NetWork | ZeroBOX

IP Address	Status	Action
156.231.25.88	Active	Moloch
164.124.101.2	Active	Moloch
172.67.187.204	Active	Moloch
185.14.56.84	Active	Moloch
198.49.23.145	Active	Moloch
34.102.136.180	Active	Moloch
67.199.248.13	Active	Moloch

Name	Response	Post-Analysis Lookup
www.gaigoilaocai.com	A 104.21.84.71 A 172.67.187.204	172.67.187.204
www.iqpt.info	A 67.199.248.12 CNAME iqpt.info A 67.199.248.13	67.199.248.13
www.theroseofsharonsalon.com	A 198.49.23.144 CNAME ext-sq.squarespace.com A 198.185.159.144 A 198.49.23.145 A 198.185.159.145	198.49.23.144
www.hk6628.com	A 34.102.136.180 CNAME hk6628.com	34.102.136.180
www.martabaroagency.com	A 185.14.56.84	185.14.56.84
www.cuadorcoast.com	A 156.231.25.88	156.231.25.88
www.craftbychristians.com	CNAME craftbychristians.com A 34.102.136.180	34.102.136.180
www.rizqebooks.com

TCP Requests

UDP Requests

GET 403 http://www.craftbychristians.com/wufn/?LXxP=rclXbN+KSBSlJsrhYTkKU4x5e2l7eFQRzjtsLZ0wIslBHruFqS+r6dHnex4dI2ICZk3527X7&tTrt=ndfHUnBht8

GET 403 http://www.hk6628.com/wufn/?LXxP=Mbz3eb2htBuwJm9my9qYpH4UWvi7L1jn54VVewVZerqVccc7GhECZ0+c8NYoPjvN/okzts0t&tTrt=ndfHUnBht8

GET 302 http://www.iqpt.info/wufn/?LXxP=hrdaP+EsGTITsCagZnHefT6Bmc518UuvQeiOjF2tcIDpZFKKlutoy9+nHdETp4OhFNJGJnoo&tTrt=ndfHUnBht8

GET 301 http://www.gaigoilaocai.com/wufn/?LXxP=+cvcaH9t4IGOvfSH2s/pGQCzCoMlKLNX9S4pg+CdqO+ehvTRSw4m6C0WiIEOYf+cYXNRRXby&tTrt=ndfHUnBht8

GET 400 http://www.theroseofsharonsalon.com/wufn/?LXxP=OadTn2uJtzT8oubefSjMAoLtzsAZKEPGGNEB1Q92m5bHHV2MxPvD7WU/WfzEYQpZzBC6ZQgQ&tTrt=ndfHUnBht8

GET 0 http://www.cuadorcoast.com/wufn/?LXxP=kYzY+WOATOJvl0LGKoTI9L4ky9M8/RXPaPgWsg9EorAZ9N2DAW9xe5TyjlQCxAJLBvRqjfNR&tTrt=ndfHUnBht8

GET 404 http://www.martabaroagency.com/wufn/?LXxP=r0PGHSY2SUcZB8VeRTqckmU+v7wbtMF1fJATAoKMkp5jXhuYZ6C7mu0EbtSkXg+d4UfDPRR1&tTrt=ndfHUnBht8

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49168 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 172.67.187.204:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 172.67.187.204:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 172.67.187.204:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 198.49.23.145:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 198.49.23.145:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 198.49.23.145:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 156.231.25.88:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 156.231.25.88:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 156.231.25.88:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 67.199.248.13:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 67.199.248.13:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 67.199.248.13:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 185.14.56.84:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 185.14.56.84:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 185.14.56.84:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts