NetWork | ZeroBOX

IP Address	Status	Action
104.17.193.73	Active	Moloch
164.124.101.2	Active	Moloch
184.168.131.241	Active	Moloch
209.99.40.222	Active	Moloch
34.102.136.180	Active	Moloch
74.208.236.33	Active	Moloch
88.214.207.96	Active	Moloch

Name	Response	Post-Analysis Lookup
www.teknotelhosting.com	A 209.99.40.222	209.99.40.222
www.fil-martime.com
www.allginns.com	A 104.17.193.73 A 104.17.192.73 A 104.17.195.73 CNAME domains.vpsiteserver04.com A 104.17.196.73 A 104.17.194.73	104.17.196.73
www.worldanimaltransport.com	A 184.168.131.241 CNAME worldanimaltransport.com	184.168.131.241
www.simplebox.world	A 88.214.207.96	88.214.207.96
www.realerestate.com	CNAME realerestate.com A 34.102.136.180	34.102.136.180
www.lnxdex.com
www.urnasaurora.com	A 74.208.236.33	74.208.236.33
www.chrometoasterrv.com	CNAME chrometoasterrv.com A 34.102.136.180	34.102.136.180

TCP Requests

UDP Requests

POST 0 http://www.urnasaurora.com/qn6g/

GET 404 http://www.urnasaurora.com/qn6g/?0T0hqZ=5Y9nApRHUyNLbSfQ171lqWRj5joN9fSwp1QGW3momieNUj8sOfwA08LvtX9P3kpa1WNCZiqL&OVolp=AZ0tZJ_pEPh43080

POST 0 http://www.worldanimaltransport.com/qn6g/

GET 301 http://www.worldanimaltransport.com/qn6g/?0T0hqZ=apmNFC6wkW3L3p0KxKMAeJrXLsRqAofgoows/2qMdUZEN6MNld+3DxAiO98nziQ0UfmIglJu&OVolp=AZ0tZJ_pEPh43080

POST 0 http://www.simplebox.world/qn6g/

GET 302 http://www.simplebox.world/qn6g/?0T0hqZ=QzGdtZSg8F8akSN5k2pwjBb1FoPlCuw1Z5l/Lc1JaRwV2an5McgvcAWHPZORd5AWYai5oOn7&OVolp=AZ0tZJ_pEPh43080

POST 405 http://www.chrometoasterrv.com/qn6g/

GET 403 http://www.chrometoasterrv.com/qn6g/?0T0hqZ=Fu3e8Nqpz+5+4FFaMeLJFH8Y30L7aCtlHBAsEYD/lc+R0ObJ136ak+iAozdvD8t+lE9r+PDd&OVolp=AZ0tZJ_pEPh43080

POST 405 http://www.realerestate.com/qn6g/

GET 403 http://www.realerestate.com/qn6g/?0T0hqZ=k66MBPypCsjes+y1e9EluxPQ2Zkme3f+3eM9mAYHQz9IRw3EnYLUoNudVCGsJICkZUZ+i8GN&OVolp=AZ0tZJ_pEPh43080

POST 0 http://www.allginns.com/qn6g/

GET 301 http://www.allginns.com/qn6g/?0T0hqZ=r/7ECEpyuLrl96sv3d04QY9imYp0ltOAHLsmvfsK+GKQs1owXP9P0ZrY4mT91OO/sPuUkovN&OVolp=AZ0tZJ_pEPh43080

POST 0 http://www.teknotelhosting.com/qn6g/

GET 200 http://www.teknotelhosting.com/qn6g/?0T0hqZ=z8YI+6R51yEnnKDGqwsBPLquhlUb7UH9xAVfqr/XXjokYAlQoscKbsf1ULkytZXIFt5bhUgo&OVolp=AZ0tZJ_pEPh43080

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:65329 -> 164.124.101.2:53	2027870	ET INFO Observed DNS Query to .world TLD	Potentially Bad Traffic
TCP 192.168.56.101:49209 -> 88.214.207.96:80	2027879	ET INFO HTTP Request to Suspicious *.world Domain	Potentially Bad Traffic
TCP 192.168.56.101:49210 -> 88.214.207.96:80	2027879	ET INFO HTTP Request to Suspicious *.world Domain	Potentially Bad Traffic
TCP 192.168.56.101:49210 -> 88.214.207.96:80	2027879	ET INFO HTTP Request to Suspicious *.world Domain	Potentially Bad Traffic
TCP 192.168.56.101:49206 -> 74.208.236.33:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 74.208.236.33:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 74.208.236.33:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 104.17.193.73:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 104.17.193.73:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 104.17.193.73:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 184.168.131.241:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 184.168.131.241:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 184.168.131.241:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 88.214.207.96:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 88.214.207.96:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 209.99.40.222:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 88.214.207.96:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 209.99.40.222:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 88.214.207.96:80	2027879	ET INFO HTTP Request to Suspicious *.world Domain	Potentially Bad Traffic
TCP 192.168.56.101:49218 -> 209.99.40.222:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts