NetWork | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

NetWork | ZeroBOX

IP Address	Status	Action
164.124.101.2	Active	Moloch
192.254.185.89	Active	Moloch
23.227.38.74	Active	Moloch
34.102.136.180	Active	Moloch
46.4.153.33	Active	Moloch

Name	Response	Post-Analysis Lookup
www.fussionpromos.com	A 192.254.185.89 CNAME fussionpromos.com	192.254.185.89
www.sergrtr.com	CNAME shops.myshopify.com A 23.227.38.74 CNAME sergeg.myshopify.com	23.227.38.74
www.lenatwo.com	CNAME lenatwo.com A 46.4.153.33	46.4.153.33
www.vidacocktails.com	CNAME vidacocktails.com A 34.102.136.180	34.102.136.180

TCP Requests

UDP Requests

GET 403 http://www.sergrtr.com/otcl/?uVjH=mBDnt/Gh8erpdJmR5LUsgS6AYomiYv6KKx4Ciy1VWZ+lm+O2aYdlFCHe7BXtcsumDYUDE2bt&R2Mxt=MjOp3dr0kBhPCb6P

GET 301 http://www.fussionpromos.com/otcl/?uVjH=R6pBimEX126Y/7jz26NSIB+pAf+iSCkbIcynLs+ia55rI8fnMgFdof6zFKq4BsG3kSXOUZFo&R2Mxt=MjOp3dr0kBhPCb6P

GET 403 http://www.vidacocktails.com/otcl/?uVjH=rypAyBghX+oRSAWiWZi6HXfSOOQXpfwEtRIEbFlRCYHxrojr5D9YoFHDjuuw3w1SPlmQfBvX&R2Mxt=MjOp3dr0kBhPCb6P

GET 0 http://www.lenatwo.com/otcl/?uVjH=jjpdYGPxaq0GEExKffhLJbVQdJjKexSz1KEBGQRYOyI7/Bdn/luiGJqh0JO76VQxmlxEikAe&R2Mxt=MjOp3dr0kBhPCb6P

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49204 -> 23.227.38.74:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 23.227.38.74:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 23.227.38.74:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 192.254.185.89:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 192.254.185.89:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49205 -> 192.254.185.89:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 46.4.153.33:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 46.4.153.33:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49207 -> 46.4.153.33:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts