NetWork | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

NetWork | ZeroBOX

IP Address	Status	Action
164.124.101.2	Active	Moloch
34.102.136.180	Active	Moloch
34.80.190.141	Active	Moloch
52.58.78.16	Active	Moloch

Name	Response	Post-Analysis Lookup
www.sierp.com	A 52.58.78.16	52.58.78.16
www.richardggreenhill.com	CNAME www74.wixdns.net A 34.80.190.141 CNAME td-balancer-ae1-190-141.wixdns.net CNAME 47363d5c-balancer.wixdns.net CNAME balancer.wixdns.net	34.80.190.141
www.sacredkashilifestudio.net	CNAME sacredkashilifestudio.net A 34.102.136.180	34.102.136.180

TCP Requests

UDP Requests

GET 403 http://www.sacredkashilifestudio.net/mxwf/?Ezu=eipsewIB2PU7fLq0V+MVTYpseXSXiNmBphXFeMyyAJ/wgZWHvgK6rmKFdWqq2CZ89/HqMPFu&Rxo=M6hH4XnpE45t

GET 301 http://www.richardggreenhill.com/mxwf/?Ezu=U68BUADVnBX1mfOYklbFYycAs+6aum+kmxds/l9wjQNa05UKM3zcbxraq+dmUoXPsoua5S44&Rxo=M6hH4XnpE45t

GET 410 http://www.sierp.com/mxwf/?Ezu=Ao4ZudGNGCCq/bz1F1jp8r1nNp3jUASgPiEiflfcY9lwBGukS/0V2qMMjZrQt7h4MdjTjHfn&Rxo=M6hH4XnpE45t

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49166 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 52.58.78.16:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 52.58.78.16:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 52.58.78.16:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 34.80.190.141:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 34.80.190.141:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 34.80.190.141:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts