NetWork | ZeroBOX

IP Address	Status	Action
104.161.87.37	Active	Moloch
164.124.101.2	Active	Moloch
185.162.228.1	Active	Moloch
185.163.46.131	Active	Moloch
192.254.187.234	Active	Moloch
34.102.136.180	Active	Moloch
45.141.152.18	Active	Moloch

Name	Response	Post-Analysis Lookup
www.gobahis119.com	A 185.162.228.1	185.162.228.1
www.xn--marketingrevolucin-61b.com	CNAME xn--marketingrevolucin-61b.com A 192.254.187.234	192.254.187.234
www.magemutfak.com	A 104.161.87.37	104.161.87.37
www.finopscert.com	CNAME finopscert.com A 34.102.136.180	34.102.136.180
www.mamafacil.com	A 34.102.136.180 CNAME mamafacil.com	34.102.136.180
www.dollaroneshop.com	CNAME dollaroneshop.com A 185.163.46.131	185.163.46.131
www.whizdomtowealth.com	CNAME whizdomtowealth.com A 34.102.136.180	34.102.136.180

TCP Requests

UDP Requests

GET 301 http://www.xn--marketingrevolucin-61b.com/b6cu/?9r4P2=80ZGTxB/QLnIHkS3oVNq0ZJzfRpffLFocOm3eB+jN4m0j2EGAAjOfaPeawF6LJbltlmb2qM2&EjU4Sz=gdMTVRIPlB

GET 301 http://www.dollaroneshop.com/b6cu/?9r4P2=hphj0fSPebsUG4+TPU9kXIDabXbQWsVnKmp+Geflc4GVcaDo89Rdm4LDqBFd7omdrUO+Pnv9&EjU4Sz=gdMTVRIPlB

GET 403 http://www.mamafacil.com/b6cu/?9r4P2=ulZMiMAzIKxhCGouzIDoJ/Atu1WGElL9zoNZgIyVxCGswo8wIs4Bs3aWeOM7i+Qcx5tOIEpw&EjU4Sz=gdMTVRIPlB

GET 403 http://www.whizdomtowealth.com/b6cu/?9r4P2=WjPAXh0JYubKQSuUuSCFbEny3O8VuxfrPqKNQoPqg5IJ+LtGQnBlfQrfzBHE5mLPoToVPehd&EjU4Sz=gdMTVRIPlB

GET 409 http://www.gobahis119.com/b6cu/?9r4P2=ruZ6cerXGD0yWecTiOU8HeUU0cRUEGerShblZmZFkrYahfnG07S/JtCKsaKAEdVecZbcrXhx&EjU4Sz=gdMTVRIPlB

GET 404 http://www.magemutfak.com/b6cu/?9r4P2=Zpu4P68kNZXiC9zzvTuPbsld3Ho+TwI+n/8Z+x1909ORVtO1OWbnp1J3pdDQ09qd2uvqchNa&EjU4Sz=gdMTVRIPlB

GET 403 http://www.finopscert.com/b6cu/?9r4P2=XrfnOBkNkkBKgnbpDotVd9Wt38azE7kGf8JADJoXDG3y8ykdxWX2zrtWAHRCNr2g6Gs3kUui&EjU4Sz=gdMTVRIPlB

ICMP traffic

Source	Destination	ICMP Type	Data
192.168.56.102	164.124.101.2	3

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49178 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49178 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49178 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49177 -> 185.163.46.131:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49177 -> 185.163.46.131:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49177 -> 185.163.46.131:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49179 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49179 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49179 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49180 -> 185.162.228.1:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49180 -> 185.162.228.1:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49180 -> 185.162.228.1:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49182 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49182 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49182 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49181 -> 104.161.87.37:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49181 -> 104.161.87.37:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49181 -> 104.161.87.37:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49176 -> 192.254.187.234:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49176 -> 192.254.187.234:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49176 -> 192.254.187.234:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts