NetWork | ZeroBOX

IP Address	Status	Action
172.67.188.154	Active	Moloch
13.107.42.12	Active	Moloch
13.107.42.13	Active	Moloch
164.124.101.2	Active	Moloch
199.59.242.153	Active	Moloch
217.160.0.46	Active	Moloch
23.227.38.74	Active	Moloch
34.102.136.180	Active	Moloch
35.186.238.101	Active	Moloch
37.48.65.150	Active	Moloch
51.83.52.226	Active	Moloch
52.58.78.16	Active	Moloch
78.135.107.25	Active	Moloch
81.95.96.29	Active	Moloch

Name	Response	Post-Analysis Lookup
www.besport24.com	A 51.83.52.226 CNAME besport24.com	51.83.52.226
www.microwgreens.com	A 78.135.107.25	78.135.107.25
www.opticatervisof.com
www.aladinfarma.com	A 81.95.96.29	81.95.96.29
pxq5zw.sn.files.1drv.com	CNAME odc-sn-files-geo.onedrive.akadns.net CNAME sn-files.fe.1drv.com CNAME sn-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net A 13.107.42.12 CNAME odc-sn-files-brs.onedrive.akadns.net CNAME l-0003.l-msedge.net	13.107.42.12
www.hangrylocal.com	A 52.58.78.16	52.58.78.16
www.adenxsdesign.com	A 217.160.0.46	217.160.0.46
www.amazebrowser.com	A 37.48.65.150	199.115.115.118
www.mobiessence.com	A 52.58.78.16	52.58.78.16
www.uniamaa.com
www.riveraitc.com	CNAME shops.myshopify.com A 23.227.38.74	23.227.38.74
www.genesysshop.com	CNAME genesysshop.com A 34.102.136.180	34.102.136.180
onedrive.live.com	CNAME odc-web-geo.onedrive.akadns.net CNAME l-0004.l-msedge.net A 13.107.42.13 CNAME odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net CNAME odc-web-brs.onedrive.akadns.net	13.107.42.13
www.mylifeinpark.com	A 35.186.238.101	35.186.238.101
www.elglink99.com	A 199.59.242.153	199.59.242.153
www.ilovemehoodie.com	CNAME cadori.myshopify.com A 23.227.38.74 CNAME shops.myshopify.com	23.227.38.74

TCP Requests

UDP Requests

GET 302 https://onedrive.live.com/download?cid=7AD84143EE0A85E3&resid=7AD84143EE0A85E3%21119&authkey=AHwDCm0rHA_Fdq0

GET 200 https://pxq5zw.sn.files.1drv.com/y4mcZwEs0Fkycahq9lyprkiGjz1qGCE-GcaPdlOrH38LMa-5PibJkjvGEh-ONPJYG0qLMLL1X07PhjqnFtLNDsO9zIJxpCDz7OgzTiNDP3W77yb6ShN2X4khXphOq41piagMu1AmGUQDMn7oUZQYZVkJ4s1RQdT4WCd0cpzqqvsxM4w6UGw6RRtOx_8qrTZPyUfC4GnP_sSq0bX8uXprvPkyQ/Dxpdkclrjdrejcszbcdvtqsvfzlnpaa?download&psid=1

GET 302 https://onedrive.live.com/download?cid=7AD84143EE0A85E3&resid=7AD84143EE0A85E3%21119&authkey=AHwDCm0rHA_Fdq0

GET 200 https://pxq5zw.sn.files.1drv.com/y4myzjDL3Z-3YxdLKyKcGO-zUi33HcVwHpWr51jFLOPEYUTb9L0MeV0Q57O01geu8Y4UdFYfK507PGXsVnoxLf8UugUWnThmtUDbATUqz_CMUCzrkNL9zh4F9yrvRfCSP3jInFCjf3azhDWQ9Qo6wPJqr8pZZ6fijXRUPyE-fC-Z2AlLUb_6LO_TW14Ae7dwaS-QceiWUVgtNTphkg30A4OIA/Dxpdkclrjdrejcszbcdvtqsvfzlnpaa?download&psid=1

GET 200 http://www.elglink99.com/6mam/?rN=SLcUjScG5RnOVZMPBoDDz2hKjpXj+iqBcro/vPi5ifNBMfCnXfAsQjLgCQAIbn3ZI+l2ZT4E&Tx=XXaL1

GET 403 http://www.genesysshop.com/6mam/?rN=gbNVLwi1vO2ZsTKwdijolRE+nd+f4bOFGjLO6oLWdkpAXgcu19jDQ9iXEv77aHIk6xstCEEF&Tx=XXaL1

GET 403 http://www.ilovemehoodie.com/6mam/?rN=WcJFy0FDyb1eQp1HHEDezlfsnB+bgSZ9M5sCd3/XEWVbVLaHwBgyDt5AxetLVNVTX35rQb0V&Tx=XXaL1

GET 302 http://www.amazebrowser.com/6mam/?rN=bdYiy4dFQ1FKdK0RHZb8AKGKI6CI94rlWbRWgupG1OIMQwt3tgAXT6Nv0jCitXCfOrToZzYc&Tx=XXaL1

GET 404 http://www.adenxsdesign.com/6mam/?rN=tU44klL44EKqmodFv/jg5nrIY8m9SPufik0gg789I5xKoKlf2FGRw1yhbPhqQNhokqqERcg/&Tx=XXaL1

GET 301 http://www.besport24.com/6mam/?rN=G66iPt+xvrTiSrnWMSNY3jIG1auw/RAx4P7alq3BxDAHCc2pRDbTwTzLPU1dODy6kKEhnUhc&Tx=XXaL1

GET 403 http://www.riveraitc.com/6mam/?rN=SnhjisI499lOsf3YfO532EwcXneBDaw7KeLS1bDcRf/9DFIScc8FKAxpINBYBIfoUHjDmPpQ&Tx=XXaL1

GET 410 http://www.hangrylocal.com/6mam/?rN=36qA+yJVADGSjIyrRZyWBcFzu3O8ymRgUV+yI2TLFgVmL4h8KOdnmVSSS6y/UW1rmq4ZtmEu&Tx=XXaL1

GET 410 http://www.mobiessence.com/6mam/?rN=KE8gpfUGztMVNWKMFV5goIwNmc44LE6Oi+XDAS05rkp2RTHle1NPjBrPfhHuDJ31Wqk/Ne1S&Tx=XXaL1

GET 301 http://www.aladinfarma.com/6mam/?rN=udSG7fe6GY9zo7ZKy45gsyroZuOYrS4qDm5Wf1a6lEkS7UZsR2SStIdy4f3tNkj1uIyko7Uw&Tx=XXaL1

GET 301 http://www.microwgreens.com/6mam/?rN=spZCZghFvseg75dRXNIXCw7EhslI35bACWKDdbchv3V0SWgn9001kbyKAZoOQB4eJhmoZDU8&Tx=XXaL1

GET 403 http://www.mylifeinpark.com/6mam/?rN=djxA7LmKh1Tu4y37ItMqg4jKcWhO49sHA3kvexLhBIUDaV9dSBVXhkalQfoX2m3vAXrXaW3C&Tx=XXaL1

ICMP traffic

Source	Destination	ICMP Type	Data
192.168.56.102	164.124.101.2	3

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49167 -> 13.107.42.12:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49166 -> 13.107.42.12:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49165 -> 13.107.42.13:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49185 -> 23.227.38.74:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49185 -> 23.227.38.74:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49185 -> 23.227.38.74:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49183 -> 199.59.242.153:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49183 -> 199.59.242.153:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49183 -> 199.59.242.153:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49195 -> 78.135.107.25:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49195 -> 78.135.107.25:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49195 -> 78.135.107.25:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49189 -> 23.227.38.74:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49189 -> 23.227.38.74:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49189 -> 23.227.38.74:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49186 -> 37.48.65.150:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49186 -> 37.48.65.150:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49186 -> 37.48.65.150:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49184 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49184 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49184 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49187 -> 217.160.0.46:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49187 -> 217.160.0.46:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49187 -> 217.160.0.46:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49188 -> 51.83.52.226:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49188 -> 51.83.52.226:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49188 -> 51.83.52.226:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49196 -> 35.186.238.101:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49196 -> 35.186.238.101:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49196 -> 35.186.238.101:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49190 -> 52.58.78.16:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49190 -> 52.58.78.16:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49190 -> 52.58.78.16:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49194 -> 81.95.96.29:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49194 -> 81.95.96.29:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49194 -> 81.95.96.29:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49192 -> 52.58.78.16:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49192 -> 52.58.78.16:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49192 -> 52.58.78.16:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49167 13.107.42.12:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02	C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com	77:27:91:d8:e9:91:39:0b:f9:f9:5e:86:3e:37:d5:dc:9d:85:30:49
TLSv1 192.168.56.102:49166 13.107.42.12:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02	C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com	77:27:91:d8:e9:91:39:0b:f9:f9:5e:86:3e:37:d5:dc:9d:85:30:49
TLSv1 192.168.56.102:49165 13.107.42.13:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02	CN=onedrive.com	24:8a:fb:ed:16:0d:11:c8:2f:65:3a:66:ca:f1:6f:60:ad:4c:cc:de

Snort Alerts

No Snort Alerts