NetWork | ZeroBOX

IP Address	Status	Action
156.237.130.173	Active	Moloch
156.241.53.161	Active	Moloch
163.43.122.119	Active	Moloch
163.44.239.73	Active	Moloch
164.124.101.2	Active	Moloch
18.236.1.157	Active	Moloch
34.102.136.180	Active	Moloch
52.58.78.16	Active	Moloch

Name	Response	Post-Analysis Lookup
www.hfjxhs.com	A 156.241.53.161	156.241.53.161
www.fuhaitongxin.com	A 156.237.130.173	156.237.130.173
www.3cheer.com	CNAME 3cheer.com A 34.102.136.180	34.102.136.180
www.69-1hn7uc.net	A 163.43.122.119	163.43.122.119
www.alfenas.info	CNAME alfenas.info A 34.102.136.180	34.102.136.180
www.newmopeds.com	A 52.58.78.16	52.58.78.16
www.adultpeace.com	A 163.44.239.73 CNAME adultpeace.com	163.44.239.73
www.dreamcashbuyers.com	CNAME sites.propelio.com CNAME sites-external-prod-ebc852aa8146fe7f.elb.us-west-2.amazonaws.com A 18.236.1.157 A 54.69.66.227 A 34.215.222.250	54.69.66.227

TCP Requests

UDP Requests

GET 301 http://www.adultpeace.com/p2io/?lDKpx8o=4oufm6g7w9cVhgu+mDBWoA8I6Q2bNaX51teMhl/6i5f1woTl8Y4Ohfe29cQ9y7IaJQfIj0iK&Kzux=PnjtQf7hih

GET 404 http://www.fuhaitongxin.com/p2io/?lDKpx8o=CqJktM7UGR26O9R1i2rMnV6ue2YAEq5Rd3PPV6e4Hl6CDdUsDohA0iBr0JiOXGWnot9DaOMs&Kzux=PnjtQf7hih

GET 301 http://www.dreamcashbuyers.com/p2io/?lDKpx8o=H0m9fF/7YLmrrfUIC4653EpAABAppk+gPA36EdDaEoCMlE2zCVYj52aQtiOQLLDBcMq8ZjGa&Kzux=PnjtQf7hih

GET 403 http://www.3cheer.com/p2io/?lDKpx8o=hDwxgnCzatE5+wdV9NFToL98ekU0apx9FaU6+ccHPOP6vOP89MFb32Jn1B2/14jOCK3bXPvO&Kzux=PnjtQf7hih

GET 302 http://www.hfjxhs.com/p2io/?lDKpx8o=DTtQlm+Z53HZQQxwVrobrkMYYvpq+NlfspfnNNuMzI98GFQb/uTk0OsIpqJyOE0lLdOWa4eE&Kzux=PnjtQf7hih

GET 302 http://www.69-1hn7uc.net/p2io/?lDKpx8o=V9Q6YNEu7TOfvwp76j8RVRt0udPCykKEN/raiLh+TizfOzW/z4mr+Qw1L4Mcx+Q4bIGaE8v/&Kzux=PnjtQf7hih

GET 403 http://www.alfenas.info/p2io/?lDKpx8o=qSqSgno9cBloRqN5VLtR5zfvl4qKeuO7jrdOV5f2r4ZX0X85kelskx3YtL4YRmLXGzhxb6Nv&Kzux=PnjtQf7hih

GET 410 http://www.newmopeds.com/p2io/?lDKpx8o=bSK1RxPLajIrf62nOJ2LeA3okZHmhG3V4GBmTatllgIVkFsFULHDN0cIL5FJcRS/4igqPa1G&Kzux=PnjtQf7hih

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49172 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 18.236.1.157:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 18.236.1.157:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 18.236.1.157:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 156.241.53.161:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 156.241.53.161:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 156.241.53.161:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 163.43.122.119:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 163.43.122.119:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 163.43.122.119:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49176 -> 52.58.78.16:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49176 -> 52.58.78.16:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49176 -> 52.58.78.16:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 163.44.239.73:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 163.44.239.73:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 163.44.239.73:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 156.237.130.173:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 156.237.130.173:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 156.237.130.173:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts