NetWork | ZeroBOX

IP Address	Status	Action
103.224.182.243	Active	Moloch
118.27.99.26	Active	Moloch
133.167.77.233	Active	Moloch
145.239.189.1	Active	Moloch
154.91.194.130	Active	Moloch
162.241.216.125	Active	Moloch
164.124.101.2	Active	Moloch
34.102.136.180	Active	Moloch
66.235.200.146	Active	Moloch

Name	Response	Post-Analysis Lookup
www.3503322.com	A 154.91.194.130	154.91.194.130
www.rimanchallenge.com	A 118.27.99.26	118.27.99.26
www.ypassociatesfue.com	CNAME ypassociatesfue.com A 66.235.200.146	66.235.200.146
www.ambientcommunity.com	CNAME ambientcommunity.com A 34.102.136.180	34.102.136.180
www.signtosavelives.info
www.natjurals.com	CNAME natjurals.com A 162.241.216.125	162.241.216.125
www.triplerb.net	CNAME triplerb.net A 34.102.136.180	34.102.136.180
www.facilmkt.com	CNAME facilmkt.com A 145.239.189.1	145.239.189.1
www.xn--u9jy72gkoryg6abnb.com	A 133.167.77.233	133.167.77.233
www.cityedirectory.com	A 103.224.182.243	103.224.182.243

TCP Requests

UDP Requests

GET 301 http://www.natjurals.com/o9pi/?JR-=7gA2nshU5oHcBaZY+ijQuPNpnYwMStAdL6cHORIxWU958uWY5q/GQE3Q+KIcK4hDlf6TgzHT&ob30qv=R2JDx2

GET 301 http://www.xn--u9jy72gkoryg6abnb.com/o9pi/?JR-=dw42vcc5H4cJtOS2xFTuvaFHfjF2n7qc0CL/kbiqYyrqDrRUwY25eQioZqzEDrHsyKZ/3+Jp&ob30qv=R2JDx2

GET 301 http://www.rimanchallenge.com/o9pi/?JR-=Ryj/ZHe86eGzdfhYpxxiW1EUL3bgOORdifsAzXuDJZVsJm+RzRFHhoTWBkx5uSPCD90XO6NN&ob30qv=R2JDx2

GET 403 http://www.ambientcommunity.com/o9pi/?JR-=y3S9oTK7ZTucHHHaCr+21MXTMaess5Kpzx7PDWAO8SVqgAMxhMAouzFjMrnVr8YtRm2uWSCI&ob30qv=R2JDx2

GET 403 http://www.triplerb.net/o9pi/?JR-=8LaaYBm3TSp0+Dsx63LIWRHbTa3sjACgPwATmM7mqou8RBHT8Uw6M3CNCc2vcCxOxjhGpp/k&ob30qv=R2JDx2

GET 0 http://www.ypassociatesfue.com/o9pi/?JR-=vJomEIO82ceFaeQdGLXRxUlnCwW32HRBD6KZ4caxEoTRh0t+XtMFapojsRpKLHNlWhKIhEvP&ob30qv=R2JDx2

GET 302 http://www.cityedirectory.com/o9pi/?JR-=z/X5Ze4UBjOWalfkHW1NeAdw2uJ9YkKssi0Q0RRRmjAem/VT1deVvUmI69DgCb1bDTAfesF6&ob30qv=R2JDx2

GET 404 http://www.3503322.com/o9pi/?JR-=mIG2xLW65f/VY2T7w/n5w3CohzNjrv59+Q+RRLKIWVzRM3IbGYEkjA8oEFQSpfhxI62o55rd&ob30qv=R2JDx2

GET 301 http://www.facilmkt.com/o9pi/?JR-=U2rBSRZonOR8QiGC5jupmy09eLApZ5QLMo35m9jcydH8ukRQYzN10iXvj8MOBJVycEsRfwTX&ob30qv=R2JDx2

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49167 -> 162.241.216.125:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 162.241.216.125:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 162.241.216.125:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 66.235.200.146:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 66.235.200.146:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 66.235.200.146:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 154.91.194.130:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 154.91.194.130:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 154.91.194.130:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 118.27.99.26:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 118.27.99.26:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 118.27.99.26:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 103.224.182.243:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 103.224.182.243:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 103.224.182.243:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 133.167.77.233:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 133.167.77.233:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 133.167.77.233:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 145.239.189.1:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 145.239.189.1:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 145.239.189.1:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts