NetWork | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

NetWork | ZeroBOX

IP Address	Status	Action
154.215.87.120	Active	Moloch
164.124.101.2	Active	Moloch
199.59.242.153	Active	Moloch
23.227.38.74	Active	Moloch
34.102.136.180	Active	Moloch
51.83.52.226	Active	Moloch
52.58.78.16	Active	Moloch

Name	Response	Post-Analysis Lookup
www.besport24.com	A 51.83.52.226 CNAME besport24.com	51.83.52.226
www.delhibudokankarate.com	A 154.215.87.120	154.215.87.120
www.f9fui8.xyz
www.apacshift.support
www.mobiessence.com	A 52.58.78.16	52.58.78.16
www.beastninjas.com	CNAME beastninjas.com A 34.102.136.180	34.102.136.180
www.elglink99.com	A 199.59.242.153	199.59.242.153
www.ilovemehoodie.com	CNAME cadori.myshopify.com A 23.227.38.74 CNAME shops.myshopify.com	23.227.38.74

TCP Requests

UDP Requests

GET 403 http://www.ilovemehoodie.com/6mam/?yVMpQN-P=WcJFy0FDyb1eQp1HHEDezlfsnB+bgSZ9M5sCd3/XEWVbVLaHwBgyDt5AxetLVNVTX35rQb0V&1bz=o8rLp

GET 410 http://www.mobiessence.com/6mam/?yVMpQN-P=KE8gpfUGztMVNWKMFV5goIwNmc44LE6Oi+XDAS05rkp2RTHle1NPjBrPfhHuDJ31Wqk/Ne1S&1bz=o8rLp

GET 0 http://www.delhibudokankarate.com/6mam/?yVMpQN-P=Dhv3NEq6R5NPQZs0dIik/SqBuvIY1/ydOcIgQc1Go12Tt/gNYl4yWQ2VA57WdGuU8YdfRGOR&1bz=o8rLp

GET 301 http://www.besport24.com/6mam/?yVMpQN-P=G66iPt+xvrTiSrnWMSNY3jIG1auw/RAx4P7alq3BxDAHCc2pRDbTwTzLPU1dODy6kKEhnUhc&1bz=o8rLp

GET 200 http://www.elglink99.com/6mam/?yVMpQN-P=SLcUjScG5RnOVZMPBoDDz2hKjpXj+iqBcro/vPi5ifNBMfCnXfAsQjLgCQAIbn3ZI+l2ZT4E&1bz=o8rLp

GET 403 http://www.beastninjas.com/6mam/?yVMpQN-P=oQhTdcG35KVC+c6Wc2Ae/5c2EVHHJUmgpuEXLTkVZHJt0CPiQFk8QVOcUVYqLYUeTWjjNSS/&1bz=o8rLp

ICMP traffic

Source	Destination	ICMP Type	Data
192.168.56.102	164.124.101.2	3
192.168.56.102	164.124.101.2	3
192.168.56.102	164.124.101.2	3

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49166 -> 23.227.38.74:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 23.227.38.74:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 23.227.38.74:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 199.59.242.153:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 199.59.242.153:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 199.59.242.153:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 154.215.87.120:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 154.215.87.120:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 154.215.87.120:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 52.58.78.16:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 52.58.78.16:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 52.58.78.16:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 51.83.52.226:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 51.83.52.226:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 51.83.52.226:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts