NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.19.200 Active Moloch
164.124.101.2 Active Moloch
172.67.170.122 Active Moloch
34.102.136.180 Active Moloch
35.209.90.116 Active Moloch
GET 301 http://www.numerologistreading.com/pjje/?EfBt4J58=KXVTcvbjXDD0gNgiMX+DPSy5YiGOmUOJbVJCTGBH734hiXpMW6Qv+6qjmAKa6Qo7kv8Emjmh&ohoXP=SzrlsD
REQUEST
RESPONSE
GET 301 http://www.mission-duplex.com/pjje/?EfBt4J58=kmMGCOOuyZn/Q8N+atCeYTYJw4/WIfZPwWB6wlOMycBYg5A/spRsR9LEwaIQQxcsBMDpWJd1&ohoXP=SzrlsD
REQUEST
RESPONSE
GET 403 http://www.rakennuspalveluporola.net/pjje/?EfBt4J58=tciR5RhO8AOzFF2Y0LHmIQxwfdqW3+4WiATtW4d/M7Ww/p8yIrAXWYz16zTljOVX4hXvSiko&ohoXP=SzrlsD
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49202 -> 172.67.170.122:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49202 -> 172.67.170.122:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49202 -> 172.67.170.122:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49201 -> 35.209.90.116:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49201 -> 35.209.90.116:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49201 -> 35.209.90.116:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49203 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49203 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49203 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts