NetWork | ZeroBOX

IP Address	Status	Action
164.124.101.2	Active	Moloch
199.241.1.183	Active	Moloch
199.59.242.153	Active	Moloch
202.165.66.108	Active	Moloch
204.11.56.48	Active	Moloch
208.113.216.170	Active	Moloch
34.98.99.30	Active	Moloch
75.126.100.9	Active	Moloch
86.105.245.69	Active	Moloch

Name	Response	Post-Analysis Lookup
www.ord9route.art	A 202.165.66.108	202.165.66.108
www.nnvv942.com	CNAME nnvv942.com A 199.241.1.183	199.241.1.183
www.lamarfish.com	A 204.11.56.48	204.11.56.48
www.kjslink.com
www.bebo.xyz	A 86.105.245.69	86.105.245.69
www.centrounac.com	A 34.98.99.30 CNAME centrounac.com	34.98.99.30
www.adorotudoisso.club	A 208.113.216.170	208.113.216.170
www.mammutphilippines.com	A 199.59.242.153 CNAME 70716.BODIS.com	199.59.242.153
www.createreleaserepeat.com	A 75.126.100.9	75.126.100.9

TCP Requests

UDP Requests

GET 200 http://www.lamarfish.com/n90q/?nH=oLp1INRQcYlCIwnKN0Njm6Xoc+cRt/X9prI3xjM3Ww6ORPuYc4D5wUV8peSbJSvq5hgWAqN2&GF=6l8lMtkXCnqDR4j

GET 200 http://www.mammutphilippines.com/n90q/?nH=GiWrvS//gQ2q/hIV6Zy/o5YW6c6VukN0OH9ROBeGDhiEQY+72LoQ1NiOAxiqbd0Y0wIFk2Ut&GF=6l8lMtkXCnqDR4j

GET 301 http://www.adorotudoisso.club/n90q/?nH=+AznKtSaeUwG4Xhx64dkxKeTbLa++kdbf8CsCGDIfyM3i3hWyBe26u1HjGAigACJ/I2g9jsl&GF=6l8lMtkXCnqDR4j

GET 403 http://www.centrounac.com/n90q/?nH=4AF0SqrcHbMbXHT29t0gKs+41/yAIXWaLUNVn/nIRBk+MAbhn5ZCt0buIkQBoGEu5wc0Q/41&GF=6l8lMtkXCnqDR4j

GET 301 http://www.nnvv942.com/n90q/?nH=8fnm1kg073ztZrdYEgPG88qlh15erAvqUZr4iV0Eq8UimOtZmlwKxqbhgxKQuef6PrzJkwXT&GF=6l8lMtkXCnqDR4j

GET 302 http://www.bebo.xyz/n90q/?nH=Dro1KrF0gyNlcbSU541z19qzrfyzXKuAHParq6y5Eexi213YrSW+4q3W+dE4BNn0Eap4e/tW&GF=6l8lMtkXCnqDR4j

GET 403 http://www.createreleaserepeat.com/n90q/?nH=SsuzvQ6HV6taaD+W8X3ly66BXMf4dXdtK5LrBFfasaPP85NssPTn5/qtxMT4ZatflkGo0SY1&GF=6l8lMtkXCnqDR4j

GET 404 http://www.ord9route.art/n90q/?nH=m4pl3ok5EqTqfLMyT/hFtIlAKU9zniQdbH9l3O+ovtt51rXL7aP0rtbmfw7iHYfUW+rGLckW&GF=6l8lMtkXCnqDR4j

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49166 -> 204.11.56.48:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 199.59.242.153:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 208.113.216.170:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 204.11.56.48:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 199.59.242.153:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 204.11.56.48:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 208.113.216.170:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 199.59.242.153:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 208.113.216.170:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 199.241.1.183:80 -> 192.168.56.102:49170	2400032	ET DROP Spamhaus DROP Listed Traffic Inbound group 33	Misc Attack
TCP 192.168.56.102:49170 -> 199.241.1.183:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 199.241.1.183:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 199.241.1.183:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 34.98.99.30:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 34.98.99.30:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 34.98.99.30:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 202.165.66.108:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 202.165.66.108:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 202.165.66.108:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 86.105.245.69:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 86.105.245.69:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 86.105.245.69:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 75.126.100.9:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 86.105.245.69:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic
TCP 192.168.56.102:49172 -> 75.126.100.9:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 75.126.100.9:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts