NetWork | ZeroBOX

Network Analysis

IP Address Status Action
107.161.23.204 Active Moloch
164.124.101.2 Active Moloch
185.4.31.82 Active Moloch
192.0.78.24 Active Moloch
209.17.116.163 Active Moloch
34.102.136.180 Active Moloch
POST 0 http://www.mezonpezon.com/arup/
REQUEST
RESPONSE
GET 301 http://www.mezonpezon.com/arup/?o2=UNxFnBumKBpgK3E6newINllmoiRNFeGsN9mFY9q/k3SwkriE4cKly4sUG2g85kP3rxM+0vbe&wR=BDKh2baXl4PtG
REQUEST
RESPONSE
POST 301 http://www.talkingpoint.tours/arup/
REQUEST
RESPONSE
GET 301 http://www.talkingpoint.tours/arup/?o2=2Bor36X4yMIxjbsNw9nIp5JqVEJ42O++igCdDW+bLrYPiTD/F7oXSRDD+M1zQEcm+TanyebS&wR=BDKh2baXl4PtG
REQUEST
RESPONSE
POST 0 http://www.royaltortoisecookieco.online/arup/
REQUEST
RESPONSE
GET 400 http://www.royaltortoisecookieco.online/arup/?o2=xicXbxHz/T/GJ6xhDm1KxNKS1jpnVDDPGy0hKxh11bForUynj74u7eHQ98aodg6MscVdd2su&wR=BDKh2baXl4PtG
REQUEST
RESPONSE
POST 405 http://www.cupecoysuites.com/arup/
REQUEST
RESPONSE
GET 403 http://www.cupecoysuites.com/arup/?o2=RwnhE8KYKqsc5MSZ6w7FRLZ4FQLQ/7KQra0CoHItoXR0D3A2SypYSixvdgQRpZ3QFM6Mzxlq&wR=BDKh2baXl4PtG
REQUEST
RESPONSE
POST 403 http://www.gzwqpsyj.com/arup/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49212 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 185.4.31.82:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 185.4.31.82:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 185.4.31.82:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 192.0.78.24:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 192.0.78.24:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 192.0.78.24:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 209.17.116.163:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 209.17.116.163:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 209.17.116.163:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts