NetWork | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

NetWork | ZeroBOX

IP Address	Status	Action
164.124.101.2	Active	Moloch
193.246.38.196	Active	Moloch
34.98.99.30	Active	Moloch
81.169.145.152	Active	Moloch

Name	Response	Post-Analysis Lookup
www.210wscottstj.info	A 34.98.99.30 CNAME 210wscottstj.info	34.98.99.30
www.tenerus.info	A 193.246.38.196	193.246.38.196
www.online-jahrescoaching.com	CNAME online-jahrescoaching.com A 81.169.145.152	81.169.145.152

TCP Requests

UDP Requests

GET 301 http://www.tenerus.info/gst0/?qR-Lurxp=bc2H+CXb4LINBWU3lVJoOqaXvmmpTEGD7FcjeqVKIkzzFbbJSoSmq3taLbMHRMCHnKbjxC/N&TVjH9b=yjRhbdjx7T6

GET 404 http://www.online-jahrescoaching.com/gst0/?qR-Lurxp=HOnpgsoWu1tI0vRU7bPBS/F4WSR7tzt3WnryFXWIF038xb9/ErYOiTChbxhvsAX18t0q5uAN&TVjH9b=yjRhbdjx7T6

GET 403 http://www.210wscottstj.info/gst0/?qR-Lurxp=V3Nsub7gmgGcOwV1QiIoiFMv6QW9B7NYrLcA52cO0TiWfOKB3Ad4fSFblZAfHfNk+l3dFhw3&TVjH9b=yjRhbdjx7T6

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49169 -> 193.246.38.196:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 193.246.38.196:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 193.246.38.196:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 81.169.145.152:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 81.169.145.152:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 81.169.145.152:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 34.98.99.30:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 34.98.99.30:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 34.98.99.30:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts