NetWork | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

NetWork | ZeroBOX

IP Address	Status	Action
150.95.255.38	Active	Moloch
164.124.101.2	Active	Moloch
166.88.19.181	Active	Moloch
192.252.151.20	Active	Moloch
209.17.116.163	Active	Moloch
88.214.207.96	Active	Moloch

Name	Response	Post-Analysis Lookup
www.usedtowels.com	A 88.214.207.96	88.214.207.96
www.nsbeneae.com	A 209.17.116.163	209.17.116.163
www.swoern.info	A 150.95.255.38	150.95.255.38
www.digitalimmersioncg.com	A 192.252.151.20	192.252.151.20
www.rlgbsuilds.com	A 166.88.19.180 A 68.68.98.160 A 166.88.19.181	166.88.19.181

TCP Requests

UDP Requests

GET 302 http://www.swoern.info/hp6s/?uTuD=4T5YGQUYHOUszNOY444hn7mmf6FrtM+AFTjOJC+Py6Ag/b5xU53y9DZCTZxlx39fr7jwKFEI&Kj6dY=ATxxQ4G

GET 302 http://www.usedtowels.com/hp6s/?uTuD=LFde+ie6fWvOLN7PGF70NwTYUX7Jm/JyGjPm4XWrD0fHhgM6rcivN6x0AQjvoX504Y/z8KH4&Kj6dY=ATxxQ4G

GET 301 http://www.rlgbsuilds.com/hp6s/?uTuD=Fw5YSRn6B6q7Vo6CTsfssUahdbXa4r2ZD7nmGGCHLkY8GDkOmUQxWePCsmLEOuwwrsL9h5YF&Kj6dY=ATxxQ4G

GET 404 http://www.digitalimmersioncg.com/hp6s/?uTuD=ecMUAiyMfvfWY8rzTadGuccx8GuXMB82GuQzWJgBWyxQ3c9DaRyVLVaaQhcCvX5nneSnIplK&Kj6dY=ATxxQ4G

GET 400 http://www.nsbeneae.com/hp6s/?uTuD=SHpD87a5Dg8Vmq/a7y609SjdXnsgQw3juNG92/8unMmD+3syTbnlJP5vOUTgSZV81y/Tfjod&Kj6dY=ATxxQ4G

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49167 -> 192.252.151.20:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 192.252.151.20:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 192.252.151.20:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 209.17.116.163:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 209.17.116.163:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 209.17.116.163:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 166.88.19.181:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 166.88.19.181:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 166.88.19.181:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49164 -> 150.95.255.38:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49164 -> 150.95.255.38:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49164 -> 150.95.255.38:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49165 -> 88.214.207.96:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49165 -> 88.214.207.96:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49165 -> 88.214.207.96:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts