NetWork | ZeroBOX

IP Address	Status	Action
108.186.87.34	Active	Moloch
164.124.101.2	Active	Moloch
185.53.177.10	Active	Moloch
198.54.114.139	Active	Moloch
198.54.117.217	Active	Moloch
34.102.136.180	Active	Moloch
44.227.65.245	Active	Moloch

Name	Response	Post-Analysis Lookup
www.noveltyporpak.xyz	A 198.54.117.218 A 198.54.117.216 A 198.54.117.217 CNAME parkingpage.namecheap.com A 198.54.117.215 A 198.54.117.212 A 198.54.117.210 A 198.54.117.211	198.54.117.216
www.putaojiau.com
www.theandrewjbrady.com	A 34.102.136.180 CNAME theandrewjbrady.com	34.102.136.180
www.legalcoloradosprings.com	A 34.102.136.180 CNAME legalcoloradosprings.com	34.102.136.180
www.lihsin.com	A 185.53.177.10	185.53.177.10
www.ameliasongsforever.com	CNAME ameliasongsforever.com A 198.54.114.139	198.54.114.139
www.sogginesses.info
www.sapphiremodule.com	A 44.227.76.166 A 44.227.65.245	44.227.76.166
www.gionakpil.com	A 108.186.87.34	108.186.87.34
www.metumuskfinance.com

TCP Requests

UDP Requests

GET 403 http://www.lihsin.com/qs23/?k0GDCl1=o1aFr5KtSv920qfmDxMrfLd6y6pwA/l3ruGXfpvzoP1TfJKE82SHCLzF3UV+gVAb2sFMcSCG&tZi0=NX1Xp

GET 301 http://www.ameliasongsforever.com/qs23/?k0GDCl1=mOW/bv2ZI17L2aRiGHyBO0k3AX3dRgTpF6jAsk5mxMOoOMPxhCVd92OSc4gI/JVNvMAPde+B&tZi0=NX1Xp

GET 0 http://www.noveltyporpak.xyz/qs23/?k0GDCl1=SDa/thlVKiuhkGOhq6+5pi6fnAt+7HKtEkOLT+kg1TEVChDSzFDgzkIOOAmifGDMjpq3vtvi&tZi0=NX1Xp

GET 403 http://www.theandrewjbrady.com/qs23/?k0GDCl1=HczVAJJS8Ob0h3rhu4NEopLGbHPYxvdn9XhTRi1N/2GlVuoE2++DpnrWDfzFWbd2z+NWTLCG&tZi0=NX1Xp

GET 403 http://www.legalcoloradosprings.com/qs23/?k0GDCl1=uM0VhG1IRz5wMznhSbXMkM7uF8gORsNKezcn1b+gyMj5WBgVWWpXHYn06fe/Fqt+l2V0Q4IB&tZi0=NX1Xp

GET 307 http://www.sapphiremodule.com/qs23/?k0GDCl1=4nH00DIdIlP16uxJcnxrWwD74hyC1jfKBUbw3YRGnC2D089bHmLxwPKwEzx4sAKOsRNjdMkG&tZi0=NX1Xp

GET 200 http://www.gionakpil.com/qs23/?k0GDCl1=5onXSvQxUjGTCM3BIa0r4MuMgPgPXvoMHysP+53Yw76tx3RAPrp4+m8nNuuPvRzOeMokdXDI&tZi0=NX1Xp

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49170 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 185.53.177.10:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 185.53.177.10:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 185.53.177.10:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 198.54.114.139:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 198.54.114.139:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 198.54.114.139:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 198.54.117.217:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 198.54.117.217:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 198.54.117.217:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 198.54.117.217:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic
TCP 192.168.56.102:49171 -> 44.227.65.245:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 44.227.65.245:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 108.186.87.34:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 44.227.65.245:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 108.186.87.34:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 108.186.87.34:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts