NetWork | ZeroBOX

IP Address	Status	Action
13.251.172.64	Active	Moloch
164.124.101.2	Active	Moloch
194.9.94.86	Active	Moloch
198.54.117.244	Active	Moloch
34.102.136.180	Active	Moloch
52.29.206.172	Active	Moloch
74.208.236.145	Active	Moloch

Name	Response	Post-Analysis Lookup
www.upinmyfeels.com	CNAME upinmyfeels.com A 34.102.136.180	34.102.136.180
www.pacifica7.com
www.kidzgovroom.com	A 34.102.136.180 CNAME kidzgovroom.com	34.102.136.180
www.jakante.com
www.conversationspit.com	A 34.102.136.180 CNAME conversationspit.com	34.102.136.180
www.pgonline111.online	A 13.251.172.64	13.251.172.64
www.gaminghallarna.net	A 194.9.94.86 A 194.9.94.85	194.9.94.85
www.rjtherealest.com	A 74.208.236.145	74.208.236.145
www.redelirevearyseuiop.xyz	A 198.54.117.244	198.54.117.244
www.totalcovidtravel.com	CNAME totalcovidtravel.com A 34.102.136.180	34.102.136.180
www.uzmdrmustafaalperaykanat.com	A 52.29.206.172 CNAME tr.docplanner.me A 18.159.10.128	52.29.206.172

TCP Requests

UDP Requests

GET 403 http://www.upinmyfeels.com/ef6c/?Bn=qu0EmkGdK39lP2qjKkkYY+FXQg5rkMbAIJtI6DFSABpZ5nF28boqJxOOjUtYwvxNL/o9/3iV&lvKh=X2MToVAP_0DHbf3

GET 301 http://www.uzmdrmustafaalperaykanat.com/ef6c/?Bn=ja7SoM3OFQT8Gg6cQsrMgEr4X7AAHRd2HQn2dp6ngt1+3x8/3G/noJ63mRQfE8+wCQKkMG6+&lvKh=X2MToVAP_0DHbf3

GET 404 http://www.pgonline111.online/ef6c/?Bn=YwrbNwP1/uOx/t5EQbsAb0agM3IyucVno+6hj+S4img8g2n6a6v8t37VHfacQRvRoazZ9RvI&lvKh=X2MToVAP_0DHbf3

GET 403 http://www.kidzgovroom.com/ef6c/?Bn=tzJrmRJzv3aPTlM/CF6MHo9U8s5+ZqDCvPfiw0R1aW0dhX7KrJSn+QKF8yUKGl3PwVlYeY7t&lvKh=X2MToVAP_0DHbf3

GET 403 http://www.conversationspit.com/ef6c/?Bn=2B3AR6Tylpqs5Gri0FIlqBRxWQiEdo1VgukX0Re3vdIAR+O8ytnn3lUzDvQXM3H/f6RyrHJq&lvKh=X2MToVAP_0DHbf3

GET 200 http://www.gaminghallarna.net/ef6c/?Bn=klh7vGPfywtzHDqBe0mXtw9R4RUvLJCc3Nh/2lv7lW0muO/R44RuNcsYgcRk+/HbCIQeLGan&lvKh=X2MToVAP_0DHbf3

GET 403 http://www.totalcovidtravel.com/ef6c/?Bn=AOAVqbk968+jHu33UUeQn7iAyru7by0I3gjPPIw/EAE0dL+8Vx6AP0T4t83EQPWP+KOBcQOK&lvKh=X2MToVAP_0DHbf3

GET 0 http://www.redelirevearyseuiop.xyz/ef6c/?Bn=+zggs108Zt88mF3I15I6Vl7MIKEVgTDkllssvVc7oGo+vC3UJFm7tcArJeeO3BpO4YdkYwbo&lvKh=X2MToVAP_0DHbf3

GET 302 http://www.rjtherealest.com/ef6c/?Bn=yyRuLH36V5D2Dmz0i9ruMhsFzlS0YjZ0uNFvdh2spF2dMn6mTJc7Wogiisuz4rZ01/rUtxwE&lvKh=X2MToVAP_0DHbf3

ICMP traffic

Source	Destination	ICMP Type	Data
192.168.56.102	164.124.101.2	3

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49170 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 34.102.136.180:80	2029711	ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1	Potentially Bad Traffic
TCP 192.168.56.102:49172 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 34.102.136.180:80	2029711	ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1	Potentially Bad Traffic
TCP 192.168.56.102:49166 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 194.9.94.86:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 194.9.94.86:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 194.9.94.86:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
UDP 192.168.56.102:59731 -> 8.8.8.8:53	2029709	ET HUNTING Suspicious Domain Request for Possible COVID-19 Domain M1	Potentially Bad Traffic
TCP 192.168.56.102:49169 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 74.208.236.145:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 74.208.236.145:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 74.208.236.145:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 13.251.172.64:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 13.251.172.64:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 13.251.172.64:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 52.29.206.172:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 52.29.206.172:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 52.29.206.172:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 198.54.117.244:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 198.54.117.244:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 198.54.117.244:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 198.54.117.244:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts