NetWork | ZeroBOX

IP Address	Status	Action
1.32.255.137	Active	Moloch
142.250.66.147	Active	Moloch
164.124.101.2	Active	Moloch
172.217.24.68	Active	Moloch
182.50.132.242	Active	Moloch
185.15.197.14	Active	Moloch
23.227.38.74	Active	Moloch
31.11.36.5	Active	Moloch
34.102.136.180	Active	Moloch
34.98.99.30	Active	Moloch
45.200.120.200	Active	Moloch
45.76.85.102	Active	Moloch
81.88.57.68	Active	Moloch
86.105.245.69	Active	Moloch

Name	Response	Post-Analysis Lookup
www.laliinparfumeri.com	A 185.15.197.14 CNAME laliinparfumeri.com	185.15.197.14
www.pawcomart.com	CNAME pawcomart.com A 34.102.136.180	34.102.136.180
www.164661.com	A 1.32.255.137	1.32.255.137
www.soins-sophro.website	CNAME onstatic-fr.setupdns.net A 81.88.57.68	81.88.57.68
www.sednayachts.com	CNAME sednayachts.com A 34.102.136.180	34.102.136.180
www.google.com	A 172.217.24.68	172.217.174.100
www.englishforbreakfast.com	A 31.11.36.5	31.11.36.5
www.tonesify.com	A 86.105.245.69	86.105.245.69
www.nesboutiqe.com	CNAME nesboutiqe.com A 45.200.120.200	45.200.120.200
www.plataformasoma.net
www.livetvnews24.com	CNAME ghs.google.com A 142.250.66.147	142.251.42.147
www.noalareelecionindefinida.com	CNAME noalareelecionindefinida.com A 182.50.132.242	182.50.132.242
www.survivalfresh.com	A 34.98.99.30 CNAME survivalfresh.com	34.98.99.30
www.lyketigers.com	CNAME lyketigers.com A 34.102.136.180	34.102.136.180
www.aisle5.store	CNAME shops.myshopify.com A 23.227.38.74	23.227.38.74
www.growversa.com	CNAME growversa.com A 45.76.85.102	45.76.85.102

TCP Requests

UDP Requests

GET 200 https://www.google.com/

GET 200 https://www.bing.com/

GET 301 http://www.nesboutiqe.com/ntfs/?AjR=0AZpuU1lOai/c3CFYAglV3LWApx0HI/ymZlC3B0dBStOc3qSnIN3lUvYiRyaPsUKmnHjuct2&ndndsT=KdvDIh08e8D4

GET 404 http://www.soins-sophro.website/ntfs/?AjR=kF66ll0Um1jo8iklno67xUTptp8D/61uY/Y7h45ITxQ0tPbmVeSluOpT2Cq4/G4DLgLc5y45&ndndsT=KdvDIh08e8D4

GET 403 http://www.aisle5.store/ntfs/?AjR=JiVfHxsQIUZIVOrZdasW0XDgZGDHbuQkpfVpZdXmV082HGIoqOCfLlCi+Z81v5cq8/OBmvs4&ndndsT=KdvDIh08e8D4

GET 301 http://www.englishforbreakfast.com/ntfs/?AjR=3i72MLA1eJ23KItbm1vJ6YRASBd+2eIAAK9eDTlV/1BpCv8kby1iQl4I3Y535oeWZTKakmdB&ndndsT=KdvDIh08e8D4

GET 403 http://www.survivalfresh.com/ntfs/?AjR=21tLgbP2yagke5ca39MMCkaTw3ul+25tQiZH/vehq0MisVUMvB6xQMdWVewG09mnNKvW1Jqi&ndndsT=KdvDIh08e8D4

GET 301 http://www.growversa.com/ntfs/?AjR=77KnmNOuKLtpENzAkQuq2gNmvUW4CHqnjVAqaPll/fIdfZHCrb/Qpm1ltv8IJzs1z9eKUWdP&ndndsT=KdvDIh08e8D4

GET 403 http://www.lyketigers.com/ntfs/?AjR=GAYoP5SBXtEJMk1r7XxckxlvOWPYxqX0P7cMtyu4khc4paR1vfQmhhKA4Vf/9ulLTXCCdtNN&ndndsT=KdvDIh08e8D4

GET 301 http://www.livetvnews24.com/ntfs/?AjR=WWBf0ejULkkWCGhGgTCASpPE+YBI6b/V2JT0klCOaSo8CpBxqsqIUL1am+XWR9RFDjFFrYDz&ndndsT=KdvDIh08e8D4

GET 301 http://www.164661.com/ntfs/?AjR=EQGFpvzmjJ01FBcJ82kVFjhH2vYYK8cPxl1D6Cz1nlh+Zn0dJbcoKaYC/GcRTMOob/2YoFxj&ndndsT=KdvDIh08e8D4

GET 403 http://www.pawcomart.com/ntfs/?AjR=+h+pxPcrngPOC8DSeBps7fK+M6H9abOtW9PHZY+UHB6fdPPxF9r9GWz81ir9o9+4HBhkJXpk&ndndsT=KdvDIh08e8D4

GET 301 http://www.laliinparfumeri.com/ntfs/?AjR=659NitD4XNMpAA5H+/pz8DnE6u+OgBpPVYj1y9JqI+QCevyhn+u5eqFdNfdyGPZBpQ3K+5wu&ndndsT=KdvDIh08e8D4

GET 302 http://www.tonesify.com/ntfs/?AjR=XayKz9N33Y7MmipE5fqv+pwyVwXNcPO1Ok9qLtTzsjUVdppRPVF79P0o009gNfu+TLiF4Hsh&ndndsT=KdvDIh08e8D4

GET 400 http://www.noalareelecionindefinida.com/ntfs/?AjR=dYZXaQ1KnAs1iIfz+GCmlR8GbRfWCjtzJ+9RQt2hFNiEXT8n/q07/spfuGdSq2ifGUCapvn7&ndndsT=KdvDIh08e8D4

GET 403 http://www.sednayachts.com/ntfs/?AjR=yWWLGy5N757qGygxfTz2VpgR61VSaqzwvTV90moS0mb9EpVeiTqg4EAujagaLLOCRusgD2OW&ndndsT=KdvDIh08e8D4

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49165 -> 172.217.24.68:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49167 -> 204.79.197.200:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49174 -> 23.227.38.74:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 34.98.99.30:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 23.227.38.74:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 34.98.99.30:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 23.227.38.74:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 34.98.99.30:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 185.15.197.14:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 185.15.197.14:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 185.15.197.14:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49184 -> 182.50.132.242:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 31.11.36.5:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49184 -> 182.50.132.242:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49184 -> 182.50.132.242:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 31.11.36.5:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 31.11.36.5:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 81.88.57.68:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 81.88.57.68:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 81.88.57.68:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 142.250.66.147:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 142.250.66.147:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 142.250.66.147:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49180 -> 1.32.255.137:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49180 -> 1.32.255.137:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49180 -> 1.32.255.137:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 45.76.85.102:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 45.76.85.102:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 45.76.85.102:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 45.200.120.200:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 45.200.120.200:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 45.200.120.200:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49183 -> 86.105.245.69:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49183 -> 86.105.245.69:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49183 -> 86.105.245.69:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49181 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49181 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49181 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49165 172.217.24.68:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1C3	CN=www.google.com	81:d3:b1:30:44:e4:01:e1:77:92:f3:6a:43:36:6a:ad:ee:99:4f:36
TLSv1 192.168.56.103:49167 204.79.197.200:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02	CN=www.bing.com	af:e3:17:ed:18:4a:d9:1c:24:8a:89:d5:ac:11:b3:27:96:02:37:c8

Snort Alerts

No Snort Alerts