NetWork | ZeroBOX

IP Address	Status	Action
118.27.122.218	Active	Moloch
154.208.173.49	Active	Moloch
164.124.101.2	Active	Moloch
184.164.70.9	Active	Moloch
185.53.179.94	Active	Moloch
208.91.197.91	Active	Moloch
23.227.38.74	Active	Moloch
34.102.136.180	Active	Moloch
35.214.244.56	Active	Moloch
37.123.118.150	Active	Moloch
89.31.143.1	Active	Moloch

Name	Response	Post-Analysis Lookup
www.saamcoheir.quest	A 37.123.118.150	37.123.118.150
www.libbybruce.space	CNAME shops.myshopify.com A 23.227.38.74	23.227.38.74
www.suvsangebotguenstigdeorg.com	A 185.53.179.94	185.53.179.94
www.preadmirer.info
www.mudatstudio.com	A 35.214.244.56	35.214.244.56
www.baumer-instruments.com	A 89.31.143.1	89.31.143.1
www.drfgr1.com
www.redherring.agency	CNAME redherring.agency A 34.102.136.180	34.102.136.180
www.pochi-owarai.com	A 118.27.122.218	118.27.122.218
www.jeetopesekashback.xyz
www.bercatv.com	A 154.208.173.49	154.208.173.49
www.chatelab.network	CNAME chatelab.network A 34.102.136.180	34.102.136.180
www.secure01bchslogin.com	CNAME secure01bchslogin.com A 184.164.70.9	184.164.70.9
www.apnagas.com	A 208.91.197.91	208.91.197.91

TCP Requests

UDP Requests

POST 405 http://www.redherring.agency/hr8n/

GET 403 http://www.redherring.agency/hr8n/?MZg8=Msb0E+nHxXTk+kRHU817jyd7jk0ZtYL78GCylVtt06iZTpAscdQZhKi5jYPsypr0fRcRxBIc&uTxXo=ojOPdxR8gB

POST 0 http://www.libbybruce.space/hr8n/

GET 403 http://www.libbybruce.space/hr8n/?MZg8=tvOOJymLPTo+u55ddd5JgP/eYwawdK1IFhff86iTT/s0UFVHuQ3vbuf5ifvAKeBftP33/qgK&uTxXo=ojOPdxR8gB

POST 0 http://www.bercatv.com/hr8n/

GET 0 http://www.bercatv.com/hr8n/?MZg8=/yRRgDSwLMsWxKA4f5KuELmjy/mqUWJqcFQmTFbv5od3MFYL2Xoy8Nze6PPGHjgxg3JBbnV1&uTxXo=ojOPdxR8gB

POST 0 http://www.suvsangebotguenstigdeorg.com/hr8n/

GET 403 http://www.suvsangebotguenstigdeorg.com/hr8n/?MZg8=0uz0Q17Sfx93I9QMDgfv2FcHKGK5h9rfNO4V9s+zrmjnR/7GYJXF1g44bJEkuz64Y6KiX6Qm&uTxXo=ojOPdxR8gB

POST 405 http://www.chatelab.network/hr8n/

GET 403 http://www.chatelab.network/hr8n/?MZg8=3oN9XgLBJtDXNs2zngQn2dVK6Uxi1QAVFf1LLML5AQ9srmgBfwUts4HpZdFn/GyEF4+HDuxo&uTxXo=ojOPdxR8gB

POST 301 http://www.pochi-owarai.com/hr8n/

GET 301 http://www.pochi-owarai.com/hr8n/?MZg8=wgLDzEI7JM5HW3UGruAf3rNm8/j8NE+Zr86Wwng2vxqt30foW8WvIulUjY9BDwGT0AcSiOsT&uTxXo=ojOPdxR8gB

POST 403 http://www.saamcoheir.quest/hr8n/

POST 0 http://www.mudatstudio.com/hr8n/

GET 0 http://www.mudatstudio.com/hr8n/?MZg8=gUaQ/+3s/kFGf10Bdd8lj7WBkIz9GsQxMveD/qPqZzJE0ReW2q5Df9vdRW11VznkrH2iE1ue&uTxXo=ojOPdxR8gB

POST 403 http://www.secure01bchslogin.com/hr8n/

GET 404 http://www.secure01bchslogin.com/hr8n/?MZg8=/xCQRyoVMWVnh23tRG8vfAMo2MFBA+pRIDM06yAvE/Fg6D1CIShQVBVEbqNYVVAHcuTqles7&uTxXo=ojOPdxR8gB

POST 405 http://www.baumer-instruments.com/hr8n/

GET 200 http://www.baumer-instruments.com/hr8n/?MZg8=q42LDbLer29Q12jt65bKw12quuQGKu9GNRKcDfylwoI+Av0krotLDNZCIm4LxOiWVzWcVna9&uTxXo=ojOPdxR8gB

POST 0 http://www.apnagas.com/hr8n/

GET 200 http://www.apnagas.com/hr8n/?MZg8=pMGdtUWSDrqidj5eJ3dEayK/o6OFfDVrqiV5PnaA2tMYsbhRHtR8TpoDkey3LlwoIKw9ab9x&uTxXo=ojOPdxR8gB

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49204 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 23.227.38.74:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 23.227.38.74:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 23.227.38.74:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49223 -> 89.31.143.1:80	2221045	SURICATA HTTP Unexpected Request body	Generic Protocol Command Decode
TCP 192.168.56.101:49221 -> 184.164.70.9:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49221 -> 184.164.70.9:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49221 -> 184.164.70.9:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49225 -> 208.91.197.91:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49225 -> 208.91.197.91:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49225 -> 208.91.197.91:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 35.214.244.56:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 35.214.244.56:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 35.214.244.56:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 185.53.179.94:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 185.53.179.94:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 185.53.179.94:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 154.208.173.49:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 154.208.173.49:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 154.208.173.49:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 118.27.122.218:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 118.27.122.218:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 118.27.122.218:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts