NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.78.41 Active Moloch
108.167.135.122 Active Moloch
164.124.101.2 Active Moloch
199.59.242.153 Active Moloch
34.102.136.180 Active Moloch
74.125.204.121 Active Moloch
POST 405 http://www.ecarehomes.com/fqiq/
REQUEST
RESPONSE
GET 403 http://www.ecarehomes.com/fqiq/?tXU4=kE7Vu6vPDcd1WfWVKKteHdpK4u5SUBt14Yatq6Mzh32VxiCRLzk8hIpR+XL7Q/vEg46arPR2&Ulq86=GTgP1na8nVSXkp
REQUEST
RESPONSE
POST 302 http://www.hirayaawards.com/fqiq/
REQUEST
RESPONSE
GET 302 http://www.hirayaawards.com/fqiq/?tXU4=ioMS2OB6gtffPyZHC2v0o2NbJMBvgda4J5Uj88jwpqxw8lz3q3Yy68AoxtXePEBB3Y0v4zlH&Ulq86=GTgP1na8nVSXkp
REQUEST
RESPONSE
POST 404 http://www.esyscoloradosprings.com/fqiq/
REQUEST
RESPONSE
POST 0 http://www.srofkansas.com/fqiq/
REQUEST
RESPONSE
GET 200 http://www.srofkansas.com/fqiq/?tXU4=wFDpWBcybTtkZf6rJwxG8GxnrXCHdVwe5dpvC2P+G/35kvGl/Iz1QduPYt3eFaCRSD2mr4cI&Ulq86=GTgP1na8nVSXkp
REQUEST
RESPONSE
POST 0 http://www.healthyweekendtips.com/fqiq/
REQUEST
RESPONSE
GET 301 http://www.healthyweekendtips.com/fqiq/?tXU4=nFNrhldW1G3Iuc6NBw1UbSwwpktYb/50pHeyo/0a7tjLnrEnAw7KG36PTjcGJ5KEduXnU9Wd&Ulq86=GTgP1na8nVSXkp
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49206 -> 74.125.204.121:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 74.125.204.121:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 74.125.204.121:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 108.167.135.122:80 -> 192.168.56.101:49208 2221010 SURICATA HTTP unable to match response to request Generic Protocol Command Decode
TCP 192.168.56.101:49210 -> 199.59.242.153:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 199.59.242.153:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 199.59.242.153:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 108.167.135.122:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 108.167.135.122:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 108.167.135.122:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 104.21.78.41:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 104.21.78.41:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 104.21.78.41:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts