NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.165.34.6 Active Moloch
164.124.101.2 Active Moloch
34.102.136.180 Active Moloch
75.2.115.196 Active Moloch
POST 405 http://www.tablescaperendezvous4two.com/fqiq/
REQUEST
RESPONSE
GET 403 http://www.tablescaperendezvous4two.com/fqiq/?v4=6JOAu55ahQuW4nGm3x3zF3lJbu5eEm2HTNrnzqBc/qIL0noTMPzpzXdnuN9xnnUaregthFw6&nt=V48Hzvcp
REQUEST
RESPONSE
POST 0 http://www.wolmoda.com/fqiq/
REQUEST
RESPONSE
GET 403 http://www.wolmoda.com/fqiq/?v4=S+cpy0umECTwuTE52eQvldFGZ7uWQHdiwg92XpTlC9HPK4+x2Wa76IO+IolmVoAcN8bu+dPq&nt=V48Hzvcp
REQUEST
RESPONSE
POST 405 http://www.doggycc.com/fqiq/
REQUEST
RESPONSE
GET 403 http://www.doggycc.com/fqiq/?v4=tdw/kGidBWNf5mG6fHQmMwAAiMBNQnR2khavRofMnKaLgi1yozi7+GTgpK8KzEDZt5zoAAfd&nt=V48Hzvcp
REQUEST
RESPONSE
POST 0 http://www.sanlifalan.com/fqiq/
REQUEST
RESPONSE
GET 200 http://www.sanlifalan.com/fqiq/?v4=prTEVkQv/aIuaJ5tknUsCYHPcHrUQSHWro/2zNHeF4wHPtFNVSB8ZmBi9ORqDWcgPylN7lnN&nt=V48Hzvcp
REQUEST
RESPONSE
POST 405 http://www.driventow.com/fqiq/
REQUEST
RESPONSE
GET 403 http://www.driventow.com/fqiq/?v4=WJEXqHgS+1w7jYZxj6bk2V/X0M1eNxv0v3Pq27u1m9Xixx6h0OkNhZFzEpcOyr0h54ejSKl9&nt=V48Hzvcp
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49212 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 104.165.34.6:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 104.165.34.6:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 104.165.34.6:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 75.2.115.196:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 75.2.115.196:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 75.2.115.196:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts