NetWork | ZeroBOX

IP Address	Status	Action
123.157.255.158	Active	Moloch
104.21.64.215	Active	Moloch
142.250.199.83	Active	Moloch
15.197.142.173	Active	Moloch
164.124.101.2	Active	Moloch
172.67.162.70	Active	Moloch
202.165.66.108	Active	Moloch
209.17.116.163	Active	Moloch
3.64.163.50	Active	Moloch
44.227.65.245	Active	Moloch

Name	Response	Post-Analysis Lookup
www.heser.net	CNAME ghs.googlehosted.com A 142.250.199.83	142.250.199.115
www.mecasso.store	A 15.197.142.173 CNAME mecasso.store A 3.33.152.147	3.33.152.147
www.weberwines.tax	A 209.17.116.163	209.17.116.163
www.pepeavatar.com	A 3.64.163.50	3.64.163.50
www.mcrjadr5.xyz
www.herbalmedication.xyz	A 44.227.76.166 A 44.227.65.245	44.227.65.245
www.gold12guide.art	A 202.165.66.108	202.165.66.108
www.baibuaherb.com	A 104.21.73.118 A 172.67.162.70	172.67.162.70
www.235296tyc.com	A 104.21.64.215 CNAME www.235296tyc.com.cdn.cloudflare.net A 172.67.187.226	172.67.187.226

TCP Requests

UDP Requests

GET 404 http://www.gold12guide.art/euzn/?8p=fG/1TTLa6+7U56mtX+B4aGEWRZbcVvvrrPCAadpaTDUqE3GL44eZkkQ9Crkv0cVWXzLtUrfa&wZ=H2J8n4y

GET 403 http://www.mecasso.store/euzn/?8p=5V4tZ993so02mJc3sFQ1G2n5zFyOyfQP63UMvRPf7Sx02fgR5BEy180KOo1jDAfLNmzZkM90&wZ=H2J8n4y

GET 307 http://www.herbalmedication.xyz/euzn/?8p=2R7YJWwCBBpytsqtiVkPZQg/Kf6xNwUZJHDVkC35/SOaGMLBhX9HHpVWwkHu5dCAZCxH7WXo&wZ=H2J8n4y

GET 301 http://www.baibuaherb.com/euzn/?8p=txChVvbQXjI9PLvjaTp0YZLPDAtzuyqbih5pAFD4cVDNzSb4eTi8CUJ3NmKGE4sEw5SlkR8L&wZ=H2J8n4y

GET 410 http://www.pepeavatar.com/euzn/?8p=c52/idsZybo5+++XEfR74GyO3sFn94uB9Bi9sGgwmuYdSzcMkVUF1vuwnR+zyHyG1b/8nRaD&wZ=H2J8n4y

GET 301 http://www.heser.net/euzn/?8p=3YIIvuVMPod2ghyVzlrVbDIKpMNjGC1jVshcE/xay47UBDuWohiRTIe7T0ywrtH6KgyQLQcn&wZ=H2J8n4y

GET 301 http://www.235296tyc.com/euzn/?8p=qPG280hY3bVwFWYgPYUPmF0yLOv8ZOX3N77VjzujjWFTLW7L05+D5h5Mp3mfBnzq5vwwDWs5&wZ=H2J8n4y

GET 400 http://www.weberwines.tax/euzn/?8p=rrblNUwXaF09u3mrCbtzJUAcItARcizJXqK8tRqRy7UZfQx0GnrhUftu7TFVxz4251JgXOGw&wZ=H2J8n4y

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49177 -> 142.250.199.83:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 142.250.199.83:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 142.250.199.83:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 209.17.116.163:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 209.17.116.163:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 209.17.116.163:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 104.21.64.215:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 104.21.64.215:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 104.21.64.215:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 15.197.142.173:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 15.197.142.173:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 15.197.142.173:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 202.165.66.108:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 3.64.163.50:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 202.165.66.108:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 3.64.163.50:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 202.165.66.108:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 3.64.163.50:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 44.227.65.245:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 44.227.65.245:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 44.227.65.245:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 172.67.162.70:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 44.227.65.245:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic
TCP 192.168.56.103:49175 -> 172.67.162.70:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 172.67.162.70:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts