popup
NetWork | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Network Analysis

Download pcap
Hosts 6 DNS 7 TCP 5 UDP 14 HTTP(S) 4 ICMP 0 IRC 0 Suricata Snort
IP Address Status Action
101.32.31.22 Active Moloch
108.167.135.122 Active Moloch
15.197.142.173 Active Moloch
154.55.180.142 Active Moloch
164.124.101.2 Active Moloch
74.220.199.6 Active Moloch
GET 403 http://www.hillcresthomegroup.com/fqiq/?RRH=e8IUz+kyOysVBZlQ7dDPCxDZEZgLUw6RtmKaFnpypWcRg6rSNETXHzLpDmYSKaMDSlUjICSm&rVBxDv=S0GhCN
REQUEST
RESPONSE
BODY 

            

        


    



        
            

    
        GET
        
        0
        http://www.kangrungao.com/fqiq/?RRH=c0qy46zMNJWMlIfJWvLWas23i13YCpczqQVz26IikTOu0V/FV9kYBe5yW824zHJtR/JIW+qz&rVBxDv=S0GhCN
        
    
    


        

            

                
 REQUEST

                

                    
                    
                

            

            

                
 RESPONSE

                

                    
                    
                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
            

    
        GET
        
        0
        http://www.benisano.com/fqiq/?RRH=1FzMW+0+OiUuFtKwwdX+18qfmmqzzEGxfDkpxhvrj8NPxWXEAOb928cDHixNpwT1SnXUPxEA&rVBxDv=S0GhCN
        
    
    


        

            

                
 REQUEST

                

                    
                    
                

            

            

                
 RESPONSE

                

                    
                    
                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
            

    
        GET
        
        200
        http://www.eclecticrenaissancewoman.com/fqiq/?RRH=r0/ZbJtj1KlrPUtj6ktEAad/47kkdxrfw2ceKfpFhpDkJU8+thj5a8jyelsFbI6qHEc9DomI&rVBxDv=S0GhCN
        
    
    


        

            

                
 REQUEST

                

                    
                    
                

            

            

                
 RESPONSE

                

                    
                    
                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
	




                            
ICMP traffic



No ICMP traffic performed.



                            
IRC traffic



No IRC requests performed.



                            
Suricata Alerts


    

        

            Flow
            SID
            Signature
            Category
        

        
        

            
                TCP
                108.167.135.122:80 ->
                192.168.56.103:49172
            
            2221010
            SURICATA HTTP unable to match response to request
            Generic Protocol Command Decode
        

        
        

            
                TCP
                192.168.56.103:49173 ->
                154.55.180.142:80
            
            2031412
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49171 ->
                101.32.31.22:80
            
            2031412
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49173 ->
                154.55.180.142:80
            
            2031449
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49171 ->
                101.32.31.22:80
            
            2031449
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49173 ->
                154.55.180.142:80
            
            2031453
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49171 ->
                101.32.31.22:80
            
            2031453
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49170 ->
                15.197.142.173:80
            
            2031412
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49170 ->
                15.197.142.173:80
            
            2031449
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49170 ->
                15.197.142.173:80
            
            2031453
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49172 ->
                108.167.135.122:80
            
            2031412
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49172 ->
                108.167.135.122:80
            
            2031449
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49172 ->
                108.167.135.122:80
            
            2031453
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49174 ->
                74.220.199.6:80
            
            2031412
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49174 ->
                74.220.199.6:80
            
            2031449
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49174 ->
                74.220.199.6:80
            
            2031453
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
    




Suricata TLS


    
No Suricata TLS




                            
Snort Alerts


    
No Snort Alerts