NetWork | ZeroBOX

IP Address	Status	Action
125.212.221.113	Active	Moloch
146.75.49.211	Active	Moloch
164.124.101.2	Active	Moloch
23.227.38.74	Active	Moloch
34.102.136.180	Active	Moloch
35.209.150.94	Active	Moloch

Name	Response	Post-Analysis Lookup
www.sweetascaramelllc.com	CNAME shops.myshopify.com CNAME sweet-as-caramel.myshopify.com A 23.227.38.74	23.227.38.74
www.vinhomes-grand-park.com	CNAME vinhomes-grand-park.com A 125.212.221.113	125.212.221.113
www.lzgirlz.com	CNAME lzgirlz.com A 34.102.136.180	34.102.136.180
www.fulvousemollientplanet.com	CNAME shops.myshopify.com A 23.227.38.74	23.227.38.74
www.thepatriottutor.com	CNAME thepatriottutor.com A 34.102.136.180	34.102.136.180
www.liyahgadgets.com	A 146.75.49.211 CNAME dualstack.sni.bigcartel.map.fastly.net CNAME liyahgadgets.bigcartel.com	151.101.193.211
www.foxandmew.com
www.royallecleaning.com	A 34.102.136.180 CNAME royallecleaning.com	34.102.136.180
www.mrteez.club
www.scion-go-getter.com	A 35.209.150.94	35.209.150.94

TCP Requests

UDP Requests

GET 302 http://www.sweetascaramelllc.com/mwev/?ARmdX8=1dgSwdT6iUfXJhnZMPGbosNbqy8frS/bAP6nSrHpcwjRB5DRuVVqLLDEtFes5YR1zw4AUvn1&KX6tW=0rmT5ZjPmbshPnQ0

GET 403 http://www.fulvousemollientplanet.com/mwev/?ARmdX8=vthKUgsi1WUC3wg/Fuh07g/ARRJh8nN5iXMY1IOUkIOGRst8HaQDSsvzM421sGAnkmdeGog+&KX6tW=0rmT5ZjPmbshPnQ0

GET 301 http://www.scion-go-getter.com/mwev/?ARmdX8=Y+Hyy1N5D5MxwHpLzGerXtl/+e9k+2VYdp+JCOaNjGnZwwqutoqB71RoDgAXCJ7sEd8Lkw64&KX6tW=0rmT5ZjPmbshPnQ0

GET 301 http://www.liyahgadgets.com/mwev/?ARmdX8=g1Z6fijHILhIWnYWTIp+4FjUMYhbb0wZRNLDOiUXPeqjelwmMdoeuMJZvq7y8sTA4qv2iqe4&KX6tW=0rmT5ZjPmbshPnQ0

GET 404 http://www.vinhomes-grand-park.com/mwev/?ARmdX8=+A5f1+5KU/VQJUIdmInlKEVxY8aL5K/QWJJwfdi7fw4L7afC02fAbPQICF0jz2WSofxc+YO3&KX6tW=0rmT5ZjPmbshPnQ0

GET 403 http://www.thepatriottutor.com/mwev/?ARmdX8=/F+5fWxCaYec331bQY3aplUtTlhxOTv5tqm7kZyG1N03wxzrV71zo6o8BaaVLz3vSpc09MhZ&KX6tW=0rmT5ZjPmbshPnQ0

GET 403 http://www.royallecleaning.com/mwev/?ARmdX8=HsmrIALRyQMPJkOtf5nMI/V00TunQUINtHtLXN2Hj1uqs6T8fON4gG2lu2ZQbwqStmDdpZMN&KX6tW=0rmT5ZjPmbshPnQ0

GET 403 http://www.lzgirlz.com/mwev/?ARmdX8=3CLo7xM/0Sn17sJZB/EECplawXlGZ+Z9N99jYgo26tSUwZqib7lJXKN2Yr8FiIXkjxSqkjkT&KX6tW=0rmT5ZjPmbshPnQ0

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49168 -> 146.75.49.211:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 146.75.49.211:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 146.75.49.211:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 23.227.38.74:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 23.227.38.74:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 23.227.38.74:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 35.209.150.94:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 35.209.150.94:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 35.209.150.94:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 23.227.38.74:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 23.227.38.74:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 23.227.38.74:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 125.212.221.113:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 125.212.221.113:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 125.212.221.113:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts