NetWork | ZeroBOX

IP Address	Status	Action
108.167.140.88	Active	Moloch
151.101.130.199	Active	Moloch
164.124.101.2	Active	Moloch
165.232.189.23	Active	Moloch
172.67.160.172	Active	Moloch
182.50.132.242	Active	Moloch
185.73.226.144	Active	Moloch
192.0.78.25	Active	Moloch
208.91.197.27	Active	Moloch
3.33.152.147	Active	Moloch
34.102.136.180	Active	Moloch
51.210.240.92	Active	Moloch

Name	Response	Post-Analysis Lookup
www.exodiguis.com
www.thesaltandpeppercompany.com	A 208.91.197.27	208.91.197.27
www.godigitalwithpavitra.com	CNAME godigitalwithpavitra.com A 34.102.136.180	34.102.136.180
www.metaverse360.biz	CNAME metaverse360.biz A 15.197.142.173 A 3.33.152.147	3.33.152.147
www.alexchen032104.com	A 108.167.140.88 CNAME alexchen032104.com	108.167.140.88
www.faceandco.clinic	CNAME faceandco.clinic A 34.102.136.180	34.102.136.180
www.iran-style.com	A 185.73.226.144	185.73.226.144
www.salvationshippingsecurity.com	A 51.210.240.92 CNAME salvationshippingsecurity.com	51.210.240.92
www.istesdesv.xyz
www.mainponsel.com	A 192.0.78.25 A 192.0.78.24 CNAME mainponsel.com	192.0.78.24
www.mygreatsport.com	A 165.232.189.23	165.232.189.23
www.pharmasolutionspr.net	A 34.102.136.180 CNAME pharmasolutionspr.net	34.102.136.180
www.aestheticgeneration.com	A 172.67.160.172 A 104.21.41.52	172.67.160.172
www.denim-dots.com	CNAME denim-dots.com A 182.50.132.242	182.50.132.242
www.karasevda-jor.com	A 151.101.130.199 A 151.101.2.199 A 151.101.194.199 A 151.101.66.199	151.101.130.199
www.dellmoor.com	A 34.102.136.180 CNAME dellmoor.com	34.102.136.180

TCP Requests

UDP Requests

GET 403 http://www.dellmoor.com/n8cr/?RVE=gLYniZTjpUciXSr40w1ZcVSpRl6QZNuH0jlBDOVrQhs3iZPl3fuig2I+APRykwKIdII5nmkF&oX=Txo8nt4pMBsp

GET 301 http://www.mainponsel.com/n8cr/?RVE=mVFDnNjJ2vTsUPjU2vMB3+FXNX8eexEZxlIfz47NSAhBxvMoxs8esVMv/fjPY52Pp2B0mYDW&oX=Txo8nt4pMBsp

GET 301 http://www.iran-style.com/n8cr/?RVE=GXfO8B+dYCYwH7WfZsiiqwaUAAueNeu6MDNafot3+FTdKfteynY4gSrLUTempKfrY+jdfgZk&oX=Txo8nt4pMBsp

GET 301 http://www.salvationshippingsecurity.com/n8cr/?RVE=78UME4TI/rV8xZ+buxbYQpMgVk8CS4P/0Mk5rSJGt63WJVcn3+gzRmywil+pDTVKA2ZCHb9f&oX=Txo8nt4pMBsp

GET 301 http://www.alexchen032104.com/n8cr/?RVE=EdcaDOzsnrgFHSEkgf65m1FrWY/Hf53INeAgoIBAXIwzlcDd64JyoQZysLIpk1YZWqFFBv8a&oX=Txo8nt4pMBsp

GET 301 http://www.aestheticgeneration.com/n8cr/?RVE=Rz970MULcJlEpQ6KB3BFBwmnE+Qwu9WizwqeBL5K2JZ4RTX0YwbwMuJMBXUYpxAAm/unvsS8&oX=Txo8nt4pMBsp

GET 403 http://www.pharmasolutionspr.net/n8cr/?RVE=9mF32nB4h40OHIxmPLkmpgSq7fKCv9zCP33FwVrabD3b2BPmEGeBbsK70Z8nk6vJRZETbnWE&oX=Txo8nt4pMBsp

GET 400 http://www.denim-dots.com/n8cr/?RVE=qwkzac1j/67F9bss9FYZBW87jp0Bt+sWJslQldl38e5d08yUah7TTEiAe+JGX9F5JVqNCAa/&oX=Txo8nt4pMBsp

GET 403 http://www.faceandco.clinic/n8cr/?RVE=7eiQl+3cJ8EV3FktohZSj628IkCH0G7iAPXfALUtCIhKVfVEdi0SOHhTKxXCREJJkmT4WqWE&oX=Txo8nt4pMBsp

GET 301 http://www.mygreatsport.com/n8cr/?RVE=6TrfVAfyv4wZJuUs2Y+7pQpWT8ScL4b/U6XAXH/1NoUMsx3E79jr4ZvGs9GXn/NNbXfgKcsF&oX=Txo8nt4pMBsp

GET 403 http://www.metaverse360.biz/n8cr/?RVE=a1iYZxDNUxPZ3BDpTTjp6GyZjjVUvaBttrRTAisrx3JfQWRNE2QL6zxye3rkeOOJStsSY+TA&oX=Txo8nt4pMBsp

GET 200 http://www.thesaltandpeppercompany.com/n8cr/?RVE=KEg72S8Kgq3jqU/Dvj3XtXev4vRdKH+I6PfdyGiW9oQHzuaf15VYTt2ur/Af8Lc7mGTrTCee&oX=Txo8nt4pMBsp

GET 301 http://www.karasevda-jor.com/n8cr/?RVE=MV1cGpiVERxA78VXTvcNrqGBP2hCBM0knujjlYmEPbwtbQyeZmTbDe9abbuH3PeuXqIn7oDT&oX=Txo8nt4pMBsp

GET 403 http://www.godigitalwithpavitra.com/n8cr/?RVE=a9TTiAQoSZyTC7GXXz2Ohzovp/Ry6CXzaHOI8WyuEjRkeLOQXnugV1U05qQEj2Q0jUP0bscA&Mrn=uVjH

GET 0 http://www.metaverse360.biz/n8cr/?RVE=a1iYZxDNUxPZ3BDpTTjp6GyZjjVUvaBttrRTAisrx3JfQWRNE2QL6zxye3rkeOOJStsSY+TA&Mrn=uVjH

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49169 -> 108.167.140.88:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 108.167.140.88:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 108.167.140.88:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 51.210.240.92:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 51.210.240.92:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 51.210.240.92:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 182.50.132.242:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 182.50.132.242:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 182.50.132.242:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
UDP 192.168.56.101:54098 -> 164.124.101.2:53	2027863	ET INFO Observed DNS Query to .biz TLD	Potentially Bad Traffic
TCP 192.168.56.101:49174 -> 165.232.189.23:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 165.232.189.23:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 165.232.189.23:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 208.91.197.27:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 208.91.197.27:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 208.91.197.27:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 192.0.78.25:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 172.67.160.172:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 192.0.78.25:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 172.67.160.172:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 192.0.78.25:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 172.67.160.172:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 185.73.226.144:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 185.73.226.144:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 185.73.226.144:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 151.101.130.199:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 151.101.130.199:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 151.101.130.199:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 3.33.152.147:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 3.33.152.147:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 3.33.152.147:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49179 -> 3.33.152.147:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49179 -> 3.33.152.147:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49179 -> 3.33.152.147:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts