popup
NetWork | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Network Analysis

Download pcap
Hosts 7 DNS 6 TCP 6 UDP 13 HTTP(S) 5 ICMP 0 IRC 0 Suricata Snort
IP Address Status Action
108.167.135.122 Active Moloch
164.124.101.2 Active Moloch
34.102.136.180 Active Moloch
34.80.190.141 Active Moloch
35.186.238.101 Active Moloch
64.190.62.111 Active Moloch
74.220.199.6 Active Moloch
GET 301 http://www.hartfulcleaning.com/fqiq/?4hLpNJ=uHvuYmjit4fallNp1Ej7vtyQWzU3HFRSMqXztfeWYNDOTP1U0scGwGT4FHCGKhM8svXnQnS7&nfutZl=xPJ4abP8
REQUEST
RESPONSE
BODY 

            

        


    



        
            

    
        GET
        
        403
        http://www.farmersfirstseed.com/fqiq/?4hLpNJ=LbdaYrSs38N8uIwY7oVDq2uzukwE8JpfT85YdDwPyg/SznV3VAz0OihEXjn7VBiJtsEJeDaz&nfutZl=xPJ4abP8
        
    
    


        

            

                
 REQUEST

                

                    
                    
                

            

            

                
 RESPONSE

                

                    
                    
                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
            

    
        GET
        
        200
        http://www.eclecticrenaissancewoman.com/fqiq/?4hLpNJ=r0/ZbJtj1KlrPUtj6ktEAad/47kkdxrfw2ceKfpFhpDkJU8+thj5a8jyelsFbI6qHEc9DomI&nfutZl=xPJ4abP8
        
    
    


        

            

                
 REQUEST

                

                    
                    
                

            

            

                
 RESPONSE

                

                    
                    
                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
            

    
        GET
        
        403
        http://www.satellitephonstore.com/fqiq/?4hLpNJ=Sq1XZHSrpCHed4l0gSE8w/MNMhRnHgbusCiv7TwhFJT/5cEiP7Kz4bRk1Jir79l1clbW8xKQ&nfutZl=xPJ4abP8
        
    
    


        

            

                
 REQUEST

                

                    
                    
                

            

            

                
 RESPONSE

                

                    
                    
                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
            

    
        GET
        
        302
        http://www.mambacustomboats.com/fqiq/?4hLpNJ=oM7C4s4IgTsCMDsM97tedYlymorHgm5Kv3M2/2amrfi4uqOFLGFzoQjLNIK3nvWL7hHP1K8A&nfutZl=xPJ4abP8
        
    
    


        

            

                
 REQUEST

                

                    
                    
                

            

            

                
 RESPONSE

                

                    
                    
                

            

        


        

            

                 BODY
                
            

            

                

            

        


    



        
	




                            
ICMP traffic



No ICMP traffic performed.



                            
IRC traffic



No IRC requests performed.



                            
Suricata Alerts


    

        

            Flow
            SID
            Signature
            Category
        

        
        

            
                TCP
                192.168.56.103:49169 ->
                34.102.136.180:80
            
            2031412
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49169 ->
                34.102.136.180:80
            
            2031449
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49169 ->
                34.102.136.180:80
            
            2031453
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                108.167.135.122:80 ->
                192.168.56.103:49167
            
            2221010
            SURICATA HTTP unable to match response to request
            Generic Protocol Command Decode
        

        
        

            
                TCP
                192.168.56.103:49168 ->
                34.80.190.141:80
            
            2031412
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49168 ->
                34.80.190.141:80
            
            2031449
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49168 ->
                34.80.190.141:80
            
            2031453
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49171 ->
                35.186.238.101:80
            
            2031412
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49171 ->
                35.186.238.101:80
            
            2031449
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49171 ->
                35.186.238.101:80
            
            2031453
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49167 ->
                108.167.135.122:80
            
            2031412
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49167 ->
                108.167.135.122:80
            
            2031449
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49167 ->
                108.167.135.122:80
            
            2031453
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49170 ->
                74.220.199.6:80
            
            2031412
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49170 ->
                74.220.199.6:80
            
            2031449
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49170 ->
                74.220.199.6:80
            
            2031453
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49172 ->
                64.190.62.111:80
            
            2031412
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49172 ->
                64.190.62.111:80
            
            2031449
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
        

            
                TCP
                192.168.56.103:49172 ->
                64.190.62.111:80
            
            2031453
            ET MALWARE FormBook CnC Checkin (GET)
            Malware Command and Control Activity Detected
        

        
    




Suricata TLS


    
No Suricata TLS




                            
Snort Alerts


    
No Snort Alerts