NetWork | ZeroBOX

IP Address	Status	Action
13.107.21.200	Active	Moloch
156.239.239.145	Active	Moloch
164.124.101.2	Active	Moloch
172.217.24.100	Active	Moloch
173.231.37.93	Active	Moloch
173.249.0.223	Active	Moloch
194.245.148.189	Active	Moloch
198.54.117.215	Active	Moloch
198.54.117.217	Active	Moloch
34.102.136.180	Active	Moloch
74.220.199.6	Active	Moloch

Name	Response	Post-Analysis Lookup
www.worldtravelcostarica.com	A 74.220.199.6	74.220.199.6
www.riyiflower.com	A 173.231.37.93	173.231.37.93
www.adornel.online	A 194.245.148.189	194.245.148.189
www.americanmamallc.com	CNAME americanmamallc.com A 34.102.136.180	34.102.136.180
www.terabyte-hosting.com	A 156.239.239.145	156.239.239.145
www.orderonlinegift.com	A 198.54.117.218 A 198.54.117.216 A 198.54.117.217 CNAME parkingpage.namecheap.com A 198.54.117.215 A 198.54.117.212 A 198.54.117.210 A 198.54.117.211	198.54.117.210
www.google.com	A 172.217.24.100	172.217.25.68
www.laminaparfum.com	A 173.249.0.223	173.249.0.223
www.usbgdt.com	A 198.54.117.218 A 198.54.117.216 A 198.54.117.217 CNAME parkingpage.namecheap.com A 198.54.117.215 A 198.54.117.212 A 198.54.117.210 A 198.54.117.211	198.54.117.211

TCP Requests

UDP Requests

GET 200 https://www.google.com/

GET 0 https://www.bing.com/

HTTP/1.1 200 OK Cache-Control: private Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: SUID=M; domain=.bing.com; expires=Wed, 10-Nov-2021 01:14:44 GMT; path=/ Set-Cookie: MUID=0932EE4008486F712B5BFEAA09036E1A; domain=.bing.com; expires=Sun, 04-Dec-2022 01:14:44 GMT; path=/; secure; SameSite=None Set-Cookie: MUIDB=0932EE4008486F712B5BFEAA09036E1A; expires=Sun, 04-Dec-2022 01:14:44 GMT; path=/ Set-Cookie: _EDGE_S=F=1&SID=2AE36CD1917165F51CB97C3B903A6488; domain=.bing.com; path=/ Set-Cookie: _EDGE_V=1; domain=.bing.com; expires=Sun, 04-Dec-2022 01:14:44 GMT; path=/ Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Thu, 09-Nov-2023 01:14:44 GMT; path=/ Set-Cookie: SRCHUID=V=2&GUID=0EAEE4A16BF74486B84F6F0CEF7C8485&dmnchg=1; domain=.bing.com; expires=Thu, 09-Nov-2023 01:14:44 GMT; path=/ Set-Cookie: SRCHUSR=DOB=20211109; domain=.bing.com; expires=Thu, 09-Nov-2023 01:14:44 GMT; path=/ Set-Cookie: SRCHHPGUSR=SRCHLANG=ko; domain=.bing.com; expires=Thu, 09-Nov-2023 01:14:44 GMT; path=/ Set-Cookie: _SS=SID=2AE36CD1917165F51CB97C3B903A6488; domain=.bing.com; path=/ Set-Cookie: ULC=; domain=.bing.com; expires=Mon, 08-Nov-2021 01:14:44 GMT; path=/ Set-Cookie: _HPVN=CS=eyJQbiI6eyJDbiI6MSwiU3QiOjAsIlFzIjowLCJQcm9kIjoiUCJ9LCJTYyI6eyJDbiI6MSwiU3QiOjAsIlFzIjowLCJQcm9kIjoiSCJ9LCJReiI6eyJDbiI6MSwiU3QiOjAsIlFzIjowLCJQcm9kIjoiVCJ9LCJBcCI6dHJ1ZSwiTXV0ZSI6dHJ1ZSwiTGFkIjoiMjAyMS0xMS0wOVQwMDowMDowMFoiLCJJb3RkIjowLCJHd2IiOjAsIkRmdCI6bnVsbCwiTXZzIjowLCJGbHQiOjAsIkltcCI6MX0=; domain=.bing.com; expires=Thu, 09-Nov-2023 01:14:44 GMT; path=/ X-SNR-Routing: 1 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: D0B1B009D2CD4CD594FD74856673B40C Ref B: SLAEDGE0312 Ref C: 2021-11-09T01:14:44Z Date: Tue, 09 Nov 2021 01:14:43 GMT

GET 0 http://www.usbgdt.com/upi8/?mfsl7bO=3UbDyqfhk74iQenn2rb1PNAqbmd7pBi1w5Vc7dibSIZzJ8oi4VLl/LL4Ih1QKPlRxuUAFdow&lZB=UFQL6PspOrB8cBA

GET 200 http://www.adornel.online/upi8/?mfsl7bO=WCYcamE4OpyvlGAM/6VYMp5sz4MiornE7eOrtWBiw93c7YzR/9rQfjXC9Ao6JY/ZAx2dt/o2&lZB=UFQL6PspOrB8cBA

GET 0 http://www.riyiflower.com/upi8/?mfsl7bO=URnhYor5h/a1eY4I1MRYkyvU/C6iyySQl5i/LfsqcAvS3n8t8VZBTJEv9CggEU7Qj9zQFGa7&lZB=UFQL6PspOrB8cBA

GET 0 http://www.terabyte-hosting.com/upi8/?mfsl7bO=IksKFeB7Nhcr1UyvjUDc9raNq3yFKaWYeG8ZFa7N8PFOP2WxrCOsBm67wrG0znY6SYLdq5hH&lZB=UFQL6PspOrB8cBA

GET 403 http://www.americanmamallc.com/upi8/?mfsl7bO=vjlpkTRLC5Dgfw3UkMfSv+OxhP+8YeLsZXlPwFsHyA3oiy9X6axLIvtArF0KGxnNi0HYfTxk&lZB=UFQL6PspOrB8cBA

GET 0 http://www.orderonlinegift.com/upi8/?mfsl7bO=vxARSuSoqZK18t0E7sgbRYlEAQ3eiG2xpdFiyjWjeE35797axIfeZv8GrLi/CrHYLYoZksiT&lZB=UFQL6PspOrB8cBA

GET 200 http://www.worldtravelcostarica.com/upi8/?mfsl7bO=kak2erzwbk6dFhAabuUNPYc5MM8Ck6cWAVuSImrNuXpPcwWoMzKM7Th/w52UZO8cralg/c95&lZB=UFQL6PspOrB8cBA

ICMP traffic

Source	Destination	ICMP Type	Data
194.245.148.189	192.168.56.103	3
194.245.148.189	192.168.56.103	3

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49161 -> 172.217.24.100:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49163 -> 13.107.21.200:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49166 -> 198.54.117.215:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 198.54.117.215:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 198.54.117.215:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 74.220.199.6:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 74.220.199.6:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 74.220.199.6:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 156.239.239.145:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 156.239.239.145:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 156.239.239.145:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 198.54.117.217:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 198.54.117.217:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 198.54.117.217:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 194.245.148.189:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 194.245.148.189:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 194.245.148.189:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 173.231.37.93:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 173.231.37.93:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 173.231.37.93:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49161 172.217.24.100:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1C3	CN=www.google.com	5e:4b:8f:b5:bf:60:fd:ba:f1:72:07:9b:d3:3a:35:d8:d0:3b:75:57
TLSv1 192.168.56.103:49163 13.107.21.200:443	C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02	CN=www.bing.com	af:e3:17:ed:18:4a:d9:1c:24:8a:89:d5:ac:11:b3:27:96:02:37:c8

Snort Alerts

No Snort Alerts