NetWork | ZeroBOX

IP Address	Status	Action
164.124.101.2	Active	Moloch
107.160.82.250	Active	Moloch
167.86.115.24	Active	Moloch
172.81.119.116	Active	Moloch
180.215.198.11	Active	Moloch
182.50.132.242	Active	Moloch
198.54.117.210	Active	Moloch
35.75.36.192	Active	Moloch
52.147.15.202	Active	Moloch
74.208.236.124	Active	Moloch

Name	Response	Post-Analysis Lookup
www.38leckiestreet.com	A 52.147.15.202	52.147.15.202
www.heller.legal	A 198.54.117.218 A 198.54.117.216 A 198.54.117.217 CNAME parkingpage.namecheap.com A 198.54.117.215 A 198.54.117.212 A 198.54.117.210 A 198.54.117.211	198.54.117.212
www.parkate.club
www.xiaye.tech	A 180.215.198.11	180.215.198.11
www.lighthouseta.com	CNAME lighthouseta.com A 182.50.132.242	182.50.132.242
www.gengzicompute.com	A 35.75.36.192	35.75.36.192
www.bajajfinserv-amc.com
www.juliorodriguez.info	A 74.208.236.124	74.208.236.124
www.lakeshoreurology.net	A 107.160.82.250	107.160.82.250
www.astrovivan.com	A 167.86.115.24 CNAME astrovivan.com	167.86.115.24
www.ppaltobk.com
www.mikes-marine.com	CNAME mikes-marine.com A 172.81.119.116	172.81.119.116

TCP Requests

UDP Requests

GET 404 http://www.astrovivan.com/sywu/?QFQLCr=o5sNhDhfZJRS9/SUQMPBXHG3DbFi02fRsIqKUlu4kB6TLWYpQz0wrHenFh/mZBJR92RFyso8&oXU=_6g8ydKhyJots

GET 404 http://www.gengzicompute.com/sywu/?QFQLCr=Sg/J+PD4SKoqXgcmmzEPzbkHChriOJdDtNPl57LzzQHkFhA1i4k5hjYuVkkFWhs3HT30LL4x&oXU=_6g8ydKhyJots

GET 400 http://www.lighthouseta.com/sywu/?QFQLCr=Fif6t9qBJS7PfbW+nV4zZIDOtUBpWKOdgsWufsEgrcVkaPOFX3rA+XhOwSnXgM/wsAdsDFIh&oXU=_6g8ydKhyJots

GET 404 http://www.xiaye.tech/sywu/?QFQLCr=x7Iu+fJ4CmAPupAvzY5WOl6wiV/RAzr8WM0SK4RPaHw8bh00os20c9SAOwy8lJ+c+kxB1kQ/&oXU=_6g8ydKhyJots

GET 404 http://www.mikes-marine.com/sywu/?QFQLCr=PbabmpsWFdXWMNTeeZ9jCNWPOn1z0XvHeI08BocNs8nNIG8Ni599zrxFdxp3gdzeKqca/8nw&oXU=_6g8ydKhyJots

GET 0 http://www.heller.legal/sywu/?QFQLCr=+W5iPjmNShX7Fk/+KG2exPFYjLOMVLK3Ae1Rlp57G0GXt2//EO1I9i0ykHjehxLSnRB6hliw&oXU=_6g8ydKhyJots

GET 302 http://www.juliorodriguez.info/sywu/?QFQLCr=5VRIM5ss2p6ZudMjCnrL8O/59St/KGbj2TdWvwSpCUm0KuOvA/1YYy3NuZ8h0Sqrozu1Sf00&oXU=_6g8ydKhyJots

GET 0 http://www.lakeshoreurology.net/sywu/?QFQLCr=up20VcKRKdIgZz9VU8Md9oKitDDtgDFv/ji54jlEG7zvlMtIMbWFEpf4avyP5SUHM5ilpOCa&oXU=_6g8ydKhyJots

GET 0 http://www.38leckiestreet.com/sywu/?QFQLCr=/vgTM4p9Z9iBgidmSY6A4cWY0D0pZxvvQpGDn6K72F4Gd8RLtU+z71PJ62L3W5IEhfgKqCPr&oXU=_6g8ydKhyJots

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49171 -> 182.50.132.242:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 182.50.132.242:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 182.50.132.242:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 172.81.119.116:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 172.81.119.116:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 172.81.119.116:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 74.208.236.124:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 74.208.236.124:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 74.208.236.124:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 167.86.115.24:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 167.86.115.24:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 167.86.115.24:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 180.215.198.11:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 180.215.198.11:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 180.215.198.11:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 52.147.15.202:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 52.147.15.202:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 52.147.15.202:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 107.160.82.250:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 107.160.82.250:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 107.160.82.250:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 198.54.117.210:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 198.54.117.210:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 198.54.117.210:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 35.75.36.192:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 35.75.36.192:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 35.75.36.192:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts