NetWork | ZeroBOX

IP Address	Status	Action
104.21.19.200	Active	Moloch
103.14.99.90	Active	Moloch
136.243.160.50	Active	Moloch
141.138.169.229	Active	Moloch
164.124.101.2	Active	Moloch
172.67.175.191	Active	Moloch
18.139.206.21	Active	Moloch
198.20.92.61	Active	Moloch
213.186.33.5	Active	Moloch
3.223.115.185	Active	Moloch
63.250.43.134	Active	Moloch
74.208.236.26	Active	Moloch

Name	Response	Post-Analysis Lookup
www.businessfoxes.com	A 172.67.175.191 A 104.21.40.47	104.21.40.47
www.gerez.cloud	A 213.186.33.5	213.186.33.5
www.alou-mall.com	A 54.179.12.202 CNAME shenlong-shangcheng-6-1984066735.ap-southeast-1.elb.amazonaws.com A 18.139.206.21	54.179.12.202
www.voedseitobacco.com
www.pickleheads.com	CNAME HDRedirect-LB7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.com A 3.223.115.185	3.223.115.185
www.maxflowo2.net	A 74.208.236.26	74.208.236.26
www.idfcfirstbankannualreports.com	A 103.14.99.90	103.14.99.90
www.teaching-hero.net	A 136.243.160.50	136.243.160.50
www.corporativogrupomg.com	CNAME corporativogrupomg.com A 198.20.92.61	198.20.92.61
www.everdaypromotions.com	CNAME everdaypromotions.com A 63.250.43.135 A 63.250.43.134	63.250.43.135
www.littlegalaxy.space	A 141.138.169.229	141.138.169.229

TCP Requests

UDP Requests

GET 404 http://www.corporativogrupomg.com/c28n/?v6A=orO9m6opkfnmZnHzgzpXGc1GtTIiBHjetz2M3r2QwqpumH3/uJsYGUGtGIcsMSlOx666nfca&1bS=W6RpsLp8e

GET 301 http://www.everdaypromotions.com/c28n/?v6A=/a7JSy4WdlrAvmBB4aPDpC+9Qm9F37Gdv2dpD4gbh9A3L5OjFXZwYLdktjrzpBVpNx3zgT/C&1bS=W6RpsLp8e

GET 302 http://www.pickleheads.com/c28n/?v6A=4mjjZOMIphcMbkg0xvmmxU3Vm7lD+tDMH/rhHhcA0VsU/aMNXX4nfF8nk0yicK2t+1yKOCHB&1bS=W6RpsLp8e

GET 302 http://www.gerez.cloud/c28n/?v6A=0U8GD0EJ/fXtvPVjxN/mDsqTH1VAr34tdE5N08x0v5QAZQTjQQEwHLTPPpJL/lqSW+T8rA4j&1bS=W6RpsLp8e

GET 403 http://www.alou-mall.com/c28n/?v6A=Aq4OZz0P1Cm0taznhBx8DbuhWEo5YYqHD/Xyz5mUsLgWMkRMPXDBNHV51GA40DFB7l/XS9RJ&1bS=W6RpsLp8e

GET 302 http://www.maxflowo2.net/c28n/?v6A=/x0PCv/IbsUdSkO4plv12/frGl5tB/J4HO/84/NztFr6Vnef68M7MqrwIoIB80+4/tmnpowE&1bS=W6RpsLp8e

GET 301 http://www.littlegalaxy.space/c28n/?v6A=Mukhagiths1oDqputph4DwAXHPcdu9rqUs5D8HK3A5RBW7p5TQDvrWlWxb4ufsdVNrHFJIhW&1bS=W6RpsLp8e

GET 404 http://www.idfcfirstbankannualreports.com/c28n/?v6A=Byn1q/FqRS1bywClSIlg9VTpv0ULBFiRiavDbl5uLz0E1VQ/1FcAXDYuMDuDOEnbWT7sDDnx&1bS=W6RpsLp8e

GET 301 http://www.teaching-hero.net/c28n/?v6A=0N8k8QGWftwT/EoB5DCQmXBQMzXZaq9Z93S6/nXzgfX0/B52rjI7GeRJ+F0Rx5ur96xJZjH8&1bS=W6RpsLp8e

GET 301 http://www.businessfoxes.com/c28n/?v6A=4TrpA9SgobkegYLeweBatJoZovAv/E4EU6OC4vvLbok40PL2JlI/KtOWQ04Y/YCHn10KPUNb&1bS=W6RpsLp8e

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49168 -> 213.186.33.5:80	2027874	ET INFO HTTP Request to Suspicious *.cloud Domain	Potentially Bad Traffic
TCP 192.168.56.101:49168 -> 213.186.33.5:80	2027874	ET INFO HTTP Request to Suspicious *.cloud Domain	Potentially Bad Traffic
TCP 192.168.56.101:49174 -> 172.67.175.191:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 172.67.175.191:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 172.67.175.191:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 103.14.99.90:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 103.14.99.90:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 103.14.99.90:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
UDP 192.168.56.101:61681 -> 164.124.101.2:53	2027865	ET INFO Observed DNS Query to .cloud TLD	Potentially Bad Traffic
TCP 192.168.56.101:49171 -> 141.138.169.229:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 141.138.169.229:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 141.138.169.229:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 136.243.160.50:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 136.243.160.50:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 136.243.160.50:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 63.250.43.134:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 63.250.43.134:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 63.250.43.134:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 18.139.206.21:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 18.139.206.21:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 18.139.206.21:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 213.186.33.5:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 213.186.33.5:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 213.186.33.5:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 213.186.33.5:80	2027874	ET INFO HTTP Request to Suspicious *.cloud Domain	Potentially Bad Traffic
TCP 192.168.56.101:49167 -> 3.223.115.185:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 3.223.115.185:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 3.223.115.185:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 198.20.92.61:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 198.20.92.61:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 74.208.236.26:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 198.20.92.61:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 74.208.236.26:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 74.208.236.26:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts