NetWork | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.20 09:11
mainbas.bat
11.20 09:11
dll007.dll
11.20 09:11
exe004.exe
11.20 09:11
exe010.exe
11.20 09:11
blecher.exe
11.20 09:11
GetAdapterInfo.exe
11.20 09:11
dll004.dll
11.20 09:11
dll008.dll
11.20 09:11
bestthingsalwaysgetbes...
11.20 09:11
DKM-9067291.pdf.lnk

Latest News
11.20 09:11
Malicious QR codes
11.20 09:11
Vista Said to Near Log...
11.20 09:11
Microsoft Launches Win...
11.20 09:11
Enhancing Cyber Resili...
11.20 09:11
VCs Look to Secondary ...
11.20 09:11
An Animated Walkthroug...
11.20 08:11
Apple, Oracle, and Apa...
11.20 08:11
NHIs Are the Future of...
11.20 08:11
Hasbro’s Gamer CEO Ref...
11.20 08:11
Threat Assessment: Ign...

NetWork | ZeroBOX

IP Address	Status	Action
164.124.101.2	Active	Moloch
185.104.28.238	Active	Moloch
20.51.217.113	Active	Moloch
207.244.126.161	Active	Moloch
217.160.0.159	Active	Moloch
34.102.136.180	Active	Moloch
99.86.202.89	Active	Moloch

Name	Response	Post-Analysis Lookup
www.yunxfeng.com
www.freeminingboxes.com	CNAME freeminingboxes.com A 34.102.136.180	34.102.136.180
www.digi-lime.com	A 217.160.0.159	217.160.0.159
www.mydealsstation.com	CNAME mydealsstation.com A 207.244.126.161	207.244.126.161
www.rayuramen.com	A 99.86.202.98 A 99.86.202.114 CNAME d5la7xg3f9rvf.cloudfront.net A 99.86.202.89 A 99.86.202.63	13.225.131.124
www.compareyoursneaker.online	A 185.104.28.238	185.104.28.238
www.509edfasdgcd.club
www.vantagenowllc.com	A 34.102.136.180 CNAME vantagenowllc.com	34.102.136.180

TCP Requests

UDP Requests

GET 200 http://20.51.217.113/xvx/ConsoleApp2.bin

GET 404 http://www.digi-lime.com/se5g/?p0D=ffJkN43k3dYoD4UbWW+NNmKuL73IbAzyyUqZeTutIN0FTw6z6MdxAIJVMyMmKKe/SXXl1C0J&pPU=EFQxUr1XhHpp

GET 301 http://www.mydealsstation.com/se5g/?p0D=I+HNmUML0gohMeqg59UrpgGZJ85HsRc6VUJofH6jdB1Me2x7iKhatADufExkQyiPgZj/+u04&pPU=EFQxUr1XhHpp

GET 403 http://www.vantagenowllc.com/se5g/?p0D=jdXEzhimOnSacXUdGxTYvdJcV61jKW0d0K+peZrLZB1Sd+zR1QfcDPrffrB+k3Lt9GaGVKnv&pPU=EFQxUr1XhHpp

GET 404 http://www.compareyoursneaker.online/se5g/?p0D=2pNa9fQttIm8n5tfYjU8dGvcjPoAXIUdTkXN9fbnSTGpjXLtUkdyV461dX21S7MuwNtDr+NS&pPU=EFQxUr1XhHpp

GET 301 http://www.rayuramen.com/se5g/?p0D=whcI31L0MoAEI++0t3jXyE3nnNQAM/cYbuyfe44aGV/9H6pvHcWSD2B4iIKYk7fns6EGCiY+&pPU=EFQxUr1XhHpp

GET 403 http://www.freeminingboxes.com/se5g/?p0D=KDNeFXd1QmbywCn03wI186znHUlSfA7WUVenVdLJ4XL4uN+vge/ynD9W6iKDIEtL9lQttASJ&pPU=EFQxUr1XhHpp

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49169 -> 207.244.126.161:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 207.244.126.161:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 207.244.126.161:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 217.160.0.159:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 217.160.0.159:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 99.86.202.89:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 217.160.0.159:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 99.86.202.89:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 99.86.202.89:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 185.104.28.238:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 185.104.28.238:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 185.104.28.238:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts