NetWork | ZeroBOX

IP Address	Status	Action
101.100.211.101	Active	Moloch
142.44.146.49	Active	Moloch
154.196.11.183	Active	Moloch
164.124.101.2	Active	Moloch
185.156.219.142	Active	Moloch
198.185.159.144	Active	Moloch
198.251.84.92	Active	Moloch
34.117.168.233	Active	Moloch
37.48.65.153	Active	Moloch
81.169.145.80	Active	Moloch
87.236.16.206	Active	Moloch

Name	Response	Post-Analysis Lookup
www.sagedermatology.com	A 198.185.159.144	198.185.159.144
www.xn--laufgefhl-w9a.com	CNAME xn--laufgefhl-w9a.com A 81.169.145.80	81.169.145.80
www.sutnsdmxq.icu	A 107.161.23.204 A 198.251.84.92 A 70.39.125.244 A 45.58.190.82 A 64.32.22.102 A 198.251.81.30 A 204.188.203.155 A 209.141.38.71 A 192.161.187.200 CNAME parking.namesilo.com A 168.235.88.209	198.251.81.30
www.servos-sandbox.com
www.eskomed.store	A 87.236.16.206	87.236.16.206
www.chegocheck.com	A 37.48.65.153	81.171.22.7
www.oneowneronly.com	A 154.196.11.183	154.196.11.183
www.padisarealtygroup.com	CNAME padisarealtygroup.com A 142.44.146.49	142.44.146.49
www.extremeentertainmentgroup.com	CNAME gcdn0.wixdns.net A 34.117.168.233 CNAME td-ccm-168-233.wixdns.net	34.117.168.233
www.glowestudiocreativo.com	A 185.156.219.142 CNAME glowestudiocreativo.com	185.156.219.142
www.loneli.biz
www.sailorswife.online
bondbuild.com.sg	A 101.100.211.101	101.100.211.101

TCP Requests

UDP Requests

GET 200 http://bondbuild.com.sg/vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv/Unqhqorelnlojsbiqegzhsaqjoyrqez

GET 302 http://www.sutnsdmxq.icu/e3rs/?lnud=Txll_FO&Dz=lUbOt4rRqVssxqmaqZkhNrZPSjqmMN1b0lqH3KrFAoA/kAmkGoi9J+xDVaciNpXg1hW1+xPy

GET 302 http://www.chegocheck.com/e3rs/?Dz=kBtv+8uMZDgJoctzJJlXxpvJV2xMrEWv2WqMq4iFDpTitVnQ5P6FBiXKhQGMvxSgf3VKVeJe&lnud=Txll_FO

GET 302 http://www.eskomed.store/e3rs/?Dz=n3coydpyvxb1+U/IYEaNzLKm1axm1EDoNytGpqjnANqsfX5bFLlHi5W8VHT6sMi3TZZUH2tw&lnud=Txll_FO

GET 400 http://www.sagedermatology.com/e3rs/?lnud=Txll_FO&Dz=BmVSufum30+1s4lK8YiwMjghnnMTkZAzSEhTOMstIaEgouylgvmW2x4JL0eg45ZsBeJi6OCm

GET 404 http://www.padisarealtygroup.com/e3rs/?Dz=itKkYQ+bPiQagqfFS+Lsc+D5+JH3ErIfx0RJoaKqHvkqLFn0ydm1fEP6hkHSMACAxfdRCwUb&lnud=Txll_FO

GET 301 http://www.extremeentertainmentgroup.com/e3rs/?Dz=dEHKxiAhq2PUxljq/uCxdG1AAciJu6kRpaHoK7hwfjqBv1xsh7JTax04MQP6Pek+aK5HhDsd&lnud=Txll_FO

GET 404 http://www.xn--laufgefhl-w9a.com/e3rs/?lnud=Txll_FO&Dz=b8jJRQWfF4+OnEJERRv9IAKdrqQukcbHmYLMW0jk5XDvFKBqdxoMO++0Oe2bhe+XWL2/5s9y

GET 0 http://www.oneowneronly.com/e3rs/?lnud=Txll_FO&Dz=Ei27cO4R/In4nCpRKe1X+vb6IhSQD7KJ8DOgqI0RS1UyrmbR2z2X6RwWjW3Zl1NqSx6QzXwL

GET 301 http://www.glowestudiocreativo.com/e3rs/?Dz=HRF5cBwRaD2pnVjl04lDxZrQc/S39DKKmsOHQJEpf55iLBXquTeAPsbQ5KkbylXLeFPlZQnh&lnud=Txll_FO

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:51935 -> 164.124.101.2:53	2026888	ET INFO DNS Query for Suspicious .icu Domain	Potentially Bad Traffic
UDP 192.168.56.103:51084 -> 164.124.101.2:53	2027863	ET INFO Observed DNS Query to .biz TLD	Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 87.236.16.206:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 87.236.16.206:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 87.236.16.206:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 142.44.146.49:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 142.44.146.49:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 142.44.146.49:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 198.185.159.144:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 198.185.159.144:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 198.185.159.144:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 81.169.145.80:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 81.169.145.80:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 81.169.145.80:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 185.156.219.142:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 185.156.219.142:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 185.156.219.142:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 37.48.65.153:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 37.48.65.153:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 37.48.65.153:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 34.117.168.233:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 34.117.168.233:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 34.117.168.233:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 154.196.11.183:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 154.196.11.183:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 154.196.11.183:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 198.251.84.92:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 198.251.84.92:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 198.251.84.92:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts