NetWork | ZeroBOX

IP Address	Status	Action
134.122.225.195	Active	Moloch
15.197.142.173	Active	Moloch
164.124.101.2	Active	Moloch
185.53.179.171	Active	Moloch
208.91.197.27	Active	Moloch
23.227.38.74	Active	Moloch
34.102.136.180	Active	Moloch
35.241.47.216	Active	Moloch

Name	Response	Post-Analysis Lookup
www.alcosto.club	CNAME alcosto.club A 34.102.136.180	34.102.136.180
www.executivetravelandlogistics.com	CNAME executivetravelandlogistics.com A 34.102.136.180	34.102.136.180
www.lojas-marias.com	CNAME lojamariaas.myshopify.com CNAME shops.myshopify.com A 23.227.38.74	23.227.38.74
www.6084pinelake.info	CNAME 6084pinelake.info A 15.197.142.173 A 3.33.152.147	3.33.152.147
www.employeebnsf.com	A 185.53.179.171	185.53.179.171
www.bldh45.xyz	A 35.241.47.216	35.241.47.216
www.moment4miracles.com	A 208.91.197.27	208.91.197.27
www.admincost.com
www.agelessfish.com	A 134.122.225.195	134.122.225.195

TCP Requests

UDP Requests

GET 200 http://www.bldh45.xyz/n6g4/?p0D=er/aW89hqZ/x2jPnh32zztWhmYSSn5MxbIy54W/3LVEYBqAoUdX3JCn0upO7r/Zv4Uhzd0tX&uFNl=XPclnfQPULv

GET 200 http://www.moment4miracles.com/n6g4/?p0D=PsntvU6v4CRkSuqaFHZW0pb5PTAK+hbatLrgbJuIkT0ZTI72gQG9OaDIbkaiFRK5RvhsvPxb&uFNl=XPclnfQPULv

GET 403 http://www.executivetravelandlogistics.com/n6g4/?p0D=GLoe/4UCmwC7HlqyZw3VEquRQI9a0MrOtnwix5hO8JL11MHqKzLvDjNwgO7O9nDHqKf/RaLP&uFNl=XPclnfQPULv

GET 403 http://www.6084pinelake.info/n6g4/?p0D=/EgobrQDT6eYXvmSTJIDXiQ/qbao7wANV39NpTJLs0brSRoOswaCV2zc+DqJbKfEJnrHxpXI&uFNl=XPclnfQPULv

GET 403 http://www.lojas-marias.com/n6g4/?p0D=TLEfg0hRnrZPcnYqH+5VOmv8AlAgrPRjTjTVBNqqBZfa0++7AI5xrB+dAMg9LLi6clhi6lha&uFNl=XPclnfQPULv

GET 403 http://www.employeebnsf.com/n6g4/?p0D=/8Ga1vKGX5EU/V/vBfc9R87wDDB6IH5FC+aL3DgDAA8ZWL71dgMkGFkeqd0AB3P/UBWI+Fxa&uFNl=XPclnfQPULv

GET 200 http://www.agelessfish.com/n6g4/?p0D=VVT0eV61/duqSEOzU/upkp96eNUViODnSPjhFuoMZk9HTCgswXUihgeBz4Z2JJbjJkgG4Igj&uFNl=XPclnfQPULv

GET 403 http://www.alcosto.club/n6g4/?p0D=2el/ot7c5YMBGOF4tAPHNftfrICusYpqYK7DNkJepwGfwFVVH29M1MFuPNXmLzoTPja39Bx2&uFNl=XPclnfQPULv

ICMP traffic

Source	Destination	ICMP Type	Data
192.168.56.101	164.124.101.2	3

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49174 -> 185.53.179.171:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 185.53.179.171:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 185.53.179.171:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 208.91.197.27:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 208.91.197.27:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 208.91.197.27:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 23.227.38.74:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 23.227.38.74:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 23.227.38.74:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 15.197.142.173:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 15.197.142.173:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 15.197.142.173:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 134.122.225.195:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 134.122.225.195:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 134.122.225.195:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 35.241.47.216:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 35.241.47.216:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 35.241.47.216:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 35.241.47.216:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts