NetWork | ZeroBOX

IP Address	Status	Action
15.197.142.173	Active	Moloch
164.124.101.2	Active	Moloch
172.67.143.209	Active	Moloch
185.68.16.179	Active	Moloch
23.227.38.74	Active	Moloch
23.80.123.107	Active	Moloch
34.102.136.180	Active	Moloch
62.149.128.40	Active	Moloch

Name	Response	Post-Analysis Lookup
www.tahnforest.com	CNAME shops.myshopify.com A 23.227.38.74	23.227.38.74
www.mentalnayaarifmetika.online	A 185.68.16.179	185.68.16.179
www.dbcyebnveoyu.cloud	A 172.67.143.209 A 104.21.27.251	104.21.27.251
www.tootko.com
www.muktobangla.xyz
www.floridacaterpillar.com	A 34.102.136.180 CNAME floridacaterpillar.com	34.102.136.180
www.mftie.com	A 23.80.123.107	23.80.123.107
www.ageofcryptos.com	CNAME ageofcryptos.com A 62.149.128.40	62.149.128.40
www.insurancewineappraisals.com	A 15.197.142.173 A 3.33.152.147 CNAME insurancewineappraisals.com	3.33.152.147

TCP Requests

UDP Requests

GET 521 http://www.dbcyebnveoyu.cloud/ocgr/?v6=NDG9KC01HFGBB9DsALy3VqccTMt/l8ATZmUqKrl6ipangMiCP12KWRrhCJ/rfCl5rNuvAs7a&1b=V6RpsLj0n

GET 404 http://www.ageofcryptos.com/ocgr/?v6=/7YxqUa9m6G+5RhPxc9MRqyWJ3uHfA/CqbgrUyjJCZIsasmpWtsD/jId67xFo7gVLCDNXM6H&1b=V6RpsLj0n

GET 403 http://www.tahnforest.com/ocgr/?v6=kkcvVq03/3lDgVMLW4MaTtaHwAG6gu+AbYnshH2Mwdzmny692KyslllP252+PkadaeyoV9Cv&1b=V6RpsLj0n

GET 403 http://www.mentalnayaarifmetika.online/ocgr/?v6=WCPK4waAr5EXG8SW/rbcYrxYoSsYkto1Afd9Drm9jpJADNSd9KR9P4A2ZEhlrXip+80cdLiS&1b=V6RpsLj0n

GET 403 http://www.insurancewineappraisals.com/ocgr/?v6=JObsRn19AdTkTzhzSx4/G4vHKR3Ocu5GfQq+UlZqrYFN7H7eyU/GWlSiGnkaO8zS8xrm0NBy&1b=V6RpsLj0n

GET 403 http://www.floridacaterpillar.com/ocgr/?v6=cHzMBU+My2VDKYJs4/si3p8Uu1AacF9CDlvbhldwQ+JQEJlNtP95Gcx9FP/BsUI6KNhZKzGQ&1b=V6RpsLj0n

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.103:60117 -> 164.124.101.2:53	2027865	ET INFO Observed DNS Query to .cloud TLD	Potentially Bad Traffic
TCP 192.168.56.103:49169 -> 23.227.38.74:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 23.227.38.74:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 23.227.38.74:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 34.102.136.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 172.67.143.209:80	2027874	ET INFO HTTP Request to Suspicious *.cloud Domain	Potentially Bad Traffic
TCP 192.168.56.103:49172 -> 34.102.136.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 34.102.136.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 172.67.143.209:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 172.67.143.209:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 172.67.143.209:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 172.67.143.209:80	2027874	ET INFO HTTP Request to Suspicious *.cloud Domain	Potentially Bad Traffic
TCP 192.168.56.103:49170 -> 185.68.16.179:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 185.68.16.179:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 185.68.16.179:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 62.149.128.40:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 62.149.128.40:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 62.149.128.40:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 15.197.142.173:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 15.197.142.173:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 15.197.142.173:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts