NetWork | ZeroBOX

IP Address	Status	Action
104.21.46.34	Active	Moloch
104.237.50.195	Active	Moloch
164.124.101.2	Active	Moloch
185.53.179.170	Active	Moloch
208.111.34.205	Active	Moloch
209.205.209.34	Active	Moloch
45.207.118.25	Active	Moloch
63.141.245.131	Active	Moloch
93.89.226.17	Active	Moloch

Name	Response	Post-Analysis Lookup
www.labouchedeli.com	A 45.207.118.25	45.207.118.25
www.moderze.life	A 63.141.245.131 CNAME moderze.life	63.141.245.131
www.stringerville.com	A 208.111.34.205	208.111.34.205
www.anadolusapka.online	A 93.89.226.17 CNAME anadolusapka.online	93.89.226.17
www.bdoranoilgasltd.com	CNAME bdoranoilgasltd.com A 209.205.209.34	209.205.209.34
www.lendana.net	A 104.237.50.195	104.237.50.195
www.dohsrdmoney.com	A 185.53.179.170	185.53.179.170
www.bt-vip1.com	A 104.21.46.34 A 172.67.223.34	104.21.46.34

TCP Requests

UDP Requests

GET 403 http://www.stringerville.com/agjr/?9rz8FzAh=Gh6tluMPQTcPzyNG3zRmzh0pGICJSQ0CUkM68yXk4Zf2KgIpjM56r3gFfc5RNnk2iDOxxtSdUz6lpnbsV5fRyyCc5U2lcTVCcnegnGU=&mlvx=fZU8pTY0MT2trP

GET 404 http://www.bdoranoilgasltd.com/agjr/?9rz8FzAh=wLgJm0zEN2ATms2/CyDHu0TfQmq0Qdx9BIX7BSDR0lyiVzgJQd6T1ThEupbW8wyYcCRWDLx3n0hYKwqwkbL/iO25XFunPFcbHS+/t1o=&mlvx=fZU8pTY0MT2trP

GET 200 http://www.labouchedeli.com/agjr/?9rz8FzAh=Q1WOsUBcDfdQ3aMTDXwxoUuH9advFFpSbncEIUbmsSSzX/3pU7s/FUVesXbRs6YgXTF/hEXOzS3t03OE2MkP72joJzE2hGlxVlRwVNY=&mlvx=fZU8pTY0MT2trP

GET 403 http://www.dohsrdmoney.com/agjr/?9rz8FzAh=MIHXyzReQtTKKXsL4NjRRigJE4TWaimoTOG+nOUfQu98OOW6g24o0SH/ypdTtMYzylzRxOnqTw2p75VeE5ZfvnoiMUf8y7KO2x18GDI=&mlvx=fZU8pTY0MT2trP

GET 200 http://www.moderze.life/agjr/?9rz8FzAh=zl4Ji3koWtggKuUOv6IQWcypBjnDnWrEcGs8NoP88FgwQ4RslMBdACHlWLRkTFsphRZ0UGdbDU3dRCHToxp66exSOm+4LFPvyZcMEXM=&mlvx=fZU8pTY0MT2trP

GET 404 http://www.lendana.net/agjr/?9rz8FzAh=RLPrgi6zXzxazkIO08wA4We7IyJr7/AqVNuUchigLl6UTdzpL7ASSLO4e8ih3pKyl7USooaVHobrnzgFxZbXcwSRjTVhavlq0x9S+4A=&mlvx=fZU8pTY0MT2trP

GET 404 http://www.bt-vip1.com/agjr/?9rz8FzAh=cMvUU+iRx5dPYw4DF8Z3ADZbRliYC2ERcjdIPLlnxH/bLxeYplKwUpLXGSto7dGpFXcTNmqbt/tuoogMVd+yABMfw/FgUsgcEu4Nx5A=&mlvx=fZU8pTY0MT2trP

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49169 -> 209.205.209.34:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 209.205.209.34:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 209.205.209.34:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
UDP 192.168.56.103:53064 -> 164.124.101.2:53	2027867	ET INFO Observed DNS Query to .life TLD	Potentially Bad Traffic
TCP 192.168.56.103:49175 -> 104.21.46.34:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 104.21.46.34:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 104.21.46.34:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 185.53.179.170:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 185.53.179.170:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 185.53.179.170:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 63.141.245.131:80	2027876	ET INFO HTTP Request to Suspicious *.life Domain	Potentially Bad Traffic
TCP 192.168.56.103:49172 -> 63.141.245.131:80	2027876	ET INFO HTTP Request to Suspicious *.life Domain	Potentially Bad Traffic
TCP 192.168.56.103:49173 -> 93.89.226.17:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 93.89.226.17:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 93.89.226.17:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 104.237.50.195:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 104.237.50.195:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 104.237.50.195:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 63.141.245.131:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 63.141.245.131:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 63.141.245.131:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 63.141.245.131:80	2027876	ET INFO HTTP Request to Suspicious *.life Domain	Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 208.111.34.205:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 208.111.34.205:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 208.111.34.205:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 45.207.118.25:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 45.207.118.25:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 45.207.118.25:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts