NetWork | ZeroBOX

Network Analysis

IP Address Status Action
135.148.169.28 Active Moloch
164.124.101.2 Active Moloch
34.102.136.180 Active Moloch
66.113.136.229 Active Moloch
GET 403 http://www.financialincubatorsolutions.com/eni9/?CP=g75aN7EngwiaxxJBLibYGDtiCu0cqaycQ9yycSDXNTNWeiWJRv3rDPs+tJ+V+YY4/DpguRM5&n4=Sxl0iBexVtEHj
REQUEST
RESPONSE
GET 301 http://www.personalassistanttools.com/eni9/?CP=0VPhllV96M60aJ4/7wJgj3Q1obRKhQA324OWsfMx2aO5OwnWD17LCZy5gEcOsxpDI8HGxlwM&n4=Sxl0iBexVtEHj
REQUEST
RESPONSE
GET 403 http://www.skixxx.art/eni9/?CP=8fC1VFyiBxjG2FKgERhtVyvbtN1LIRoN7m7DuBSaip5Hl7AvBCFXn37Pru7su+Iy1mOTnz0Q&n4=Sxl0iBexVtEHj
REQUEST
RESPONSE

ICMP traffic

Source Destination ICMP Type Data
192.168.56.103 164.124.101.2 3
192.168.56.103 164.124.101.2 3
192.168.56.103 164.124.101.2 3
192.168.56.103 164.124.101.2 3

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49165 -> 135.148.169.28:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 135.148.169.28:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 135.148.169.28:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts