NetWork | ZeroBOX

Network Analysis

IP Address Status Action
154.204.248.137 Active Moloch
164.124.101.2 Active Moloch
175.41.16.124 Active Moloch
216.18.208.202 Active Moloch
45.33.6.223 Active Moloch
85.159.66.93 Active Moloch
GET 404 http://www.hf9blwwuwpx7j8k.live/pgnt/?9rn4nZSH=jggKibTkaQnsv+2bz686sPrTKpZZj5Y7aAqpZixHsFh0T3weMU/cyshvM3OEWd3UvH/Dq+t9ATMUuDnmaxwczBaDQ+rEYQWWB3PST8s=&w2=jFQp3Rm0k
REQUEST
RESPONSE
GET 200 http://www.sqlite.org/2020/sqlite-dll-win32-x86-3330000.zip
REQUEST
RESPONSE
POST 404 http://www.asiadesign.xyz/pgnt/
REQUEST
RESPONSE
POST 404 http://www.asiadesign.xyz/pgnt/
REQUEST
RESPONSE
POST 0 http://www.easy005.xyz/pgnt/
REQUEST
RESPONSE
POST 405 http://www.easy005.xyz/pgnt/
REQUEST
RESPONSE
GET 200 http://www.easy005.xyz/pgnt/?9rn4nZSH=c6ZjPMR1KypLsYL8ZObHXIR8yq1gidghehR4txHs12y83WCLVbV9I23DeUmMEfmlfVnaxELxUHkqoDbKi0r8vsl7teQksvkhOq4cf7k=&w2=jFQp3Rm0k
REQUEST
RESPONSE
POST 0 http://www.terratechpower.com/pgnt/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49167 -> 85.159.66.93:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 175.41.16.124:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 85.159.66.93:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 85.159.66.93:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 85.159.66.93:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 85.159.66.93:80 2031088 ET HUNTING Request to .XYZ Domain with Minimal Headers Potentially Bad Traffic
TCP 192.168.56.103:49172 -> 175.41.16.124:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 154.204.248.137:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 175.41.16.124:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 175.41.16.124:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 175.41.16.124:80 2031088 ET HUNTING Request to .XYZ Domain with Minimal Headers Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 216.18.208.202:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 216.18.208.202:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 216.18.208.202:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts