NetWork | ZeroBOX

IP Address	Status	Action
164.124.101.2	Active	Moloch
185.126.216.74	Active	Moloch
45.196.84.173	Active	Moloch
45.33.6.223	Active	Moloch
46.30.213.155	Active	Moloch
8.209.78.136	Active	Moloch
81.17.29.146	Active	Moloch

Name	Response	Post-Analysis Lookup
www.thezweb.com	A 81.17.29.146	81.17.29.146
www.kkqqzb.xyz	A 8.209.78.136	8.209.78.136
www.fruitecology.com	A 46.30.213.155	46.30.213.155
www.atamahaberleri.com	CNAME atamahaberleri.com A 185.126.216.74	185.126.216.74
www.dg-computing.com	A 45.196.84.173	45.196.84.173
www.sqlite.org	A 45.33.6.223	45.33.6.223

TCP Requests

UDP Requests

GET 404 http://www.atamahaberleri.com/a2fh/?LggCa3B4=qcchKJfYoXX+SNysomeaXt2UPWY/FcJKOe6J/rkRQI82UqjdWxoSyFumgkLce2bhgQ1UYjQfjBP88N6FTJ0nkeTpGzUxt+uzFPein5I=&9xB=qObO_nFVUV3Q9s_

GET 200 http://www.sqlite.org/2016/sqlite-dll-win32-x86-3100000.zip

POST 404 http://www.kkqqzb.xyz/a2fh/

GET 567 http://www.kkqqzb.xyz/a2fh/?LggCa3B4=26Y37L3jXNG2JHI3wpaK6zCVLkrwfYXeV/30niWVu7rxeLE01wiRvGELFFHOaIrCm60YwShU1siy0NCFU9cAiPm31W1i39pBO7M5w+I=&9xB=qObO_nFVUV3Q9s_

POST 0 http://www.fruitecology.com/a2fh/

POST 404 http://www.fruitecology.com/a2fh/

GET 404 http://www.fruitecology.com/a2fh/?LggCa3B4=HirmV0K3W8X16cPIA6CgpFp2oQQLbxP0EUyoOXJjH6Oo2gLH1gE5EmJJO1tE0kgmFicI29ZS7SJZl+PB0hquqiKbSKMHjlIfypwbQTc=&9xB=qObO_nFVUV3Q9s_

POST 0 http://www.thezweb.com/a2fh/

POST 302 http://www.thezweb.com/a2fh/

GET 200 http://www.thezweb.com/a2fh/?LggCa3B4=ohPlRN1rGtRlq2ENH0YEDA1UceaE5ScRC2dJJXLlUzkXjZP8hqfc1Pamn8K9eI0nDacK8c7ZeK5GYMYRI15J27P9D9jBSgJvDxW15X4=&9xB=qObO_nFVUV3Q9s_

POST 302 http://www.dg-computing.com/a2fh/

GET 302 http://www.dg-computing.com/a2fh/?LggCa3B4=pV97ZqUGpE+UodE0UyDCOo7MEcmaoOdfg9usDzs3w3JwZR7SMHyMKVK/lZy2YBfdLhtcCUV0G4ICDRW/J2REkgHIgwBLa2wBoIgzf5w=&9xB=qObO_nFVUV3Q9s_

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49173 -> 81.17.29.146:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 45.196.84.173:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 8.209.78.136:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 45.196.84.173:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 45.196.84.173:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 46.30.213.155:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 45.196.84.173:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 46.30.213.155:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 46.30.213.155:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 46.30.213.155:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 8.209.78.136:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 8.209.78.136:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 8.209.78.136:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 8.209.78.136:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 185.126.216.74:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 185.126.216.74:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 185.126.216.74:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 81.17.29.146:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 81.17.29.146:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 81.17.29.146:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts