NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
192.0.78.24 Active Moloch
35.227.197.36 Active Moloch
76.223.105.230 Active Moloch
GET 301 http://www.oliviahodges04.uk/sa79/?T8kD=3HmUkRFWstZ/xsvvXCVgYJLRrrcnJmgiwegIDeQwZYyLk7GSagwRMPBNdLuE3jtARa50r64A&Vnw0Z=-Z2hTbdPQ2dhN4y
REQUEST
RESPONSE
GET 301 http://www.rahilprakash.com/sa79/?T8kD=FQxM/LfEtsdNPd9lcQ3fHhWjGCP7SrZqu0I9GJfO6cOgbFH11N56o5A937py/xwkq6yJtR1f&Vnw0Z=-Z2hTbdPQ2dhN4y
REQUEST
RESPONSE
GET 403 http://www.cloud-spartan.co.uk/sa79/?T8kD=jkxHAd9GAbQei4M5qdOAezShFl0g6rfkBT3I54TzQtwvhmYtcfZekS4RyxImys3XUoylJySQ&Vnw0Z=-Z2hTbdPQ2dhN4y
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49169 -> 192.0.78.24:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 192.0.78.24:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 192.0.78.24:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 76.223.105.230:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 76.223.105.230:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 76.223.105.230:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 35.227.197.36:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 35.227.197.36:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 35.227.197.36:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts