NetWork | ZeroBOX

Network Analysis

IP Address Status Action
154.19.186.209 Active Moloch
164.124.101.2 Active Moloch
192.185.39.28 Active Moloch
192.227.183.170 Active Moloch
27.124.125.171 Active Moloch
GET 200 http://192.227.183.170/mac/Eunmqp.png
REQUEST
RESPONSE
GET 0 http://www.alphametatek.online/ar73/?4hLpNJ=8PQPyxuyNQLALfcTnwnCIS8V6sOsrVQczXAXl7lVYCMlFKgF4d3+cTIu+9fq5JPqxk7vHQfg&nfutZl=xPJ4abP8
REQUEST
RESPONSE
GET 301 http://www.five-dollar-meals.com/ar73/?4hLpNJ=xw5+2WrtgZ3I+FmDO28cYdOMSi8i8skO3LqTANOzc5+CPzKV8TCqQFujaaofBjSxJp3ZM220&nfutZl=xPJ4abP8
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49169 -> 192.185.39.28:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 192.185.39.28:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 192.185.39.28:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 27.124.125.171:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 27.124.125.171:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 27.124.125.171:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 154.19.186.209:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 154.19.186.209:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 154.19.186.209:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts