NetWork | ZeroBOX

IP Address	Status	Action
109.123.121.243	Active	Moloch
164.124.101.2	Active	Moloch
172.67.173.11	Active	Moloch
195.201.147.116	Active	Moloch
210.16.189.19	Active	Moloch
45.33.6.223	Active	Moloch
67.223.117.160	Active	Moloch
91.195.240.45	Active	Moloch

Name	Response	Post-Analysis Lookup
www.mjsink.com	A 172.67.173.11 A 104.21.88.53	104.21.88.53
www.marketing-solution.net	A 91.195.240.45	91.195.240.45
www.regnerjanet.xyz	A 109.123.121.243	109.123.121.243
www.towfire.life	A 67.223.117.160	67.223.117.160
www.sqlite.org	A 45.33.6.223	45.33.6.223
www.ginbaochip.com	A 210.16.189.19	210.16.189.19

TCP Requests

UDP Requests

GET 200 http://195.201.147.116/422/vbc.exe

POST 404 http://www.regnerjanet.xyz/f619/

GET 404 http://www.regnerjanet.xyz/f619/?8h-zwsZ=6wuoF5Ocy4AJpvQBu7Oine5RwOGmLKsd0ov4HSbRQC4ETZ6v/roT0yDkqgD/NT0BDr09cLMaIgNt2KmG3oCiS9IXpK2jSgOlbsyy8aE=&XoCV09=Pw3IzxRA7ICfJT

GET 200 http://www.sqlite.org/2018/sqlite-dll-win32-x86-3260000.zip

POST 404 http://www.mjsink.com/f619/

GET 404 http://www.mjsink.com/f619/?8h-zwsZ=QohnKbePrODEc2nRtJyzKv2nV7sTIQ5Qx9yDXgwt8Ie8gSFBAbmvCJj6zIyweYgDzy/0i+4z3xbiwRYsSsB8T6DnOWQEfeuCAQefg3Q=&XoCV09=Pw3IzxRA7ICfJT

POST 404 http://www.ginbaochip.com/f619/

GET 404 http://www.ginbaochip.com/f619/?8h-zwsZ=J8+hP/zSxq0se/+LWXXRGMthd5MtqREYtVha/m82I85cLREj8S8ix7RpcjqSy8HBHkmEBC3cSxdy+flYH4rJd56MdeRk/rncEkBsCJA=&XoCV09=Pw3IzxRA7ICfJT

POST 404 http://www.towfire.life/f619/

GET 404 http://www.towfire.life/f619/?8h-zwsZ=Ehbg4LlyVMHP0pAFmIQxhDDkp6Kxs477sF6nDv0EaT5K8/1GH5wf1bgzqSKTUaDZXTnW9d28cNYQDMZcc5x0F8aQqyCdRYlsL10lLoU=&XoCV09=Pw3IzxRA7ICfJT

POST 403 http://www.marketing-solution.net/f619/

GET 200 http://www.marketing-solution.net/f619/?8h-zwsZ=7aEb1be+dODnXJS70ht2rOIyRE7tt83KP3MXokAl2sed9H5NqFjOq19haFrbwR5XS7xCcbMG4E83Por5kDVXeeM4WTNIDHd3Sc1+pdc=&XoCV09=Pw3IzxRA7ICfJT

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49162 -> 195.201.147.116:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.103:49162 -> 195.201.147.116:80	2035207	ET MALWARE MSIL/GenKryptik.FQRH Download Request	A Network Trojan was detected
TCP 192.168.56.103:49162 -> 195.201.147.116:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 195.201.147.116:80 -> 192.168.56.103:49162	2022050	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1	A Network Trojan was detected
TCP 195.201.147.116:80 -> 192.168.56.103:49162	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 195.201.147.116:80 -> 192.168.56.103:49162	2022051	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2	A Network Trojan was detected
TCP 195.201.147.116:80 -> 192.168.56.103:49162	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49178 -> 67.223.117.160:80	2027876	ET INFO HTTP Request to Suspicious *.life Domain	Potentially Bad Traffic
TCP 192.168.56.103:49178 -> 67.223.117.160:80	2027876	ET INFO HTTP Request to Suspicious *.life Domain	Potentially Bad Traffic
TCP 192.168.56.103:49173 -> 210.16.189.19:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected
UDP 192.168.56.103:62576 -> 164.124.101.2:53	2027867	ET INFO Observed DNS Query to .life TLD	Potentially Bad Traffic
TCP 192.168.56.103:49176 -> 67.223.117.160:80	2027876	ET INFO HTTP Request to Suspicious *.life Domain	Potentially Bad Traffic
TCP 192.168.56.103:49176 -> 67.223.117.160:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 67.223.117.160:80	2027876	ET INFO HTTP Request to Suspicious *.life Domain	Potentially Bad Traffic
TCP 192.168.56.103:49182 -> 91.195.240.45:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 91.195.240.45:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 91.195.240.45:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 210.16.189.19:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 210.16.189.19:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 210.16.189.19:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 67.223.117.160:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 67.223.117.160:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 67.223.117.160:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 67.223.117.160:80	2027876	ET INFO HTTP Request to Suspicious *.life Domain	Potentially Bad Traffic
TCP 192.168.56.103:49170 -> 172.67.173.11:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 172.67.173.11:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 172.67.173.11:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 172.67.173.11:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 109.123.121.243:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 109.123.121.243:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 109.123.121.243:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 109.123.121.243:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts