NetWork | ZeroBOX

Network Analysis

IP Address Status Action
107.172.148.217 Active Moloch
164.124.101.2 Active Moloch
172.67.171.154 Active Moloch
198.49.23.145 Active Moloch
81.88.57.68 Active Moloch
GET 200 http://107.172.148.217/245/hkcmd.exe
REQUEST
RESPONSE
GET 200 http://107.172.148.217/re/rs/IRjVevieEjoNGeLpLWfDSZKIoW131.bin
REQUEST
RESPONSE
GET 404 http://www.meuble-chaussure-entree.site/gtt8/?WZ=yCnQ5L6NlcTRcn+ifIq7oQPvIlFV2UDOCQ1NjUaFJYn2MwS8YusSoR7wSYegmy6tKiXh+Vbc&Rv=X2JXNdDX_20Dj04
REQUEST
RESPONSE
GET 400 http://www.parimaladragonflywellness.life/gtt8/?WZ=C+0/87yis/Zlv4qd7l9geBDqQKvoMWPO9Bv6EyyNy79humck0b/iQDmOl3lSHHtefS401NFg&Rv=X2JXNdDX_20Dj04
REQUEST
RESPONSE
GET 301 http://www.lennartjahn.com/gtt8/?WZ=OdtWE4DAxERL7SMiEfq8Qou+0omTbT/PNs+Z6OFSeBqZ4lp4mdBeKi3j+/SgzRhga1nsl2MQ&Rv=X2JXNdDX_20Dj04
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49170 -> 81.88.57.68:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 81.88.57.68:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 81.88.57.68:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 172.67.171.154:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 172.67.171.154:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 172.67.171.154:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
UDP 192.168.56.102:62846 -> 164.124.101.2:53 2027867 ET INFO Observed DNS Query to .life TLD Potentially Bad Traffic
TCP 192.168.56.102:49169 -> 107.172.148.217:80 2018752 ET MALWARE Generic .bin download from Dotted Quad A Network Trojan was detected
TCP 192.168.56.102:49163 -> 107.172.148.217:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 107.172.148.217:80 -> 192.168.56.102:49163 2022050 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 A Network Trojan was detected
TCP 107.172.148.217:80 -> 192.168.56.102:49163 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 107.172.148.217:80 -> 192.168.56.102:49163 2022051 ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 A Network Trojan was detected
TCP 107.172.148.217:80 -> 192.168.56.102:49163 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.102:49172 -> 198.49.23.145:80 2027876 ET INFO HTTP Request to Suspicious *.life Domain Potentially Bad Traffic
TCP 192.168.56.102:49172 -> 198.49.23.145:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 198.49.23.145:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 198.49.23.145:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 198.49.23.145:80 2027876 ET INFO HTTP Request to Suspicious *.life Domain Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts