NetWork | ZeroBOX

Network Analysis

IP Address Status Action
154.211.6.140 Active Moloch
164.124.101.2 Active Moloch
167.172.228.26 Active Moloch
185.215.4.53 Active Moloch
31.186.11.254 Active Moloch
45.33.6.223 Active Moloch
POST 404 http://www.ladookhotnikov.pro/b0n2/
REQUEST
RESPONSE
GET 404 http://www.ladookhotnikov.pro/b0n2/?y9=UBEc/gOREsWhRjfgOCV+1+JiinyAdXbhHxe8y5u01Nzj6ZMeJfVpNRipiet0bNC5wtAmoEND3mJBcEe3MMZ+QNWkhcCvUZa871o6QsI=&udp=hDpz
REQUEST
RESPONSE
GET 404 http://www.sqlite.org/2021/sqlite-dll-win32-x86-3340000.zip
REQUEST
RESPONSE
GET 200 http://www.sqlite.org/2017/sqlite-dll-win32-x86-3180000.zip
REQUEST
RESPONSE
POST 404 http://www.sdrongfei.com/b0n2/
REQUEST
RESPONSE
GET 404 http://www.sdrongfei.com/b0n2/?y9=6rAhzxdjZwhumfSwHjeZhKNvwWilDFZg3FlFq9l5kFDYIxuGNfVhFNHJQ/+ZUBOV1gUdIESkP1VkLGU+T6X2I6iiw2u+SZW4hC7utV4=&udp=hDpz
REQUEST
RESPONSE
POST 302 http://www.geoffregsiu.com/b0n2/
REQUEST
RESPONSE
POST 302 http://www.geoffregsiu.com/b0n2/
REQUEST
RESPONSE
GET 404 http://www.geoffregsiu.com/b0n2/?y9=C+ffa5fIsPqpX/YjwiZCCYdwDlII4sg9Xg6ClcbCMMdG9WOkFnuyV4UEPSj2eq9dA37TJ/jYCfSNl3AfQBBAWI5iih0wk4QqY5CxYcY=&udp=hDpz
REQUEST
RESPONSE
POST 0 http://www.tenistr.online/b0n2/
REQUEST
RESPONSE
POST 0 http://www.tenistr.online/b0n2/
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49176 -> 167.172.228.26:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 154.211.6.140:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 154.211.6.140:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 154.211.6.140:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 154.211.6.140:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49179 -> 31.186.11.254:80 2031413 ET MALWARE FormBook CnC Checkin (POST) M2 Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 185.215.4.53:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 185.215.4.53:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 185.215.4.53:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49178 -> 167.172.228.26:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49178 -> 167.172.228.26:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49178 -> 167.172.228.26:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49181 -> 31.186.11.254:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49181 -> 31.186.11.254:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49181 -> 31.186.11.254:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts