NetWork | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.15 01:11
wwbizsrvs.exe
11.15 01:11
op.exe
11.15 01:11
msf.exe
11.15 01:11
lum250.exe
11.15 01:11
msf443.exe
11.13 04:11
hello.exe
11.13 03:11
espsemhvcioff.exe
11.13 02:11
Geek_se.exe
11.13 02:11
cred64.dll
11.13 02:11
svhost.exe

Latest News
11.16 12:11
Critical Unauthenticat...
11.16 12:11
BASIC Co-Inventor Thom...
11.16 09:11
존쿡 델리미트 외식 매장서 ‘연말맞이 다...
11.16 09:11
서울퓨처랩, 누적체험객 6만명 돌파…프로...
11.16 09:11
니지모리스튜디오 갤러리, 일본 일러스트 ...
11.16 09:11
RISC-V Pushes 400 Mill...
11.16 09:11
IT Sicherheitsnews tae...
11.16 07:11
Anduril’s Chair Consul...
11.16 07:11
Senators Call for Prob...
11.16 06:11
Microsoft Windows NTLM...

NetWork | ZeroBOX

IP Address	Status	Action
164.124.101.2	Active	Moloch
198.143.186.151	Active	Moloch
199.115.116.43	Active	Moloch
35.186.223.180	Active	Moloch
74.208.236.124	Active	Moloch

Name	Response	Post-Analysis Lookup
www.deliciasbethel.info	A 199.115.116.43	199.115.116.43
www.rastreosonline.lat	A 35.186.223.180	35.186.223.180
www.globalservice.fun	A 198.143.186.151 CNAME globalservice.fun	198.143.186.151
www.lawyercriminal.online	A 74.208.236.124	74.208.236.124

TCP Requests

UDP Requests

GET 404 http://www.lawyercriminal.online/c20s/?DVBX=OqT4TDZXX8n4nzhgSqDClvlTeNzDX736vbjdAvptvkJx+VGp3lprU3NJ1OqV6uSCFtdB5HHf&UbGD=qFNxA0YxDdFXnlHP

GET 302 http://www.deliciasbethel.info/c20s/?DVBX=0MD65XWqEGmfQ0385QOYLMWXUmbCICRz+ZxGu9aOkLt7+ZM+opJpio0/V1ouAxNLj4ViaBph&UbGD=qFNxA0YxDdFXnlHP

GET 301 http://www.globalservice.fun/c20s/?DVBX=8GjTKD1P5krVnnM+7bBe0gOYwBaMV8hxPnCdvjlSRTD5gVIx5fO8N6aCbhO/gOACPtm11bCQ&UbGD=qFNxA0YxDdFXnlHP

GET 500 http://www.rastreosonline.lat/c20s/?DVBX=3rfdN+WQ4K5ti9+PcEtUR+xxfPddEUd2ubj+kG8ODpULlQc0d7OahN6Fp1kUWJZerpn6yhMk&UbGD=qFNxA0YxDdFXnlHP

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49165 -> 74.208.236.124:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 74.208.236.124:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 74.208.236.124:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 198.143.186.151:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 198.143.186.151:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 198.143.186.151:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 35.186.223.180:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 35.186.223.180:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 35.186.223.180:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 199.115.116.43:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 199.115.116.43:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 199.115.116.43:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts