NetWork | ZeroBOX

Network Analysis

IP Address Status Action
104.21.8.182 Active Moloch
164.124.101.2 Active Moloch
216.40.34.41 Active Moloch
34.102.136.180 Active Moloch
GET 200 http://www.cabecompetency.com/dh08/?tZU4=6zMJpal1jELWyVXE7kHb6wwT7/dU/IFboNnwxgqTXGKMHLLlLHTleu9daJ1rUWDkLY7oYrRx&Ult8E=GTgP1na8nVYlWF
REQUEST
RESPONSE
GET 301 http://www.tgecosystem.com/dh08/?tZU4=A2V9+T/OcVJ+R/N/A9wtV6HjqQDkHgT/bH3QOw4mF+D+JFEk4yQjTLfggiip6Wi3+INi1Nnf&Ult8E=GTgP1na8nVYlWF
REQUEST
RESPONSE
GET 403 http://www.futurefmexpo.com/dh08/?tZU4=5gv4dgY5t2k2OqiJ2pc959383q9hiAV1qWA1rKNuG9NjkIQrUUmCD9VJnBdN/x2t6vjHDOZQ&Ult8E=GTgP1na8nVYlWF
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49166 -> 104.21.8.182:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 104.21.8.182:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 104.21.8.182:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 216.40.34.41:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 216.40.34.41:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 216.40.34.41:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts