NetWork | ZeroBOX

IP Address	Status	Action
185.225.75.8	Active	Moloch
103.71.154.243	Active	Moloch
104.21.13.143	Active	Moloch
164.124.101.2	Active	Moloch
199.59.243.225	Active	Moloch
216.239.38.21	Active	Moloch
216.240.130.67	Active	Moloch
23.104.137.185	Active	Moloch
23.95.106.3	Active	Moloch
45.33.6.223	Active	Moloch
67.223.117.37	Active	Moloch
85.128.134.237	Active	Moloch

Name	Response	Post-Analysis Lookup
www.poultry-symposium.com	A 85.128.134.237	85.128.134.237
www.frefire.top	A 67.223.117.37	67.223.117.37
www.tsygy.com	A 23.104.137.185	23.104.137.185
www.onlyleona.com	A 104.21.13.143 A 172.67.132.228	172.67.132.228
www.prosourcegraniteinc.com	A 216.239.34.21 A 216.239.36.21 A 216.239.38.21 A 216.239.32.21	216.239.32.21
www.siteapp.fun
www.theartboxslidell.com	A 199.59.243.225	199.59.243.225
www.xxkxcfkujyeft.xyz	A 216.240.130.67 CNAME xxkxcfkujyeft.xyz	216.240.130.67
www.pengeloladata.click
www.8956kjw1.com	CNAME cname.bf723.com A 103.71.154.243	103.71.154.243
www.sqlite.org	A 45.33.6.223	45.33.6.223

TCP Requests

UDP Requests

GET 200 http://23.95.106.3/479/qw/Ooseha.exe

GET 200 http://23.95.106.3/479/Kodviywuey.mp3

GET 200 http://23.95.106.3/479/process.exe

POST 403 http://www.prosourcegraniteinc.com/kniu/

GET 200 http://www.prosourcegraniteinc.com/kniu/?9UU4WiQ1=9xFgCh3s8l/k2B8O7aAt9yPceR5ZLMimGcu4Dy10KR8z2IhjbkPtetaY6rVQOSuqKBOJhR+SeENFOh5XwKmANMDhEFCrb4byHJuvuWU=&XT=9LS9sDj_UX

GET 200 http://www.sqlite.org/2018/sqlite-dll-win32-x86-3220000.zip

POST 200 http://www.theartboxslidell.com/kniu/

GET 200 http://www.theartboxslidell.com/kniu/?9UU4WiQ1=pbzwZ3uv6ZLNK9kOZcORaqCkpmWHCySL5KPRtIvuGjYxhe5HL3eyc57X4ozDsIqy99XGgcN1QrQuWuftpLGszPSRgY0zgb673Mjl5VE=&XT=9LS9sDj_UX

POST 404 http://www.xxkxcfkujyeft.xyz/kniu/

GET 404 http://www.xxkxcfkujyeft.xyz/kniu/?9UU4WiQ1=i0HwDxosD6vP35vKxXt8TqB5hgt09UAmGu6yXsGJ7KHeDbKCAxtr8kYkpXafqSJ5CWKS4JQhNIcZa2fBS8/HEz0POFGF5EDYOp/zgDU=&XT=9LS9sDj_UX

POST 405 http://www.onlyleona.com/kniu/

GET 404 http://www.onlyleona.com/kniu/?9UU4WiQ1=eul8o7FRTpzZYv+GqkkzOpE5tEZO7cuUa8jf7YGp4uFOB2eW2y1ALY7ycZgKlFf7jddzg63rMJOPKD43r6dZxMpJnJONv2M7MFgI8Mw=&XT=9LS9sDj_UX

POST 0 http://www.tsygy.com/kniu/

POST 404 http://www.tsygy.com/kniu/

GET 404 http://www.tsygy.com/kniu/?9UU4WiQ1=bJ36cMi4kupHJe0Hctq9gMewB+uvjmGDqwrfSqfgcqRhOtXAC1zMZIlHhDCyIhSJCFAYjWOLktx1yjWN3ai585tt7uX+B1FmFo0jbF0=&XT=9LS9sDj_UX

POST 0 http://www.poultry-symposium.com/kniu/

POST 200 http://www.poultry-symposium.com/kniu/

GET 200 http://www.poultry-symposium.com/kniu/?9UU4WiQ1=40XX9Ytbs/otsI+0yUtAogrXy8SgXZWV889z9rydVcgoc+JCy8vgR1icdWU6u94Njq5xrtv7NQnpOX1iusCyLYuLxlHkdapdsh1Ymak=&XT=9LS9sDj_UX

POST 404 http://www.frefire.top/kniu/

GET 404 http://www.frefire.top/kniu/?9UU4WiQ1=w8rKBuSUIg6smCThP+RZr8URK2cMAOxRwdqHG6Uo67OOMeio1zBa/jWrwyXT3+M/9aqTr1N41d9bzE5WN9beyeWExgAtk5mD8L1zbeQ=&XT=9LS9sDj_UX

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49162 -> 23.95.106.3:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 23.95.106.3:80 -> 192.168.56.103:49162	2022050	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1	A Network Trojan was detected
TCP 23.95.106.3:80 -> 192.168.56.103:49162	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 23.95.106.3:80 -> 192.168.56.103:49162	2022051	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2	A Network Trojan was detected
TCP 23.95.106.3:80 -> 192.168.56.103:49162	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 23.95.106.3:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 23.95.106.3:80 -> 192.168.56.103:49166	2014819	ET INFO Packed Executable Download	Misc activity
TCP 192.168.56.103:49173 -> 199.59.243.225:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected
TCP 23.95.106.3:80 -> 192.168.56.103:49166	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 23.95.106.3:80 -> 192.168.56.103:49166	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 23.95.106.3:80 -> 192.168.56.103:49166	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49185 -> 85.128.134.237:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected
TCP 103.71.154.243:80 -> 192.168.56.103:49190	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 103.71.154.243:80 -> 192.168.56.103:49189	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 192.168.56.103:49191 -> 67.223.117.37:80	2023882	ET INFO HTTP Request to a *.top domain	Potentially Bad Traffic
TCP 192.168.56.103:49191 -> 67.223.117.37:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 216.240.130.67:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected
UDP 192.168.56.103:64631 -> 164.124.101.2:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic
TCP 185.225.75.8:3333 -> 192.168.56.103:49166	2525015	ET 3CORESec Poor Reputation IP group 16	Misc Attack
TCP 103.71.154.243:80 -> 192.168.56.103:49188	2221010	SURICATA HTTP unable to match response to request	Generic Protocol Command Decode
TCP 192.168.56.103:49182 -> 23.104.137.185:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49193 -> 67.223.117.37:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49193 -> 67.223.117.37:80	2031089	ET HUNTING Request to .TOP Domain with Minimal Headers	Potentially Bad Traffic
TCP 192.168.56.103:49171 -> 216.239.38.21:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49184 -> 23.104.137.185:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 199.59.243.225:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 216.240.130.67:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 216.240.130.67:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic
TCP 192.168.56.103:49181 -> 104.21.13.143:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49187 -> 85.128.134.237:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 104.21.13.143:80	2031413	ET MALWARE FormBook CnC Checkin (POST) M2	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts