NetWork | ZeroBOX

Network Analysis

IP Address Status Action
162.213.251.166 Active Moloch
164.124.101.2 Active Moloch
45.33.6.223 Active Moloch
66.33.60.194 Active Moloch
84.32.84.32 Active Moloch
POST 404 http://www.childhealth.pro/b0vh/
REQUEST
RESPONSE
GET 404 http://www.childhealth.pro/b0vh/?Gy99=QUBVmFKdBNxds9OiApRhVsAj+ScDRPHeUPya3YpvxKMFpoL0UXIizO+2Knd5vz9rSJ99vd1oMGbpKodYFcGso7ng1PXq6kPJUf/keZz2BFmCSPb1BPLSFhWLkB5VTYfkmDPjYsE=&A97DD=dIkYLZ1GahSa
REQUEST
RESPONSE
GET 200 http://www.sqlite.org/2017/sqlite-dll-win32-x86-3200000.zip
REQUEST
RESPONSE
POST 0 http://www.vivamente.shop/p4iy/
REQUEST
RESPONSE
GET 200 http://www.vivamente.shop/p4iy/?Gy99=SRywWHlJneqGbgnZMnkP75yQY1jNoV+uUvrvQ9vwHOg3gIy7AYQSo7rFsMjmhZA0ylqE+AAlROwVtLWgpormrByiUeawEdhj2T0RPVxTjD2FTpAWFNeIi4haYWVZYJq3iwiPjnM=&A97DD=dIkYLZ1GahSa
REQUEST
RESPONSE
POST 308 http://www.partflix.net/t94t/
REQUEST
RESPONSE
GET 308 http://www.partflix.net/t94t/?Gy99=6wcCudhLkH0VejVFRrMKOuT81SneVTs21TOXThNHeftxWAPzww3VNZ/fA4UNu8KULkzvL+qpdGK+6ln1YlZUcKuT272xiEUSQXi3WiUcrBFdZosaj7GWSIfDKBhRZwCKqwkunqw=&A97DD=dIkYLZ1GahSa
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49169 -> 162.213.251.166:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 66.33.60.194:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 84.32.84.32:80 2050745 ET MALWARE FormBook CnC Checkin (GET) M5 Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts