Network Analysis
Name | Response | Post-Analysis Lookup |
---|---|---|
gwenetha.info | 104.21.12.27 | |
pastebin.com | 104.23.98.190 | |
iplogger.org | 88.99.66.31 | |
cdn.discordapp.com | 162.159.134.233 | |
whatitis.website |
- TCP Requests
-
-
192.168.56.101:49201 104.23.99.190:443pastebin.com
-
192.168.56.101:49202 162.159.133.233:443cdn.discordapp.com
-
192.168.56.101:49203 162.159.133.233:443cdn.discordapp.com
-
192.168.56.101:49206 162.159.133.233:443cdn.discordapp.com
-
192.168.56.101:49207 162.159.133.233:443cdn.discordapp.com
-
192.168.56.101:49208 162.159.133.233:443cdn.discordapp.com
-
192.168.56.101:49204 172.67.131.232:443gwenetha.info
-
192.168.56.101:49205 88.99.66.31:443iplogger.org
-
- UDP Requests
-
-
192.168.56.101:54056 164.124.101.2:53
-
192.168.56.101:55450 164.124.101.2:53
-
192.168.56.101:59369 164.124.101.2:53
-
192.168.56.101:61479 164.124.101.2:53
-
192.168.56.101:62324 164.124.101.2:53
-
192.168.56.101:65329 164.124.101.2:53
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:138 192.168.56.255:138
-
192.168.56.101:49152 239.255.255.250:3702
-
192.168.56.101:62325 239.255.255.250:3702
-
192.168.56.101:62445 239.255.255.250:1900
-
192.168.56.101:62447 239.255.255.250:3702
-
192.168.56.101:62449 239.255.255.250:3702
-
52.231.114.183:123 192.168.56.101:123
-
8.8.8.8:53 192.168.56.101:65329
-
GET
200
https://pastebin.com/raw/gCyjHCCH
REQUEST
RESPONSE
BODY
GET /raw/gCyjHCCH HTTP/1.1
Host: pastebin.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 07 Apr 2021 07:44:32 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d46747f6db05896f0310afd3fdde679b51617781472; expires=Fri, 07-May-21 07:44:32 GMT; path=/; domain=.pastebin.com; HttpOnly; SameSite=Lax; Secure
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1;mode=block
cache-control: public, max-age=1801
CF-Cache-Status: HIT
Age: 1114
cf-request-id: 094ce353bd00000aa0433cc000000001
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
CF-RAY: 63c1a1992faa0aa0-NRT
GET
403
https://cdn.discordapp.com/attachments/826198252025675816/826538114838298715/install_setupVPSfree.exe
REQUEST
RESPONSE
BODY
GET /attachments/826198252025675816/826538114838298715/install_setupVPSfree.exe HTTP/1.1
Host: cdn.discordapp.com
Connection: Keep-Alive
HTTP/1.1 403 Forbidden
Date: Wed, 07 Apr 2021 07:44:48 GMT
Content-Type: application/xml; charset=UTF-8
Content-Length: 223
Connection: keep-alive
Set-Cookie: __cfduid=d7b304178341ca0eca6efb76ac455ec021617781487; expires=Fri, 07-May-21 07:44:47 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax
CF-Ray: 63c1a1fbccb3a255-ICN
Cache-Control: private, max-age=0
Expires: Wed, 07 Apr 2021 07:44:48 GMT
Vary: Accept-Encoding
CF-Cache-Status: EXPIRED
Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 094ce391580000a2557e8cb000000001
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
X-GUploader-UploadID: ABg5-Uz8O-yj-RfLqoUgT3WJWfoQlj2xFhYejuWTcStcEtknFtY8S5Ur-KTcxNGULak4fi56zOKO2x_xb5Yx1rkbERL1gHuKlg
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=LS9%2FXolnZJc0HvLu99dAhnLXHOjFMBUF4imJcvUYZILwkPZhsWciJSmEUMOPN6YXUhFEOSdmyZmzVteREYFmM0nlQhWQNwUu868ml1pY3hwADqI%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"max_age":604800,"report_to":"cf-nel"}
Server: cloudflare
GET
403
https://cdn.discordapp.com/attachments/826416818390040589/826855866228670474/7525b875715555.exe
REQUEST
RESPONSE
BODY
GET /attachments/826416818390040589/826855866228670474/7525b875715555.exe HTTP/1.1
Host: cdn.discordapp.com
Connection: Keep-Alive
HTTP/1.1 403 Forbidden
Date: Wed, 07 Apr 2021 07:44:48 GMT
Content-Type: application/xml; charset=UTF-8
Content-Length: 223
Connection: keep-alive
Set-Cookie: __cfduid=d04be8c1ec838af1a8e075ee6023635e31617781488; expires=Fri, 07-May-21 07:44:48 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax
CF-Ray: 63c1a1fddcc10b9b-NRT
Cache-Control: private, max-age=0
Expires: Wed, 07 Apr 2021 07:44:48 GMT
Vary: Accept-Encoding
CF-Cache-Status: EXPIRED
Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 094ce392ab00000b9bbfa33000000001
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
X-GUploader-UploadID: ABg5-UwfJzLSk0zR3f3PKDTF7CENWOv3fJxsd8_qZ2u5l37a-tgs3vNZVIcRcg3b-fyqAVW17B1_87Cb4xfIsBV6wOg6SunVNw
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=CfF2jm0KMJQOMYbsOk5IT322vDkN6TEdyqj57ZlPTUsDLgNPcPwYEO7ObnZFNf%2B%2Fkh%2BjiX0dPnzjI3w2pUKFfg%2BqqptnO4qPBhzc6HTNkY%2F7qxw%3D"}]}
NEL: {"max_age":604800,"report_to":"cf-nel"}
Server: cloudflare
GET
404
https://gwenetha.info/setup-KGQJ-1.exe
REQUEST
RESPONSE
BODY
GET /setup-KGQJ-1.exe HTTP/1.1
Host: gwenetha.info
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 07 Apr 2021 07:44:49 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 19
Connection: keep-alive
Set-Cookie: __cfduid=d6d0fb87564e954ed960a8d4d8f360b4e1617781488; expires=Fri, 07-May-21 07:44:48 GMT; path=/; domain=.gwenetha.info; HttpOnly; SameSite=Lax
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
cf-request-id: 094ce3945500000564b2038000000001
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=DjrKCiDbjMm1P0tQ50J8%2FDhv60Yrod5rRXy5q8nsa9pMy49Phl%2FAturvD8tdkJo%2FTxuGliIRCX%2BXRony8TY%2FYeaj8UCXQO1a55s1bfsi"}],"max_age":604800,"group":"cf-nel"}
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 63c1a2008cc00564-LAX
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET
301
https://iplogger.org/2LehR6.exe
REQUEST
RESPONSE
BODY
GET /2LehR6.exe HTTP/1.1
Host: iplogger.org
Connection: Keep-Alive
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Wed, 07 Apr 2021 07:44:56 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=6d52rg4m6rsei9eivcgtom05h5; path=/; HttpOnly
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
Set-Cookie: clhf03028ja=175.208.134.150; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=261266695; path=/
Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
Location: https://cdn.discordapp.com/attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe
Strict-Transport-Security: max-age=31536000; preload
X-Frame-Options: DENY
GET
200
https://cdn.discordapp.com/attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe
REQUEST
RESPONSE
BODY
GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1
Host: cdn.discordapp.com
HTTP/1.1 200 OK
Date: Wed, 07 Apr 2021 07:45:02 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d2e2b008ed4750cc5980f659662318ec51617781502; expires=Fri, 07-May-21 07:45:02 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax
X-Frame-Options: SAMEORIGIN
cf-request-id: 094ce3c89b00000158e320a000000001
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=m%2FZhNa5hrjli5QAoG5LcG4ficTAf9rfxwVRTn4Skmhal%2B9uFHEUUgz6nuwz%2F%2FL7LhNhfyS6TjVia5hw6RK1hBAIcY6JEDTPUs1BK%2BHZm0G%2F1RUE%3D"}],"max_age":604800}
NEL: {"max_age":604800,"report_to":"cf-nel"}
Server: cloudflare
CF-RAY: 63c1a2542d2b0158-ICN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET
403
https://cdn.discordapp.com/attachments/826416818390040589/826469949593485312/file.exe
REQUEST
RESPONSE
BODY
GET /attachments/826416818390040589/826469949593485312/file.exe HTTP/1.1
Host: cdn.discordapp.com
HTTP/1.1 403 Forbidden
Date: Wed, 07 Apr 2021 07:45:02 GMT
Content-Type: application/xml; charset=UTF-8
Content-Length: 223
Connection: keep-alive
Set-Cookie: __cfduid=d7107257c94fec7742564bdba819903491617781502; expires=Fri, 07-May-21 07:45:02 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax
CF-Ray: 63c1a254fbaa060b-ICN
Cache-Control: private, max-age=0
Expires: Wed, 07 Apr 2021 07:45:02 GMT
Vary: Accept-Encoding
CF-Cache-Status: EXPIRED
Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 094ce3c91b0000060b33b42000000001
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
X-GUploader-UploadID: ABg5-UyboCYyrxuxJs_oHndEW1I7V2g-4r8Eii9mF4Lq9APH1qiMjz6HEZ5a4JZD9O_dcts1vU3sz8abHXyLWhOqF4y1g_c9nw
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=3zHjmTBi6iaZEz%2ByplgA6rO4eV28XVic%2BTNfAkMPPruU7CaNpuMNA67vXD9p0A74oIH4IVfcItxLA3gwrYdKTBmiD%2FAf479ZkCIk%2BElgdw590Bc%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"max_age":604800,"report_to":"cf-nel"}
Server: cloudflare
GET
200
https://cdn.discordapp.com/attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe
REQUEST
RESPONSE
BODY
GET /attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe HTTP/1.1
Host: cdn.discordapp.com
HTTP/1.1 200 OK
Date: Wed, 07 Apr 2021 07:45:04 GMT
Content-Type: application/x-msdos-program
Content-Length: 505856
Connection: keep-alive
Set-Cookie: __cfduid=daac32ff1284fde76d718a2b3695c1fee1617781504; expires=Fri, 07-May-21 07:45:04 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax
CF-Ray: 63c1a2656c820158-ICN
Accept-Ranges: bytes
Age: 636513
Cache-Control: public, max-age=31536000
Content-Disposition: attachment;%20filename=7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe
ETag: "28345a7bb63babaf99e760965ce493b7"
Expires: Thu, 07 Apr 2022 07:45:04 GMT
Last-Modified: Tue, 30 Mar 2021 19:35:01 GMT
Vary: Accept-Encoding
CF-Cache-Status: HIT
Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 094ce3d35d0000015805bb1000000001
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-goog-generation: 1617132901889175
x-goog-hash: crc32c=Ws/4nQ==
x-goog-hash: md5=KDRae7Y7q6+Z52CWXOSTtw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 505856
X-GUploader-UploadID: ABg5-UznZNO55X93AubXlWYP0c5SyYOTRHkzDJhcIzrcH58RoyWaPDs0j0jqBmhsS-QvB5VHDoqPplp1xtV5hwkr0kW8h3tVvw
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=O6DOo4TuOu%2Fy7CY1OOoBjgQjfvccdPRUA2q19mkYbKhNpNRIkDLWdAKylbx%2Bw8xeoFp5LSlKbe4C6yFJRHXqe6zyZ3%2BxbiWPhI4jVIik110g0Ro%3D"}],"max_age":604800}
NEL: {"max_age":604800,"report_to":"cf-nel"}
Server: cloudflare
GET
200
https://cdn.discordapp.com/attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe
REQUEST
RESPONSE
BODY
GET /attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe HTTP/1.1
Host: cdn.discordapp.com
HTTP/1.1 200 OK
Date: Wed, 07 Apr 2021 07:45:09 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d93167edb39e0928d45a5ddc52081564c1617781509; expires=Fri, 07-May-21 07:45:09 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax
X-Frame-Options: SAMEORIGIN
cf-request-id: 094ce3e41b0000ef92eab75000000001
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=frOXTXStSbo%2BKr9HSM6hMnRUrpKioDkpG5nO%2FLMLc8v6wfrDB9phg5OAAGOJEfuOuHo3vegztSmi4d7DcLeB2yCQCnbfIjKlbv1iBgLcP%2Bo%2B%2B1Y%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 63c1a2802f23ef92-NRT
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
ICMP traffic
Source | Destination | ICMP Type | Data |
---|---|---|---|
192.168.56.101 | 164.124.101.2 | 3 |
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts