Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.856379977.xyz | 103.88.34.80 | |
| www.amercon.net |
CNAME
amercon.net
|
199.250.194.209 |
| www.tc1k.com | ||
| www.0713sun.com | 96.45.164.246 |
- UDP Requests
-
-
192.168.56.102:50839 164.124.101.2:53
-
192.168.56.102:54221 164.124.101.2:53
-
192.168.56.102:54660 164.124.101.2:53
-
192.168.56.102:57660 164.124.101.2:53
-
192.168.56.102:61459 164.124.101.2:53
-
192.168.56.102:61998 164.124.101.2:53
-
192.168.56.102:137 192.168.56.255:137
-
192.168.56.102:138 192.168.56.255:138
-
192.168.56.102:49152 239.255.255.250:3702
-
192.168.56.102:56752 239.255.255.250:1900
-
192.168.56.102:56754 239.255.255.250:3702
-
192.168.56.102:56756 239.255.255.250:3702
-
192.168.56.102:56758 239.255.255.250:3702
-
8.8.8.8:53 192.168.56.102:50839
-
8.8.8.8:53 192.168.56.102:61459
-
POST
0
http://www.0713sun.com/e2ci/
REQUEST
RESPONSE
BODY
POST /e2ci/ HTTP/1.1
Host: www.0713sun.com
Connection: close
Content-Length: 218
Cache-Control: no-cache
Origin: http://www.0713sun.com
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.0713sun.com/e2ci/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
GET
404
http://www.0713sun.com/e2ci/?TVg84P=zjR8DXapILM&q48HnNuH=mjXgAoGc9RiEdal923fYMsjwHVXgKiM9DTzs5kYNCd4TPCHNxR/c2ZF+kFqQgDCsM/ynEOPN
REQUEST
RESPONSE
BODY
GET /e2ci/?TVg84P=zjR8DXapILM&q48HnNuH=mjXgAoGc9RiEdal923fYMsjwHVXgKiM9DTzs5kYNCd4TPCHNxR/c2ZF+kFqQgDCsM/ynEOPN HTTP/1.1
Host: www.0713sun.com
Connection: close
HTTP/1.1 404 Not Found
Server: nginx
Date: Thu, 20 May 2021 00:45:14 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Vary: Accept-Encoding
POST
404
http://www.amercon.net/e2ci/
REQUEST
RESPONSE
BODY
POST /e2ci/ HTTP/1.1
Host: www.amercon.net
Connection: close
Content-Length: 218
Cache-Control: no-cache
Origin: http://www.amercon.net
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.amercon.net/e2ci/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
HTTP/1.1 404 Not Found
Date: Thu, 20 May 2021 00:57:58 GMT
Server: Apache
Content-Length: 236
Connection: close
Content-Type: text/html; charset=iso-8859-1
GET
404
http://www.amercon.net/e2ci/?TVg84P=zjR8DXapILM&q48HnNuH=JcnlCjkOOIBiQ/xfxAOFe67syMYooRlDgk8yaYfeSo2+mC+bu0GwiVI+/NZtw6qc0De33r3H
REQUEST
RESPONSE
BODY
GET /e2ci/?TVg84P=zjR8DXapILM&q48HnNuH=JcnlCjkOOIBiQ/xfxAOFe67syMYooRlDgk8yaYfeSo2+mC+bu0GwiVI+/NZtw6qc0De33r3H HTTP/1.1
Host: www.amercon.net
Connection: close
HTTP/1.1 404 Not Found
Date: Thu, 20 May 2021 00:57:58 GMT
Server: Apache
Content-Length: 236
Connection: close
Content-Type: text/html; charset=iso-8859-1
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49817 -> 199.250.194.209:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.102:49817 -> 199.250.194.209:80 | 2031449 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.102:49817 -> 199.250.194.209:80 | 2031453 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.102:49815 -> 96.45.164.246:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.102:49815 -> 96.45.164.246:80 | 2031449 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.102:49815 -> 96.45.164.246:80 | 2031453 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts