ee.txt| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6402 | May 25, 2021, 3:23 p.m. | May 25, 2021, 3:26 p.m. |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| warms.atwebpages.com | 185.176.43.98 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49814 -> 185.176.43.98:80 | 2030890 | ET HUNTING Suspicious HTTP POST to Free Web Host Atwebpages | Misc activity |
| TCP 192.168.56.102:49815 -> 185.176.43.98:80 | 2030890 | ET HUNTING Suspicious HTTP POST to Free Web Host Atwebpages | Misc activity |
Suricata TLS
No Suricata TLS
| suspicious_features | POST method with no referer header, POST method with no useragent header | suspicious_request | POST http://warms.atwebpages.com/rh/post.php | ||||||
| suspicious_features | GET method with no useragent header | suspicious_request | GET http://warms.atwebpages.com/rh/ee.down | ||||||
| suspicious_features | GET method with no useragent header | suspicious_request | GET http://warms.atwebpages.com/rh/del.php?filename=ee | ||||||
| request | POST http://warms.atwebpages.com/rh/post.php |
| request | GET http://warms.atwebpages.com/rh/ee.down |
| request | GET http://warms.atwebpages.com/rh/del.php?filename=ee |
| request | POST http://warms.atwebpages.com/rh/post.php |
| host | 172.217.25.14 | |||