Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.robinsonuas.com | 34.199.107.45 | |
| www.blowuin.com |
CNAME
blowuin.com
|
184.168.131.241 |
| www.pokemonteambuilder.team |
CNAME
pokemonteambuilder.team
|
34.197.205.97 |
- UDP Requests
-
-
192.168.56.101:54056 164.124.101.2:53
-
192.168.56.101:59369 164.124.101.2:53
-
192.168.56.101:61479 164.124.101.2:53
-
192.168.56.101:62324 164.124.101.2:53
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:138 192.168.56.255:138
-
192.168.56.101:49152 239.255.255.250:3702
-
192.168.56.101:62327 239.255.255.250:1900
-
192.168.56.101:62329 239.255.255.250:3702
-
192.168.56.101:62331 239.255.255.250:3702
-
192.168.56.101:62333 239.255.255.250:3702
-
52.231.114.183:123 192.168.56.101:123
-
GET
200
http://www.robinsonuas.com/wlns/?Rfm=1/cHY6o3y2kTfnImlOu2zDDBy3QA1LzHHg6SRmwmJGbZFdy9dxCYPVknHFO77fV8z6zDjSzB&E6A=8pMxBp
REQUEST
RESPONSE
BODY
GET /wlns/?Rfm=1/cHY6o3y2kTfnImlOu2zDDBy3QA1LzHHg6SRmwmJGbZFdy9dxCYPVknHFO77fV8z6zDjSzB&E6A=8pMxBp HTTP/1.1
Host: www.robinsonuas.com
Connection: close
HTTP/1.1 200 OK
Date: Thu, 24 Jun 2021 11:36:34 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
GET
302
http://www.blowuin.com/wlns/?Rfm=kqh7r8ylgS3zHL1GIAw/iISI3Ruz0mzNrNj/DvCk+DiaPMdHZWMr1tcS75k91vx/gv/9MhU8&E6A=8pMxBp
REQUEST
RESPONSE
BODY
GET /wlns/?Rfm=kqh7r8ylgS3zHL1GIAw/iISI3Ruz0mzNrNj/DvCk+DiaPMdHZWMr1tcS75k91vx/gv/9MhU8&E6A=8pMxBp HTTP/1.1
Host: www.blowuin.com
Connection: close
HTTP/1.1 302 Found
Server: nginx/1.16.1
Date: Thu, 24 Jun 2021 11:36:54 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
Location: https://afternic.com/forsale/blowuin.com?utm_source=TDFS&utm_medium=sn_affiliate_click&utm_campaign=TDFS_GoDaddy_DLS&traffic_type=TDFS&traffic_id=GoDaddy_DLS
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49203 -> 18.205.135.125:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49203 -> 18.205.135.125:80 | 2031449 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49203 -> 18.205.135.125:80 | 2031453 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49204 -> 184.168.131.241:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49204 -> 184.168.131.241:80 | 2031449 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49204 -> 184.168.131.241:80 | 2031453 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts