Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.eepemvv.icu | 47.91.170.222 | |
| www.sewingfabulous.com | 157.230.123.243 |
GET
301
http://www.sewingfabulous.com/bckt/?Sj=7Ik8ChWSL5VzEe3a04+36/SJu8hLtPZoZ31vezVf5nypdk71mafxck6NJodjqBPI4m/Qid3L&RX=dnC4O0dPddHd4N7
REQUEST
RESPONSE
BODY
GET /bckt/?Sj=7Ik8ChWSL5VzEe3a04+36/SJu8hLtPZoZ31vezVf5nypdk71mafxck6NJodjqBPI4m/Qid3L&RX=dnC4O0dPddHd4N7 HTTP/1.1
Host: www.sewingfabulous.com
Connection: close
HTTP/1.1 301 Moved Permanently
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 08 Sep 2021 01:06:37 GMT
Content-Type: text/html
Content-Length: 178
Connection: close
Location: https://www.sewingfabulous.com/bckt/?Sj=7Ik8ChWSL5VzEe3a04+36/SJu8hLtPZoZ31vezVf5nypdk71mafxck6NJodjqBPI4m/Qid3L&RX=dnC4O0dPddHd4N7
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| UDP 192.168.56.102:52336 -> 164.124.101.2:53 | 2026888 | ET INFO DNS Query for Suspicious .icu Domain | Potentially Bad Traffic |
| TCP 192.168.56.102:49167 -> 157.230.123.243:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.102:49167 -> 157.230.123.243:80 | 2031449 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.102:49167 -> 157.230.123.243:80 | 2031453 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts