Network Analysis
Name | Response | Post-Analysis Lookup |
---|---|---|
raw.githubusercontent.com | 185.199.108.133 | |
sanctam.net | ||
github.com | 15.164.81.167 |
GET
302
https://github.com/UnamSanctam/SilentETHMiner/raw/master/SilentETHMiner/Resources/ethminer.zip
REQUEST
RESPONSE
BODY
GET /UnamSanctam/SilentETHMiner/raw/master/SilentETHMiner/Resources/ethminer.zip HTTP/1.1
Host: github.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Server: GitHub.com
Date: Thu, 14 Oct 2021 08:27:20 GMT
Content-Type: text/html; charset=utf-8
Vary: X-PJAX, X-PJAX-Container, Accept-Encoding, Accept, X-Requested-With
permissions-policy: interest-cohort=()
Access-Control-Allow-Origin: https://render.githubusercontent.com https://viewscreen.githubusercontent.com
Location: https://raw.githubusercontent.com/UnamSanctam/SilentETHMiner/master/SilentETHMiner/Resources/ethminer.zip
Cache-Control: no-cache
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Referrer-Policy: no-referrer-when-downgrade
Expect-CT: max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.com collector.githubapp.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events translator.github.com wss://alive.github.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com online.visualstudio.com/api/v1/locations raw.githubusercontent.com github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src render.githubusercontent.com viewscreen.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com secured-user-images.githubusercontent.com/ *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
Content-Length: 171
X-GitHub-Request-Id: C00C:44FB:19DBB4:225DC8:6167E9E8
GET
200
https://raw.githubusercontent.com/UnamSanctam/SilentETHMiner/master/SilentETHMiner/Resources/ethminer.zip
REQUEST
RESPONSE
BODY
GET /UnamSanctam/SilentETHMiner/master/SilentETHMiner/Resources/ethminer.zip HTTP/1.1
Host: raw.githubusercontent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 1971900
Cache-Control: max-age=300
Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
Content-Type: application/zip
ETag: "5ee119a9b5e3823337ea58ba72c3114d59e9720a45d0b3788d4fc42c1f4cc1f0"
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-XSS-Protection: 1; mode=block
X-GitHub-Request-Id: 5E3E:6348:16F5D:23EF5:6167E9E9
Accept-Ranges: bytes
Date: Thu, 14 Oct 2021 08:27:21 GMT
Via: 1.1 varnish
X-Served-By: cache-icn1450042-ICN
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1634200041.030604,VS0,VE387
Vary: Authorization,Accept-Encoding,Origin
Access-Control-Allow-Origin: *
X-Fastly-Request-ID: 07445ccf79f2cf3cfd64f291074852efc51c1307
Expires: Thu, 14 Oct 2021 08:32:21 GMT
Source-Age: 0
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
TCP 192.168.56.102:49165 -> 185.199.109.133:443 | 906200022 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
TCP 192.168.56.102:49164 -> 52.78.231.108:443 | 906200022 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLS 1.2 192.168.56.102:49165 185.199.109.133:443 |
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA | C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=www.github.com | 70:94:de:dd:e6:c4:69:48:3a:92:70:a1:48:56:78:2d:18:64:e0:b7 |
TLS 1.2 192.168.56.102:49164 52.78.231.108:443 |
C=US, O=DigiCert, Inc., CN=DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1 | C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=github.com | 84:63:b3:a9:29:12:cc:fd:1d:31:47:05:98:9b:ec:13:99:37:d0:d7 |
Snort Alerts
No Snort Alerts