Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| vh390.timeweb.ru | 92.53.96.4 | |
| cx55566.tmweb.ru | 92.53.96.4 |
- TCP Requests
-
-
192.168.56.103:49173 92.53.96.4:80cx55566.tmweb.ru
-
192.168.56.103:49174 92.53.96.4:443cx55566.tmweb.ru
-
192.168.56.103:49175 92.53.96.4:443cx55566.tmweb.ru
-
192.168.56.103:49178 92.53.96.4:80cx55566.tmweb.ru
-
192.168.56.103:49179 92.53.96.4:443cx55566.tmweb.ru
-
192.168.56.103:49180 92.53.96.4:443cx55566.tmweb.ru
-
- UDP Requests
-
-
192.168.56.103:53893 164.124.101.2:53
-
192.168.56.103:58465 164.124.101.2:53
-
192.168.56.103:137 192.168.56.255:137
-
192.168.56.103:138 192.168.56.255:138
-
192.168.56.103:49152 239.255.255.250:3702
-
192.168.56.103:49168 239.255.255.250:1900
-
192.168.56.103:49170 239.255.255.250:3702
-
192.168.56.103:49172 239.255.255.250:3702
-
192.168.56.103:53894 239.255.255.250:3702
-
GET
302
http://cx55566.tmweb.ru/farm_money.exe
REQUEST
RESPONSE
BODY
GET /farm_money.exe HTTP/1.1
Host: cx55566.tmweb.ru
Connection: Keep-Alive
HTTP/1.1 302 Moved Temporarily
Server: nginx/1.20.1
Date: Thu, 14 Oct 2021 09:17:29 GMT
Content-Type: text/html
Content-Length: 145
Connection: keep-alive
Location: https://vh390.timeweb.ru/blocked/?ref=cx55566.tmweb.ru
Expires: Sun, 14 Nov 2021 09:17:29 GMT
Cache-Control: max-age=2678400
GET
302
http://cx55566.tmweb.ru/monero-bandit.exe
REQUEST
RESPONSE
BODY
GET /monero-bandit.exe HTTP/1.1
Host: cx55566.tmweb.ru
Connection: Keep-Alive
HTTP/1.1 302 Moved Temporarily
Server: nginx/1.20.1
Date: Thu, 14 Oct 2021 09:17:32 GMT
Content-Type: text/html
Content-Length: 145
Connection: keep-alive
Location: https://vh390.timeweb.ru/blocked/?ref=cx55566.tmweb.ru
Expires: Sun, 14 Nov 2021 09:17:32 GMT
Cache-Control: max-age=2678400
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.103:49175 -> 92.53.96.4:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.103:49180 -> 92.53.96.4:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.103:49179 -> 92.53.96.4:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.103:49174 -> 92.53.96.4:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts