Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.freshfruits.online | 52.58.78.16 | |
| www.cycw168.com | 172.241.79.24 | |
| www.mantlepies.co.uk |
CNAME
mantlepies.co.uk
|
194.11.155.157 |
GET
301
http://www.mantlepies.co.uk/ne28/?t8o8szU=qqm+J93IvUzIpsvlcDCofCpDZ1e3GW2Uvp+4wrKJhnvgzBwSBunnLsrelTMknHiM20FMLgvx&kPj0q=K4kP
REQUEST
RESPONSE
BODY
GET /ne28/?t8o8szU=qqm+J93IvUzIpsvlcDCofCpDZ1e3GW2Uvp+4wrKJhnvgzBwSBunnLsrelTMknHiM20FMLgvx&kPj0q=K4kP HTTP/1.1
Host: www.mantlepies.co.uk
Connection: close
HTTP/1.1 301 Moved Permanently
Connection: close
content-type: text/html
content-length: 707
date: Wed, 05 Apr 2023 08:33:53 GMT
server: LiteSpeed
location: https://www.mantlepies.co.uk/ne28/?t8o8szU=qqm+J93IvUzIpsvlcDCofCpDZ1e3GW2Uvp+4wrKJhnvgzBwSBunnLsrelTMknHiM20FMLgvx&kPj0q=K4kP
platform: hostinger
content-security-policy: upgrade-insecure-requests
GET
410
http://www.freshfruits.online/ne28/?t8o8szU=gE2koM16bc0rOnK/MBZG/f0y7whpdIhM0SAPAPR9GoMdZqV7E8zDPgnGgOZ4njeguJBhKBSc&kPj0q=K4kP
REQUEST
RESPONSE
BODY
GET /ne28/?t8o8szU=gE2koM16bc0rOnK/MBZG/f0y7whpdIhM0SAPAPR9GoMdZqV7E8zDPgnGgOZ4njeguJBhKBSc&kPj0q=K4kP HTTP/1.1
Host: www.freshfruits.online
Connection: close
HTTP/1.1 410 Gone
Server: openresty
Date: Wed, 05 Apr 2023 08:34:13 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49165 -> 194.11.155.157:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49165 -> 194.11.155.157:80 | 2031449 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49165 -> 194.11.155.157:80 | 2031453 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49170 -> 52.58.78.16:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49170 -> 52.58.78.16:80 | 2031449 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.101:49170 -> 52.58.78.16:80 | 2031453 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts