Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| cryptersandtools.minhacasa.tv | 186.210.128.242 |
GET
200
http://cryptersandtools.minhacasa.tv/e/e
REQUEST
RESPONSE
BODY
GET /e/e HTTP/1.1
Host: cryptersandtools.minhacasa.tv
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 05 Jul 2023 01:13:54 GMT
Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28
Last-Modified: Tue, 04 Jul 2023 21:37:29 GMT
ETag: "42ac-5ffb01710c014"
Accept-Ranges: bytes
Content-Length: 17068
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
GET
200
http://79.110.49.55/mynes.txt
REQUEST
RESPONSE
BODY
GET /mynes.txt HTTP/1.1
Host: 79.110.49.55
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Tue, 13 Jun 2023 17:43:49 GMT
Accept-Ranges: bytes
ETag: "dbff469c1e9ed91:0"
Server: Microsoft-IIS/8.5
Date: Wed, 05 Jul 2023 01:13:53 GMT
Content-Length: 223916
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 79.110.49.55:80 -> 192.168.56.101:49166 | 2020424 | ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1 | Exploit Kit Activity Detected |
| TCP 186.210.128.242:80 -> 192.168.56.101:49165 | 2029538 | ET HUNTING EXE Base64 Encoded potential malware | Misc activity |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts