Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| cryptersandtools.minhacasa.tv | 177.106.216.53 |
GET
200
http://cryptersandtools.minhacasa.tv/e/e
REQUEST
RESPONSE
BODY
GET /e/e HTTP/1.1
Host: cryptersandtools.minhacasa.tv
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 07 Jul 2023 00:19:44 GMT
Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28
Last-Modified: Tue, 04 Jul 2023 21:37:29 GMT
ETag: "42ac-5ffb01710c014"
Accept-Ranges: bytes
Content-Length: 17068
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
GET
200
http://79.110.49.55/aby.txt
REQUEST
RESPONSE
BODY
GET /aby.txt HTTP/1.1
Host: 79.110.49.55
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Sun, 02 Jul 2023 19:02:30 GMT
Accept-Ranges: bytes
ETag: "d25285c017add91:0"
Server: Microsoft-IIS/8.5
Date: Fri, 07 Jul 2023 00:19:45 GMT
Content-Length: 223916
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 79.110.49.55:80 -> 192.168.56.101:49166 | 2020425 | ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1 | Exploit Kit Activity Detected |
| TCP 177.106.216.53:80 -> 192.168.56.101:49165 | 2029538 | ET HUNTING EXE Base64 Encoded potential malware | Misc activity |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts