Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| cryptersandtools.minhacasa.tv | 177.106.216.53 |
- UDP Requests
-
-
192.168.56.103:50800 164.124.101.2:53
-
192.168.56.103:52760 164.124.101.2:53
-
192.168.56.103:64894 164.124.101.2:53
-
192.168.56.103:137 192.168.56.101:137
-
192.168.56.103:137 192.168.56.255:137
-
192.168.56.103:138 192.168.56.255:138
-
192.168.56.103:64897 239.255.255.250:1900
-
52.231.114.183:123 192.168.56.103:123
-
GET
200
http://cryptersandtools.minhacasa.tv/e/e
REQUEST
RESPONSE
BODY
GET /e/e HTTP/1.1
Host: cryptersandtools.minhacasa.tv
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 07 Jul 2023 00:21:33 GMT
Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28
Last-Modified: Tue, 04 Jul 2023 21:37:29 GMT
ETag: "42ac-5ffb01710c014"
Accept-Ranges: bytes
Content-Length: 17068
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
GET
200
http://79.110.49.55/mynes.txt
REQUEST
RESPONSE
BODY
GET /mynes.txt HTTP/1.1
Host: 79.110.49.55
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Tue, 13 Jun 2023 17:43:49 GMT
Accept-Ranges: bytes
ETag: "dbff469c1e9ed91:0"
Server: Microsoft-IIS/8.5
Date: Fri, 07 Jul 2023 00:21:34 GMT
Content-Length: 223916
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 79.110.49.55:80 -> 192.168.56.103:49168 | 2020424 | ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1 | Exploit Kit Activity Detected |
| TCP 177.106.216.53:80 -> 192.168.56.103:49167 | 2029538 | ET HUNTING EXE Base64 Encoded potential malware | Misc activity |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts