Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.fxphones.com | 13.248.169.48 | |
| www.zqgf529.com | 172.67.176.126 | |
| www.tommybcarpentry.com |
CNAME
tommybcarpentry.com
|
34.102.136.180 |
GET
403
http://www.fxphones.com/ge83/?uTuD=dutfo2jPxvj1WOO8lT3X46PXeruLDGk4GIPLTA+1FdBceEacxR+vVx+tnRg7elNjWLO8USK4&Kj6ly=ATPddxOp02iTrlL0
REQUEST
RESPONSE
BODY
GET /ge83/?uTuD=dutfo2jPxvj1WOO8lT3X46PXeruLDGk4GIPLTA+1FdBceEacxR+vVx+tnRg7elNjWLO8USK4&Kj6ly=ATPddxOp02iTrlL0 HTTP/1.1
Host: www.fxphones.com
Connection: close
HTTP/1.1 403 Forbidden
Server: openresty
Date: Sun, 06 Aug 2023 23:55:38 GMT
Content-Type: text/html
Content-Length: 291
Connection: close
ETag: "64bae6bf-123"
GET
403
http://www.tommybcarpentry.com/ge83/?uTuD=4l1dgt6EqJfDtjFFl8HEiOm9OdrxJ3x3R23fkyRuAcDEYyPOkg50wBw+bbg4lJJkpPSBxSQs&Kj6ly=ATPddxOp02iTrlL0
REQUEST
RESPONSE
BODY
GET /ge83/?uTuD=4l1dgt6EqJfDtjFFl8HEiOm9OdrxJ3x3R23fkyRuAcDEYyPOkg50wBw+bbg4lJJkpPSBxSQs&Kj6ly=ATPddxOp02iTrlL0 HTTP/1.1
Host: www.tommybcarpentry.com
Connection: close
HTTP/1.1 403 Forbidden
Server: openresty
Date: Sun, 06 Aug 2023 23:55:58 GMT
Content-Type: text/html
Content-Length: 291
ETag: "64ce1fdc-123"
Via: 1.1 google
Connection: close
GET
520
http://www.zqgf529.com/ge83/?uTuD=xP2bwfOv2vpCt0xlFavLXdTEag9kTo/lay+lErW/aYJe6onvGjWkrhTcHwah5PuetW529ZI1&Kj6ly=ATPddxOp02iTrlL0
REQUEST
RESPONSE
BODY
GET /ge83/?uTuD=xP2bwfOv2vpCt0xlFavLXdTEag9kTo/lay+lErW/aYJe6onvGjWkrhTcHwah5PuetW529ZI1&Kj6ly=ATPddxOp02iTrlL0 HTTP/1.1
Host: www.zqgf529.com
Connection: close
HTTP/1.1 520
Date: Sun, 06 Aug 2023 23:56:19 GMT
Content-Length: 0
Connection: close
Cache-Control: no-store, no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C1UPPwFzFTSNmAKw4w8dzDBLcsoQhNY6K1ypBqG5%2BT7O3zRQNC3b%2BJfDaiwSuqmVVpASPjJ3vrFnemQdH0e8%2FzgU%2Fz29sd6zRHnfumaxxIoP7jugBiX6JpDudgOCFE18xHw%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7f2b373a7904836a-KIX
alt-svc: h3=":443"; ma=86400
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.103:49166 -> 34.102.136.180:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.103:49167 -> 104.21.31.119:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.103:49165 -> 76.223.54.146:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts