Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| wsvdyhrgebwhevawe.ydns.eu | 81.161.229.9 | |
| tornado.ydns.eu | 193.42.32.61 | |
| orifak.ydns.eu | 193.42.32.61 |
GET
200
http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/Fnvtdhenaps
REQUEST
RESPONSE
BODY
GET /goofeeewsvd/Fnvtdhenaps HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Host: wsvdyhrgebwhevawe.ydns.eu
HTTP/1.1 200 OK
etag: "f1cf4-64f6c9f5-17cb2e;;;"
last-modified: Tue, 05 Sep 2023 06:25:57 GMT
content-length: 990452
accept-ranges: bytes
date: Tue, 05 Sep 2023 22:39:45 GMT
server: LiteSpeed
connection: Keep-Alive
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.103:49166 -> 193.42.32.61:1972 | 2036594 | ET JA3 Hash - Remcos 3.x TLS Connection | Malware Command and Control Activity Detected |
| TCP 192.168.56.103:49165 -> 193.42.32.61:1972 | 2036594 | ET JA3 Hash - Remcos 3.x TLS Connection | Malware Command and Control Activity Detected |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLS 1.3 192.168.56.103:49166 193.42.32.61:1972 |
None | None | None |
|
TLS 1.3 192.168.56.103:49165 193.42.32.61:1972 |
None | None | None |
Snort Alerts
No Snort Alerts