Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| xmr-eu1.nanopool.org | 51.68.143.81 | |
| iplogger.com | 148.251.234.93 | |
| pastebin.com | 104.20.68.143 |
- TCP Requests
-
-
192.168.56.103:49206 104.20.67.143:443pastebin.com
-
192.168.56.103:49175 148.251.234.93:443iplogger.com
-
192.168.56.103:49180 148.251.234.93:443iplogger.com
-
192.168.56.103:49182 148.251.234.93:443iplogger.com
-
192.168.56.103:49183 148.251.234.93:443iplogger.com
-
192.168.56.103:49184 148.251.234.93:443iplogger.com
-
192.168.56.103:49186 148.251.234.93:443iplogger.com
-
192.168.56.103:49190 148.251.234.93:443iplogger.com
-
192.168.56.103:49197 148.251.234.93:443iplogger.com
-
192.168.56.103:49202 148.251.234.93:443iplogger.com
-
192.168.56.103:49204 148.251.234.93:443iplogger.com
-
192.168.56.103:49207 148.251.234.93:443iplogger.com
-
192.168.56.103:49209 148.251.234.93:443iplogger.com
-
192.168.56.103:49210 148.251.234.93:443iplogger.com
-
192.168.56.103:49211 148.251.234.93:443iplogger.com
-
192.168.56.103:49212 148.251.234.93:443iplogger.com
-
192.168.56.103:49213 148.251.234.93:443iplogger.com
-
192.168.56.103:49214 148.251.234.93:443iplogger.com
-
192.168.56.103:49215 148.251.234.93:443iplogger.com
-
192.168.56.103:49216 148.251.234.93:443iplogger.com
-
192.168.56.103:49205 163.172.154.142:14433xmr-eu1.nanopool.org
-
192.168.56.103:49208 212.47.253.124:14433xmr-eu1.nanopool.org
-
192.168.56.103:49185 5.42.65.39:80
-
POST
200
http://5.42.65.39/bed95ea4798a5204.php
REQUEST
RESPONSE
BODY
POST /bed95ea4798a5204.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----BKECFIIEHCFHIECAFBAK
Host: 5.42.65.39
Content-Length: 200
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Oct 2023 03:36:29 GMT
Server: Apache/2.4.52 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 1792
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://5.42.65.39/bed95ea4798a5204.php
REQUEST
RESPONSE
BODY
POST /bed95ea4798a5204.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----JKJECBAAAFHIIEBFCBKF
Host: 5.42.65.39
Content-Length: 199
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Oct 2023 03:36:29 GMT
Server: Apache/2.4.52 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 5056
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://5.42.65.39/bed95ea4798a5204.php
REQUEST
RESPONSE
BODY
POST /bed95ea4798a5204.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----CGDHDHJEBGHJKFIECBGC
Host: 5.42.65.39
Content-Length: 4463
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Oct 2023 03:36:30 GMT
Server: Apache/2.4.52 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
GET
200
http://5.42.65.39/a03c8956ff198333/sqlite3.dll
REQUEST
RESPONSE
BODY
GET /a03c8956ff198333/sqlite3.dll HTTP/1.1
Host: 5.42.65.39
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Oct 2023 03:36:30 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT
ETag: "10e436-5e7ec6832a180"
Accept-Ranges: bytes
Content-Length: 1106998
Content-Type: application/x-msdos-program
GET
200
http://5.42.65.39/a03c8956ff198333/freebl3.dll
REQUEST
RESPONSE
BODY
GET /a03c8956ff198333/freebl3.dll HTTP/1.1
Host: 5.42.65.39
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Oct 2023 03:36:36 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
ETag: "a7550-5e7e950876500"
Accept-Ranges: bytes
Content-Length: 685392
Content-Type: application/x-msdos-program
GET
200
http://5.42.65.39/a03c8956ff198333/mozglue.dll
REQUEST
RESPONSE
BODY
GET /a03c8956ff198333/mozglue.dll HTTP/1.1
Host: 5.42.65.39
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Oct 2023 03:36:37 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
ETag: "94750-5e7e950876500"
Accept-Ranges: bytes
Content-Length: 608080
Content-Type: application/x-msdos-program
GET
200
http://5.42.65.39/a03c8956ff198333/msvcp140.dll
REQUEST
RESPONSE
BODY
GET /a03c8956ff198333/msvcp140.dll HTTP/1.1
Host: 5.42.65.39
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Oct 2023 03:36:38 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
ETag: "6dde8-5e7e950876500"
Accept-Ranges: bytes
Content-Length: 450024
Content-Type: application/x-msdos-program
GET
200
http://5.42.65.39/a03c8956ff198333/nss3.dll
REQUEST
RESPONSE
BODY
GET /a03c8956ff198333/nss3.dll HTTP/1.1
Host: 5.42.65.39
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Oct 2023 03:36:39 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
ETag: "1f3950-5e7e950876500"
Accept-Ranges: bytes
Content-Length: 2046288
Content-Type: application/x-msdos-program
GET
200
http://5.42.65.39/a03c8956ff198333/softokn3.dll
REQUEST
RESPONSE
BODY
GET /a03c8956ff198333/softokn3.dll HTTP/1.1
Host: 5.42.65.39
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Oct 2023 03:36:41 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
ETag: "3ef50-5e7e950876500"
Accept-Ranges: bytes
Content-Length: 257872
Content-Type: application/x-msdos-program
GET
200
http://5.42.65.39/a03c8956ff198333/vcruntime140.dll
REQUEST
RESPONSE
BODY
GET /a03c8956ff198333/vcruntime140.dll HTTP/1.1
Host: 5.42.65.39
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Oct 2023 03:36:42 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
ETag: "13bf0-5e7e950876500"
Accept-Ranges: bytes
Content-Length: 80880
Content-Type: application/x-msdos-program
POST
200
http://5.42.65.39/bed95ea4798a5204.php
REQUEST
RESPONSE
BODY
POST /bed95ea4798a5204.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----KEGCFCAKFHCGCBFHCGHD
Host: 5.42.65.39
Content-Length: 875
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Oct 2023 03:36:42 GMT
Server: Apache/2.4.52 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=90
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://5.42.65.39/bed95ea4798a5204.php
REQUEST
RESPONSE
BODY
POST /bed95ea4798a5204.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAK
Host: 5.42.65.39
Content-Length: 811
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Oct 2023 03:36:42 GMT
Server: Apache/2.4.52 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=89
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://5.42.65.39/bed95ea4798a5204.php
REQUEST
RESPONSE
BODY
POST /bed95ea4798a5204.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----GDGHJEHJJDAAAKEBGCFC
Host: 5.42.65.39
Content-Length: 595
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Oct 2023 03:36:43 GMT
Server: Apache/2.4.52 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=88
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://5.42.65.39/bed95ea4798a5204.php
REQUEST
RESPONSE
BODY
POST /bed95ea4798a5204.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----FBFCFIEBKEGHIDGCAFBF
Host: 5.42.65.39
Content-Length: 113
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Oct 2023 03:36:43 GMT
Server: Apache/2.4.52 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 263
Keep-Alive: timeout=5, max=87
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://5.42.65.39/bed95ea4798a5204.php
REQUEST
RESPONSE
BODY
POST /bed95ea4798a5204.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----FIIIIDGHJEBFBGDHDGII
Host: 5.42.65.39
Content-Length: 199
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Oct 2023 03:36:43 GMT
Server: Apache/2.4.52 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 1596
Keep-Alive: timeout=5, max=86
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://5.42.65.39/bed95ea4798a5204.php
REQUEST
RESPONSE
BODY
POST /bed95ea4798a5204.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----IJKFIIIJJKJJKEBGIDGC
Host: 5.42.65.39
Content-Length: 197
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Oct 2023 03:36:44 GMT
Server: Apache/2.4.52 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=85
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
POST
200
http://5.42.65.39/bed95ea4798a5204.php
REQUEST
RESPONSE
BODY
POST /bed95ea4798a5204.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----GIJEGDAKEHJECAKEGDHJ
Host: 5.42.65.39
Content-Length: 192
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 09 Oct 2023 03:36:44 GMT
Server: Apache/2.4.52 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=84
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLS 1.3 192.168.56.103:49208 212.47.253.124:14433 |
None | None | None |
|
TLS 1.3 192.168.56.103:49206 104.20.67.143:443 |
None | None | None |
|
TLS 1.3 192.168.56.103:49205 163.172.154.142:14433 |
None | None | None |
Snort Alerts
No Snort Alerts