Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.ngmnetwork.com | 65.254.250.192 | |
| www.appsrocky.top | ||
| www.jonathanvuportfolio.website | 76.76.21.123 |
GET
401
http://www.ngmnetwork.com/o5gu/?nRntHD=nt54C05KUkIvbOhXcmX2JQxj1c8TC2AD0f5qM8oIBe83LqreralmCs6eOllIegrlb6Ji0dmb&Lh38w=ATUDS8l
REQUEST
RESPONSE
BODY
GET /o5gu/?nRntHD=nt54C05KUkIvbOhXcmX2JQxj1c8TC2AD0f5qM8oIBe83LqreralmCs6eOllIegrlb6Ji0dmb&Lh38w=ATUDS8l HTTP/1.1
Host: www.ngmnetwork.com
Connection: close
HTTP/1.1 401 Unauthorized
Date: Tue, 17 Oct 2023 07:40:25 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 381
Connection: close
Server: Apache/2
WWW-Authenticate: Basic realm="Password Protected"
Age: 0
GET
308
http://www.jonathanvuportfolio.website/o5gu/?nRntHD=s49Z/zB4WxMPm1wKIpwtofnGUZAAmhHqcm3eZ7CT59XMMjyacZTQ4OMMqMGT9RUeDBDjK0yu&Lh38w=ATUDS8l
REQUEST
RESPONSE
BODY
GET /o5gu/?nRntHD=s49Z/zB4WxMPm1wKIpwtofnGUZAAmhHqcm3eZ7CT59XMMjyacZTQ4OMMqMGT9RUeDBDjK0yu&Lh38w=ATUDS8l HTTP/1.1
Host: www.jonathanvuportfolio.website
Connection: close
HTTP/1.0 308 Permanent Redirect
Content-Type: text/plain
Location: https://www.jonathanvuportfolio.website/o5gu/?nRntHD=s49Z/zB4WxMPm1wKIpwtofnGUZAAmhHqcm3eZ7CT59XMMjyacZTQ4OMMqMGT9RUeDBDjK0yu&Lh38w=ATUDS8l
Refresh
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| UDP 192.168.56.103:50800 -> 164.124.101.2:53 | 2023883 | ET DNS Query to a *.top domain - Likely Hostile | Potentially Bad Traffic |
| TCP 192.168.56.103:49166 -> 65.254.250.192:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.103:49168 -> 76.76.21.241:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts