Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| pool.hashvault.pro | 142.202.242.43 | |
| pastebin.com | 172.67.34.170 | |
| xmr.2miners.com | 162.19.139.184 |
- UDP Requests
-
-
192.168.56.103:50800 164.124.101.2:53
-
192.168.56.103:52760 164.124.101.2:53
-
192.168.56.103:53673 164.124.101.2:53
-
192.168.56.103:62576 164.124.101.2:53
-
192.168.56.103:64894 164.124.101.2:53
-
192.168.56.103:137 192.168.56.101:137
-
192.168.56.103:137 192.168.56.255:137
-
192.168.56.103:138 192.168.56.255:138
-
52.231.114.183:123 192.168.56.103:123
-
POST
200
http://94.156.71.160/carsalepanel/api/endpoint.php
REQUEST
RESPONSE
BODY
POST /carsalepanel/api/endpoint.php HTTP/1.1
Accept: */*
Connection: close
Content-Length: 505
Content-Type: application/json
Host: 94.156.71.160
User-Agent: cpp-httplib/0.12.6
HTTP/1.1 200 OK
Date: Sat, 25 Nov 2023 09:05:45 GMT
Server: Apache/2.4.52 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 1238
Connection: close
Content-Type: text/html; charset=UTF-8
POST
200
http://94.156.71.160/carsalepanel/api/endpoint.php
REQUEST
RESPONSE
BODY
POST /carsalepanel/api/endpoint.php HTTP/1.1
Accept: */*
Connection: close
Content-Length: 507
Content-Type: application/json
Host: 94.156.71.160
User-Agent: cpp-httplib/0.12.6
HTTP/1.1 200 OK
Date: Sat, 25 Nov 2023 09:05:47 GMT
Server: Apache/2.4.52 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 1238
Connection: close
Content-Type: text/html; charset=UTF-8
POST
200
http://94.156.71.160/carsalepanel/api/endpoint.php
REQUEST
RESPONSE
BODY
POST /carsalepanel/api/endpoint.php HTTP/1.1
Accept: */*
Connection: close
Content-Length: 530
Content-Type: application/json
Host: 94.156.71.160
User-Agent: cpp-httplib/0.12.6
HTTP/1.1 200 OK
Date: Sat, 25 Nov 2023 09:06:47 GMT
Server: Apache/2.4.52 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 1238
Connection: close
Content-Type: text/html; charset=UTF-8
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| UDP 192.168.56.103:64894 -> 164.124.101.2:53 | 2040353 | ET COINMINER Observed DNS Query to Cryptocurrency Mining Pool Domain (xmr .2miners .com) | Crypto Currency Mining Activity Detected |
| TCP 94.156.71.160:80 -> 192.168.56.103:49180 | 2403392 | ET CINS Active Threat Intelligence Poor Reputation IP group 93 | Misc Attack |
| TCP 192.168.56.103:49170 -> 172.67.34.170:443 | 906200068 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (CoinMiner) | undefined |
| UDP 192.168.56.103:62576 -> 164.124.101.2:53 | 2036289 | ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) | Crypto Currency Mining Activity Detected |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLS 1.3 192.168.56.103:49170 172.67.34.170:443 |
None | None | None |
|
TLS 1.3 192.168.56.103:49169 162.19.139.184:12222 |
None | None | None |
|
TLS 1.3 192.168.56.103:49173 131.153.76.130:80 |
None | None | None |
Snort Alerts
No Snort Alerts