Network Analysis
Name | Response | Post-Analysis Lookup |
---|---|---|
pastebin.com | 104.20.68.143 | |
pool.hashvault.pro | 125.253.92.50 | |
xmr.2miners.com | 162.19.139.184 |
POST
200
http://94.156.71.160/carsalepanel/api/endpoint.php
REQUEST
RESPONSE
BODY
POST /carsalepanel/api/endpoint.php HTTP/1.1
Accept: */*
Connection: close
Content-Length: 505
Content-Type: application/json
Host: 94.156.71.160
User-Agent: cpp-httplib/0.12.6
HTTP/1.1 200 OK
Date: Sun, 17 Dec 2023 22:51:58 GMT
Server: Apache/2.4.52 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 1238
Connection: close
Content-Type: text/html; charset=UTF-8
POST
200
http://94.156.71.160/carsalepanel/api/endpoint.php
REQUEST
RESPONSE
BODY
POST /carsalepanel/api/endpoint.php HTTP/1.1
Accept: */*
Connection: close
Content-Length: 528
Content-Type: application/json
Host: 94.156.71.160
User-Agent: cpp-httplib/0.12.6
HTTP/1.1 200 OK
Date: Sun, 17 Dec 2023 22:52:56 GMT
Server: Apache/2.4.52 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 1238
Connection: close
Content-Type: text/html; charset=UTF-8
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
UDP 192.168.56.101:53004 -> 164.124.101.2:53 | 2036289 | ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) | Crypto Currency Mining Activity Detected |
UDP 192.168.56.101:59002 -> 164.124.101.2:53 | 2040353 | ET COINMINER Observed DNS Query to Cryptocurrency Mining Pool Domain (xmr .2miners .com) | Crypto Currency Mining Activity Detected |
TCP 192.168.56.101:49169 -> 104.20.67.143:443 | 906200068 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (CoinMiner) | undefined |
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLS 1.3 192.168.56.101:49171 131.153.76.130:80 |
None | None | None |
TLS 1.3 192.168.56.101:49166 162.19.139.184:12222 |
None | None | None |
TLS 1.3 192.168.56.101:49169 104.20.67.143:443 |
None | None | None |
Snort Alerts
No Snort Alerts