Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| laoqianppp.com | 156.251.17.97 |
GET
200
http://laoqianppp.com/97.bin
REQUEST
RESPONSE
BODY
GET /97.bin HTTP/1.1
User-Agent:
Host: laoqianppp.com
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 2802
Accept-Ranges: bytes
Server: HFS 2.4.0 RC7
Set-Cookie: HFS_SID_=QamBRke5kAAAEDwxEzZPw; path=/; HttpOnly
ETag: 5a94c8e56a2664c0bd9dae3b82567205
Last-Modified: Thu, 04 Jan 2024 02:33:41 GMT
Content-Disposition: attachment; filename*=UTF-8''97.bin; filename=97.bin
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49170 -> 156.251.17.97:8000 | 2260003 | SURICATA Applayer Protocol detection skipped | Generic Protocol Command Decode |
| TCP 192.168.56.101:49169 -> 156.251.17.97:80 | 2007994 | ET HUNTING Suspicious Empty User-Agent | Unknown Traffic |
| TCP 156.251.17.97:80 -> 192.168.56.101:49169 | 2045860 | ET HUNTING Rejetto HTTP File Sever Response | A Network Trojan was detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts