Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| www.eshopkhaliji.store | 158.176.194.183 | |
| www.caxars.store |
CNAME
caxars.store
|
91.184.0.200 |
| www.shopadamsstore.com |
CNAME
d051d6-2.myshopify.com
CNAME
shops.myshopify.com
|
23.227.38.74 |
| www.kampspacex.com |
- TCP Requests
-
-
192.168.56.103:49165 141.125.157.19:80www.eshopkhaliji.store
-
192.168.56.103:49166 141.125.157.19:80www.eshopkhaliji.store
-
192.168.56.103:49167 141.125.157.19:80www.eshopkhaliji.store
-
192.168.56.103:49171 23.227.38.74:80www.shopadamsstore.com
-
192.168.56.103:49172 23.227.38.74:80www.shopadamsstore.com
-
192.168.56.103:49173 23.227.38.74:80www.shopadamsstore.com
-
192.168.56.103:49168 91.184.0.200:80www.caxars.store
-
192.168.56.103:49169 91.184.0.200:80www.caxars.store
-
192.168.56.103:49170 91.184.0.200:80www.caxars.store
-
- UDP Requests
-
-
192.168.56.103:52760 164.124.101.2:53
-
192.168.56.103:137 192.168.56.101:137
-
192.168.56.103:137 192.168.56.255:137
-
192.168.56.103:138 192.168.56.255:138
-
192.168.56.103:49154 239.255.255.250:1900
-
8.8.8.8:53 192.168.56.103:50800
-
8.8.8.8:53 192.168.56.103:52760
-
8.8.8.8:53 192.168.56.103:53673
-
8.8.8.8:53 192.168.56.103:64894
-
GET
308
http://www.eshopkhaliji.store/muti/?8p=PenW7MtlXSrvxOPA1PJj8U2jUUvXlhwVh1FpwKQCNXiCStQ1MIBfQTqa3m2cpudHTvQpU++Q&4h=vTxdQD-PSRspeX7&sql=1
REQUEST
RESPONSE
BODY
GET /muti/?8p=PenW7MtlXSrvxOPA1PJj8U2jUUvXlhwVh1FpwKQCNXiCStQ1MIBfQTqa3m2cpudHTvQpU++Q&4h=vTxdQD-PSRspeX7&sql=1 HTTP/1.1
Host: www.eshopkhaliji.store
Connection: close
HTTP/1.1 308 Permanent Redirect
Date: Fri, 07 Jun 2024 00:35:01 GMT
Content-Type: application/octet-stream
Content-Length: 19
Connection: close
Location: https://www.eshopkhaliji.store/muti/?8p=PenW7MtlXSrvxOPA1PJj8U2jUUvXlhwVh1FpwKQCNXiCStQ1MIBfQTqa3m2cpudHTvQpU++Q&4h=vTxdQD-PSRspeX7&sql=1
Server: Youcan.Private.DC/2.0
x-powered-by: Youcan.Private.DC/2.0
POST
0
http://www.eshopkhaliji.store/muti/
REQUEST
RESPONSE
BODY
POST /muti/ HTTP/1.1
Host: www.eshopkhaliji.store
Connection: close
Content-Length: 3412
Cache-Control: no-cache
Origin: http://www.eshopkhaliji.store
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.eshopkhaliji.store/muti/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
POST
0
http://www.eshopkhaliji.store/muti/
REQUEST
RESPONSE
BODY
POST /muti/ HTTP/1.1
Host: www.eshopkhaliji.store
Connection: close
Content-Length: 158700
Cache-Control: no-cache
Origin: http://www.eshopkhaliji.store
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.eshopkhaliji.store/muti/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
GET
404
http://www.caxars.store/muti/?8p=vAkEv8VlD6HvoJ7OTZ3UyhPmsIwewVN5MI8wV+ea/g1itgmvOaYSZ0nMfK3GudfMXpkuz2fr&4h=vTxdQD-PSRspeX7&sql=1
REQUEST
RESPONSE
BODY
GET /muti/?8p=vAkEv8VlD6HvoJ7OTZ3UyhPmsIwewVN5MI8wV+ea/g1itgmvOaYSZ0nMfK3GudfMXpkuz2fr&4h=vTxdQD-PSRspeX7&sql=1 HTTP/1.1
Host: www.caxars.store
Connection: close
HTTP/1.1 404 Not Found
Date: Fri, 07 Jun 2024 00:35:21 GMT
Server: Apache
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Length: 196
Connection: close
Content-Type: text/html; charset=iso-8859-1
POST
404
http://www.caxars.store/muti/
REQUEST
RESPONSE
BODY
POST /muti/ HTTP/1.1
Host: www.caxars.store
Connection: close
Content-Length: 3412
Cache-Control: no-cache
Origin: http://www.caxars.store
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.caxars.store/muti/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
HTTP/1.1 404 Not Found
Date: Fri, 07 Jun 2024 00:35:23 GMT
Server: Apache
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Length: 196
Connection: close
Content-Type: text/html; charset=iso-8859-1
POST
404
http://www.caxars.store/muti/
REQUEST
RESPONSE
BODY
POST /muti/ HTTP/1.1
Host: www.caxars.store
Connection: close
Content-Length: 158700
Cache-Control: no-cache
Origin: http://www.caxars.store
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.caxars.store/muti/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
HTTP/1.1 404 Not Found
Date: Fri, 07 Jun 2024 00:35:23 GMT
Server: Apache
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Length: 196
Connection: close
Content-Type: text/html; charset=iso-8859-1
GET
403
http://www.shopadamsstore.com/muti/?8p=rUMPbDi9V+hLkBWFtVE1y7T4O5kE79Gi8Nwpb3xjlkSgEF4tpwDWlQ4hDt2c39K6jtdDQHz5&4h=vTxdQD-PSRspeX7&sql=1
REQUEST
RESPONSE
BODY
GET /muti/?8p=rUMPbDi9V+hLkBWFtVE1y7T4O5kE79Gi8Nwpb3xjlkSgEF4tpwDWlQ4hDt2c39K6jtdDQHz5&4h=vTxdQD-PSRspeX7&sql=1 HTTP/1.1
Host: www.shopadamsstore.com
Connection: close
HTTP/1.1 403 Forbidden
Date: Fri, 07 Jun 2024 00:35:42 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 4518
Connection: close
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: max-age=15
Expires: Fri, 07 Jun 2024 00:35:57 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wi88mXxUlNPN%2FtZE8jtKXDVzuVl678NbycKSpZOTlBKKOqd6vsuAnBRRF98SOd3AbLjsHoOcEJ8HzAyPPIGp1ktwleNjMI8ugDwYPJJ2sSr%2B4hzeNfEr15WVw%2FfRXXmZ0W9kzIucmic%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
Server-Timing: cfRequestDuration;dur=8.000135
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Download-Options: noopen
Server: cloudflare
CF-RAY: 88fc904b9ab8aa38-ICN
alt-svc: h3=":443"; ma=86400
POST
0
http://www.shopadamsstore.com/muti/
REQUEST
RESPONSE
BODY
POST /muti/ HTTP/1.1
Host: www.shopadamsstore.com
Connection: close
Content-Length: 3412
Cache-Control: no-cache
Origin: http://www.shopadamsstore.com
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.shopadamsstore.com/muti/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
HTTP/1.1 404 Not Found
Date: Fri, 07 Jun 2024 00:35:44 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
X-Sorting-Hat-PodId: -1
Vary: Accept-Encoding
vary: Accept
x-frame-options: DENY
x-request-id: 19558479-c51e-4fcb-9c4c-14643fd2a096-1717720544
server-timing: processing;dur=5
content-security-policy: frame-ancestors 'none'; report-uri /csp-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=19558479-c51e-4fcb-9c4c-14643fd2a096-1717720544
x-content-type-options: nosniff
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block; report=/xss-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=19558479-c51e-4fcb-9c4c-14643fd2a096-1717720544
x-dc: gcp-asia-northeast3,gcp-us-east1,gcp-us-east1
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HCoSd9WNX0%2FZ2v0KhJ2ZNe%2FHMqpV9hP44HLCCoXvS96H8iN7xmXyg%2FE8pfMVd%2FistYQGTybApGjiKcbXIioga4a1zvQ8lhD4kzExTQYKKjev2OkIUgnW6cFRt2tP06n1APNsvnpKNTA%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
Server-Timing: cfRequestDuration;dur=230.000019
Server: cloudflare
CF-RAY: 88fc90581a3730a9-ICN
alt-svc: h3=":443"; ma=86400
POST
0
http://www.shopadamsstore.com/muti/
REQUEST
RESPONSE
BODY
POST /muti/ HTTP/1.1
Host: www.shopadamsstore.com
Connection: close
Content-Length: 158700
Cache-Control: no-cache
Origin: http://www.shopadamsstore.com
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://www.shopadamsstore.com/muti/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
HTTP/1.1 404 Not Found
Date: Fri, 07 Jun 2024 00:35:44 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: close
X-Sorting-Hat-PodId: -1
Vary: Accept-Encoding
vary: Accept
x-frame-options: DENY
x-request-id: 1778d037-8ce3-4817-9fac-9edd56ee870a-1717720544
server-timing: processing;dur=15
content-security-policy: frame-ancestors 'none'; report-uri /csp-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=1778d037-8ce3-4817-9fac-9edd56ee870a-1717720544
x-content-type-options: nosniff
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block; report=/xss-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=1778d037-8ce3-4817-9fac-9edd56ee870a-1717720544
x-dc: gcp-asia-northeast3,gcp-us-east1,gcp-us-east1
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CobFxgu7vNotgQfW7lAapDE1Mb3vHnYUElP1q%2FuQEiNAoVu7jvlskO767RUVzzG4Nr2x93q%2BGm6MnVc9NSoeY4B3KMj8OOx4zSlMcblaENT4V5zvikhZifubCJx6FOEgVzcAGZbx8GY%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
Server-Timing: cfRequestDuration;dur=855.999947
Server: cloudflare
CF-RAY: 88fc90582cf1c053-ICN
alt-svc: h3=":443"; ma=86400
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.103:49168 -> 91.184.0.200:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.103:49171 -> 23.227.38.74:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.103:49165 -> 141.125.157.19:80 | 2031412 | ET MALWARE FormBook CnC Checkin (GET) | Malware Command and Control Activity Detected |
| TCP 192.168.56.103:49172 -> 23.227.38.74:80 | 2031413 | ET MALWARE FormBook CnC Checkin (POST) M2 | Malware Command and Control Activity Detected |
| TCP 192.168.56.103:49166 -> 141.125.157.19:80 | 2031413 | ET MALWARE FormBook CnC Checkin (POST) M2 | Malware Command and Control Activity Detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts