Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| stvse.com | 176.97.64.174 |
POST
100
http://stvse.com/upload.php
REQUEST
RESPONSE
BODY
POST /upload.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: stvse.com
Content-Length: 52
Expect: 100-continue
Connection: Keep-Alive
HTTP/1.1 100 Continue
POST
100
http://stvse.com/upload.php
REQUEST
RESPONSE
BODY
POST /upload.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: stvse.com
Content-Length: 54
Expect: 100-continue
Connection: Keep-Alive
HTTP/1.1 100 Continue
POST
100
http://stvse.com/upload.php
REQUEST
RESPONSE
BODY
POST /upload.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: stvse.com
Content-Length: 52
Expect: 100-continue
Connection: Keep-Alive
HTTP/1.1 100 Continue
POST
100
http://stvse.com/upload.php
REQUEST
RESPONSE
BODY
POST /upload.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: stvse.com
Content-Length: 58
Expect: 100-continue
Connection: Keep-Alive
HTTP/1.1 100 Continue
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49180 -> 176.97.64.174:80 | 2046820 | ET MALWARE [ANY.RUN] Konni.APT Exfiltration | A Network Trojan was detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts