URL User Request GET HTTP/1.1IP 185.216.70.70:443
ASN#216289 Sircrosar Limited
CertificateIssuer Subjectlocalhost FingerprintB0:23:8C:54:7A:90:5B:FA:11:9C:4E:8B:AC:CA:EA:CF:36:49:1F:F6 ValidityTue, 10 Nov 2009 23:48:47 GMT - Fri, 08 Nov 2019 23:48:47 GMT
File typeASCII text, with CRLF line terminators Hash5235814f73c4ffc6982d4a0afd8e9012 8907b031f949ed55a3401e812b7fc4b589f74c61 13ef9dea8022d0a66e802023b81b4f93c6aeb9205aca57314c0f38083e4f54cc
| Analyzer | Verdict | Alert |
|---|
| Public Nextron YARA rules | malware | Detects obfuscated PowerShell hacktools | | Public Nextron YARA rules | malware | Detects PowerShell invocation with suspicious parameters |
GET /i4.txt HTTP/1.1
Host: 185.216.70.70
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Tue, 23 Apr 2024 06:35:39 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
Last-Modified: Fri, 12 Apr 2024 20:25:29 GMT
ETag: "7b5-615ec12a21162"
Accept-Ranges: bytes
Content-Length: 1973
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/plain
|
| 185.216.70.70/favicon.ico | 185.216.70.70 | 404 Not Found | 300 B |
URL GET HTTP/1.1185.216.70.70/favicon.ico IP185.216.70.70:443 ASN#216289 Sircrosar Limited
Requested byhttps://185.216.70.70/i4.txt CertificateIssuer Subjectlocalhost FingerprintB0:23:8C:54:7A:90:5B:FA:11:9C:4E:8B:AC:CA:EA:CF:36:49:1F:F6 ValidityTue, 10 Nov 2009 23:48:47 GMT - Fri, 08 Nov 2019 23:48:47 GMT
File typeHTML document, ASCII text Hashb8d8e1e02f857afae4ead899eb44cca5 f5dd957c332a17a151b107846e47604e73b32ba1 ff4be5509756f8190e92aac561efffaca72307f6ff23682134046cb74d0761fe
GET /favicon.ico HTTP/1.1
Host: 185.216.70.70
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://185.216.70.70/i4.txt
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Tue, 23 Apr 2024 06:35:39 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
Content-Length: 300
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|