IP 185.196.8.238:0
File typeHTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text Hash1578f0feeac8c51f16a3dd66a1c895ca 4c4afaadd77da5d49326d8177608802f3e7f0b77 407e491c87b08c5ee614ab2c115fc99e1ffe5089cdf7f8288ca95b4fbec2be13
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET INFO Executable Download from dotted-quad Host |
GET /veup.exe HTTP/1.1
Host: 185.196.8.238
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Fri, 08 Dec 2023 08:28:18 GMT
Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4
Content-Length: 299
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
| 185.196.8.238/favicon.ico | 185.196.8.238 | 200 OK | 31 kB |
URL GET HTTP/1.1185.196.8.238/favicon.ico IP185.196.8.238:80
Requested byhttp://185.196.8.238/veup.exe
File typeMS Windows icon resource - 3 icons, 64x64, 32 bits/pixel, 48x48, 32 bits/pixel\012- data Hash6eb4a43cb64c97f76562af703893c8fd c50c4273b9d2433c6069454f971ed6653e07c126 1d7c95c5eea00a8083a95810f902682f9e26e7fbb7876b022a403642d776d0c9
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: 185.196.8.238
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://185.196.8.238/veup.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 08 Dec 2023 08:28:18 GMT
Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4
Last-Modified: Thu, 16 Jul 2015 15:32:32 GMT
ETag: "78ae-51affc7a4c400"
Accept-Ranges: bytes
Content-Length: 30894
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/x-icon
|