| 94.142.138.114/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll |  94.142.138.114 | | 194 B |
URL User Request GET 94.142.138.114/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll IP94.142.138.114:0 ASN#35196 Ihor Hosting LLC
File typeHTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF, LF line terminators Hashd40062ed2924b41f9d244e95d7fd0818 7d2c1e0a8aa967eaac35e4013b0f787e11ec8a3a 60341eea7eaf8c16b91ca7eddb90ea1a255403e72e2e8386d0584fc8d9e1c542
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
| NIDS | Severity | Alert |
|---|
| suricata | medium | ET INFO Dotted Quad Host DLL Request | | suricata | medium | ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity | | suricata | high | ThreatFox botnet C2 traffic (url - confidence level: 100%) | | suricata | high | ThreatFox botnet C2 traffic (url - confidence level: 100%) |
GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll HTTP/1.1
Host: 94.142.138.114
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Nov 2023 12:38:07 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Encoding: gzip
|
| 94.142.138.114/favicon.ico | 94.142.138.114 | 200 OK | 194 B |
URL GET HTTP/1.194.142.138.114/favicon.ico IP94.142.138.114:80 ASN#35196 Ihor Hosting LLC
Requested byhttp://94.142.138.114/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
File typeHTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF, LF line terminators Hashd40062ed2924b41f9d244e95d7fd0818 7d2c1e0a8aa967eaac35e4013b0f787e11ec8a3a 60341eea7eaf8c16b91ca7eddb90ea1a255403e72e2e8386d0584fc8d9e1c542
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
| NIDS | Severity | Alert |
|---|
| suricata | high | ThreatFox botnet C2 traffic (url - confidence level: 100%) | | suricata | high | ThreatFox botnet C2 traffic (url - confidence level: 100%) |
GET /favicon.ico HTTP/1.1
Host: 94.142.138.114
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://94.142.138.114/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Wed, 29 Nov 2023 12:38:08 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Encoding: gzip
|