URL User Request GET HTTP/1.1IP 154.12.231.18:90
File typeASCII text, with CRLF line terminators Hash393ff0dedb8fd607737a7033f81b6c6a 6be77cc278df922aeca32e19880153baf0d499a4 8a8b68e34b038ffa6fe09b387ea804f23021a1aa2286ef48380c3e712cbf1032
| Analyzer | Verdict | Alert |
|---|
| Public Nextron YARA rules | malware | Detects obfuscated PowerShell hacktools | | Public Nextron YARA rules | malware | Detects PowerShell invocation with suspicious parameters | | Quad9 DNS | malicious | Sinkholed |
GET /s.txt HTTP/1.1
Host: 154.12.231.18:90
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 25 Apr 2024 08:20:40 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Last-Modified: Sun, 21 Apr 2024 19:12:01 GMT
ETag: "daf-616a0187d12fe"
Accept-Ranges: bytes
Content-Length: 3503
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/plain
|
| 154.12.231.18:90/favicon.ico | 154.12.231.18 | 404 Not Found | 299 B |
URL GET HTTP/1.1154.12.231.18:90/favicon.ico IP154.12.231.18:90
Requested byhttp://154.12.231.18:90/s.txt
File typeHTML document, ASCII text Hashabf79bedcf0ebc1b817f648eb3fe78b4 b0195cc162d8fa547c930d2fcb29ecedf938ad23 8db5c54479501aeb6042fccffcb99fbd0b2d8a9bb7a761959997c49cd9910e8a
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: 154.12.231.18:90
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://154.12.231.18:90/s.txt
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Thu, 25 Apr 2024 08:20:41 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
Content-Length: 299
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
|
| aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml | 35.244.181.201 | | 444 B |
URL aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml IP35.244.181.201:0 ASN#396982 GOOGLE-CLOUD-PLATFORM
File typeXML 1.0 document, ASCII text, with very long lines (332) Hash3b324dec137a87ef7e24a30a65b13dd0 c0faa95b2f1018e264b3a14aaf50d1003e6c27b3 6cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463
GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1
Host: aus5.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Cache-Control: no-cache
Pragma: no-cache
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
rule-id: unknown
rule-data-version: unknown
content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/aus.content-signature.mozilla.org-2024-06-09-11-51-10.chain; p384ecdsa=1SMl10cYuoxKPNNhssvFQ3U82VpbIW9eRBJ5xt1MA-kYSzP1STeZWY_6BDmJSNGfwW4vuKyWjOs60Gw_tbuoHMrM3XYknQngZwRkauT7C_K-OaGRIHQytd5zK-d7VLS8
strict-transport-security: max-age=31536000;
x-content-type-options: nosniff
content-security-policy: default-src 'none'; frame-ancestors 'none'
x-proxy-cache-status: EXPIRED
content-encoding: gzip
via: 1.1 google
date: Thu, 25 Apr 2024 08:19:06 GMT
content-type: text/xml; charset=utf-8
vary: Accept-Encoding
content-length: 444
age: 113
cache-control: public,max-age=90
alt-svc: clear
X-Firefox-Spdy: h2
|