Report - 123.11.240.106:56014/bin.sh

Report Overview

Visitedpublic

2024-10-09 02:56:50

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Host Summary

Host	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-10-07 19:37:44	1.3 kB	3.5 kB	23.33.119.57
123.11.240.106:56014	unknown	unknown	No data	No data	397 B	136 kB	123.11.240.106
r11.o.lencr.org	unknown	2020-06-29	2024-06-07 07:43:57	2024-10-07 19:37:45	981 B	2.7 kB	23.36.76.226

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-10-09	medium	123.11.240.106:56014/bin.sh	Detects a suspicious ELF binary with UPX compression
2024-10-09	medium	123.11.240.106:56014/bin.sh	Linux.Packer.Patched_UPX

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-10-09	medium	123.11.240.106	Sinkholed

ThreatFox

No alerts detected

File detected

URL

123.11.240.106:56014/bin.sh

IP / ASN

123.11.240.106

#4837 CHINA UNICOM China169 Backbone

File Overview

File TypeELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV)

Size136 kB (135472 bytes)

MD5a73ddd6ec22462db955439f665cad4e6

SHA1ac6962542a4b23ac13bddff22f8df9aeb702ef12

SHA256b5cf68c7cb5bb2d21d60bf6654926f61566d95bfd7c9f9e182d032f1da5b4605

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detects a suspicious ELF binary with UPX compression
Elastic Security YARA Rules	malware	Linux.Packer.Patched_UPX
VirusTotal	malicious	VirusTotal - Scan result 42/59

JavaScript (0)

HTTP Transactions (8)

URL IP Response Size

r10.o.lencr.org/

23.33.119.57

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.33.119.57

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-10-08

Last Seen2024-10-11

Times Seen2943

Size504 B (504 bytes)

MD594a2d5e693f71770bd013db51ee0fbbe

SHA12f5b5bd658d11088f0599e5f244740d0d8667bea

SHA256a4b45c1833f63c69b1847216d9dd0bbfc4f95f33501d88e7dc5555648f019595

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "A4B45C1833F63C69B1847216D9DD0BBFC4F95F33501D88E7DC5555648F019595"
Last-Modified: Tue, 08 Oct 2024 12:10:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20181
Expires: Wed, 09 Oct 2024 08:32:46 GMT
Date: Wed, 09 Oct 2024 02:56:25 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.57

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.33.119.57

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-10-11

Last Seen2024-10-11

Times Seen240

Size504 B (504 bytes)

MD5b5fba3de48fd6c409033029700670f78

SHA10e348372969c771ca1d5f0ae6a944eb21c7ede05

SHA25686d583a273489c4b3d93bc10e3fa9718746ba439c1d88533f0177dec4c7183ce

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "86D583A273489C4B3D93BC10E3FA9718746BA439C1D88533F0177DEC4C7183CE"
Last-Modified: Tue, 08 Oct 2024 22:04:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4500
Expires: Wed, 09 Oct 2024 04:11:25 GMT
Date: Wed, 09 Oct 2024 02:56:25 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.57

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.33.119.57

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-10-08

Last Seen2024-10-11

Times Seen5844

Size504 B (504 bytes)

MD533985775df7b619cb33f4050d88c5fb9

SHA1cf0b2ff92cd2f7e12ce788a164a73d75dea5da83

SHA256b6db380f5eeb73aa56abf90afa43b52cc9f51b01f33ad1eefeccc473a41ffb86

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "B6DB380F5EEB73AA56ABF90AFA43B52CC9F51B01F33AD1EEFECCC473A41FFB86"
Last-Modified: Tue, 08 Oct 2024 11:18:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4523
Expires: Wed, 09 Oct 2024 04:11:48 GMT
Date: Wed, 09 Oct 2024 02:56:25 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.57

504 B

URL HTTP

r10.o.lencr.org/

IP / ASN

23.33.119.57

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-10-09

Last Seen2024-10-11

Times Seen1876

Size504 B (504 bytes)

MD5ee8a3075e7c2e453a0e7ecb6d0ffb710

SHA18207b3beb4c30142e41563a15cc410ecab5f61a8

SHA256af0c2421d7af6507eb62dfa55b8dd2c1f969ca02692e89d3bf841cb42430ebe1

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "AF0C2421D7AF6507EB62DFA55B8DD2C1F969CA02692E89D3BF841CB42430EBE1"
Last-Modified: Tue, 08 Oct 2024 12:40:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2981
Expires: Wed, 09 Oct 2024 03:46:06 GMT
Date: Wed, 09 Oct 2024 02:56:25 GMT
Connection: keep-alive

GET 123.11.240.106:56014/bin.sh

123.11.240.106

200 OK

136 kB

URL User Request GET HTTP

123.11.240.106:56014/bin.sh

IP / ASN

123.11.240.106

#4837 CHINA UNICOM China169 Backbone

Requested byN/A

Resource Info

File typeELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV)

First Seen2023-05-05

Last Seen2025-08-06

Times Seen54670

Size136 kB (135472 bytes)

MD5a73ddd6ec22462db955439f665cad4e6

SHA1ac6962542a4b23ac13bddff22f8df9aeb702ef12

SHA256b5cf68c7cb5bb2d21d60bf6654926f61566d95bfd7c9f9e182d032f1da5b4605

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detects a suspicious ELF binary with UPX compression
Elastic Security YARA Rules	malware	Linux.Packer.Patched_UPX
Quad9 DNS	malicious	Sinkholed
VirusTotal	malicious	VirusTotal - Scan result 42/59

HTTP Headers

GET /bin.sh HTTP/1.1
Host: 123.11.240.106:56014
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Length: 135472
Connection: close
Content-Type: application/zip

r11.o.lencr.org/

23.36.76.226

504 B

URL HTTP

r11.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-10-08

Last Seen2024-10-11

Times Seen8574

Size504 B (504 bytes)

MD5aa746f2452828a39148ef2ed129c14f6

SHA1aab2904047696ac367e2bfc0ffb1ba44c9c84256

SHA2565c76fd0fb994332de5317dc7d533ae3edb60d9f0ce253f839e609d83a3bf0fa7

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "5C76FD0FB994332DE5317DC7D533AE3EDB60D9F0CE253F839E609D83A3BF0FA7"
Last-Modified: Tue, 08 Oct 2024 04:17:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9165
Expires: Wed, 09 Oct 2024 05:29:12 GMT
Date: Wed, 09 Oct 2024 02:56:27 GMT
Connection: keep-alive

r11.o.lencr.org/

23.36.76.226

504 B

URL HTTP

r11.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-10-08

Last Seen2024-10-11

Times Seen8574

Size504 B (504 bytes)

MD5aa746f2452828a39148ef2ed129c14f6

SHA1aab2904047696ac367e2bfc0ffb1ba44c9c84256

SHA2565c76fd0fb994332de5317dc7d533ae3edb60d9f0ce253f839e609d83a3bf0fa7

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "5C76FD0FB994332DE5317DC7D533AE3EDB60D9F0CE253F839E609D83A3BF0FA7"
Last-Modified: Tue, 08 Oct 2024 04:17:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9165
Expires: Wed, 09 Oct 2024 05:29:12 GMT
Date: Wed, 09 Oct 2024 02:56:27 GMT
Connection: keep-alive

r11.o.lencr.org/

23.36.76.226

504 B

URL HTTP

r11.o.lencr.org/

IP / ASN

23.36.76.226

#20940 Akamai International B.V.

Requested byN/A

Resource Info

File typedata

First Seen2024-10-08

Last Seen2024-10-11

Times Seen8574

Size504 B (504 bytes)

MD5aa746f2452828a39148ef2ed129c14f6

SHA1aab2904047696ac367e2bfc0ffb1ba44c9c84256

SHA2565c76fd0fb994332de5317dc7d533ae3edb60d9f0ce253f839e609d83a3bf0fa7

HTTP Headers

POST / HTTP/1.1
Host: r11.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "5C76FD0FB994332DE5317DC7D533AE3EDB60D9F0CE253F839E609D83A3BF0FA7"
Last-Modified: Tue, 08 Oct 2024 04:17:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9165
Expires: Wed, 09 Oct 2024 05:29:12 GMT
Date: Wed, 09 Oct 2024 02:56:27 GMT
Connection: keep-alive