API tools faq
paste
travisbgreen

Untitled

travisbgreen
Apr 2nd, 2019
190
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 8.98 KB | None | 0 0
raw download clone embed print report
  1. input: ./3c64807b-f201-4ed8-a72f-8e45f42af06b.pcap
  2. filter: ((ip || ip6) || (vlan && (ip || ip6)))
  3. match: POST
  4.  
  5. T 192.168.100.157:49780 -> 154.120.228.126:8080 [AP] #19
  6. POST /results/chunk/nsip/ HTTP/1.1.
  7. Referer: http://154.120.228.126/results/chunk/nsip/.
  8. Content-Type: application/x-www-form-urlencoded.
  9. DNT: 1.
  10. User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E).
  11. Host: 154.120.228.126:8080.
  12. Content-Length: 461.
  13. Connection: Keep-Alive.
  14. Cache-Control: no-cache.
  15. .
  16. o1L1037fLw=nREmVPy7Q%2FmFi1A1%2FEPn2oX5S1ZW%2FvRsLNXXqZBePwN92aI7v%2BIYxCPXL2mBfoxYKAqcczthSHH9ltO07sfP0Mj8inEd1SfWRqJx%2FoPjpcqJeta1CfpBQMDTuL5KVug6%2Fp%2BB45hh88%2BKh%2FungAYa9SaLSQGADS3G5DcWh6ylNBIwg4h9YUzOgK6DiDt8kW9MdW4%2BrVf2no797rIRFxo2zicb0mMdF%2FS3etHivGYRmkIMY5x9vZEpGtL7cXzZqlxgJV99u9HmvDzCrXdjgU5BITOoO1TsGy2Yjzd%2Flf2gE7v1tZ6gTukUnVxbwHOYLht6ZuNeebI2yzPO7zYpB%2B0UTlMWK0Cn7hhsAJSTHurjUeWlpYJ1BqX82J17j8tmY%2FFz%2BvFZnHE%2FRuEGl%2FQiAYyuDDDJ%2BiU%3D
  17.  
  18. T 192.168.100.157:49861 -> 190.104.229.114:8090 [AP] #29
  19. POST /odbc/attrib/ HTTP/1.1.
  20. Referer: http://190.104.229.114/odbc/attrib/.
  21. Content-Type: application/x-www-form-urlencoded.
  22. DNT: 1.
  23. User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E).
  24. Host: 190.104.229.114:8090.
  25. Content-Length: 450.
  26. Connection: Keep-Alive.
  27. Cache-Control: no-cache.
  28. .
  29. oFqVX=HCyLOutoQgO%2F3jU8ZmWfCQDqB3ggZ0qbwIWKadFHyvhTfK8L6Qxm5SaY3YRoeCigQzeU2XGCJb3wT%2BKzQjs6QNzWZs25v5VHLG1l0u3fUpu0YhvskgoZdhpM2w7W6bEa%2Fp%2BB45hh88%2BKh%2FungAYa9SaLSQGADS3G5DcWh6ylNBIwg4h9YUzOgK6DiDt8kW9MdW4%2BrVf2no797rIRFxo2zicb0mMdF%2FS3etHivGYRmkIMY5x9vZEpGtL7cXzZqlxgJV99u9HmvDzCrXdjgU5BITOoO1TsGy2Yjzd%2Flf2gE7v1tZ6gTukUnVxbwHOYLht6ZuNeebI2yzPO7zYpB%2B0UTlMWK0Cn7hhsAJSTHurjUeWlpYJ1BqX82J17j8tmY%2FFz%2BvFZnHE%2FRuEGl%2FQiAYyuDDDJ%2BiU%3D
  30.  
  31. T 192.168.100.157:49932 -> 181.118.101.22:8080 [AP] #39
  32. POST /vermont/vermont/ HTTP/1.1.
  33. Referer: http://181.118.101.22/vermont/vermont/.
  34. Content-Type: application/x-www-form-urlencoded.
  35. DNT: 1.
  36. User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E).
  37. Host: 181.118.101.22:8080.
  38. Content-Length: 462.
  39. Connection: Keep-Alive.
  40. Cache-Control: no-cache.
  41. .
  42. jjWyV=Gjikp0haMqPSVpk%2FZ84%2BezsV3mrZ%2FYRmpSNlF9FmiRzsCRIPC%2FIP%2B7Kwvhq9vfQ%2B%2BGqb1xVeFgb%2FYD7qtYGIirzmVxJ6ArPXrCf5HeRCyWNI6fB3M0631Nf5SALteATK%2Fp%2BB45hh88%2BKh%2FungAYa9SaLSQGADS3G5DcWh6ylNBIwg4h9YUzOgK6DiDt8kW9MdW4%2BrVf2no797rIRFxo2zicb0mMdF%2FS3etHivGYRmkIMY5x9vZEpGtL7cXzZqlxgJV99u9HmvDzCrXdjgU5BITOoO1TsGy2Yjzd%2Flf2gE7v1tZ6gTukUnVxbwHOYLht6ZuNeebI2yzPO7zYpB%2B0UTlMWK0Cn7hhsAJSTHurjUeWlpYJ1BqX82J17j8tmY%2FFz%2BvFZnHE%2FRuEGl%2FQiAYyuDDDJ%2BiU%3D
  43.  
  44. T 192.168.100.157:49983 -> 190.18.219.56:443 [AP] #48
  45. POST /acquire/mult/ HTTP/1.1.
  46. Referer: http://190.18.219.56/acquire/mult/.
  47. Content-Type: application/x-www-form-urlencoded.
  48. DNT: 1.
  49. User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E).
  50. Host: 190.18.219.56:443.
  51. Content-Length: 456.
  52. Connection: Keep-Alive.
  53. Cache-Control: no-cache.
  54. .
  55. jzcbd=O1yPIMiwSoQF0MTFwErDZaX2H1ZbkhS7RJFPSAjIyLGrsBwHIQguPw8Uhryr%2BOu4GYNu64rnqG%2F%2FBas%2FA4L7rxlSBR1tW%2BlyKuM7RTNfLSns3AZw7sm4H0TB7BioJNny%2Fp%2BB45hh88%2BKh%2FungAYa9SaLSQGADS3G5DcWh6ylNBIwg4h9YUzOgK6DiDt8kW9MdW4%2BrVf2no797rIRFxo2zicb0mMdF%2FS3etHivGYRmkIMY5x9vZEpGtL7cXzZqlxgJV99u9HmvDzCrXdjgU5BITOoO1TsGy2Yjzd%2Flf2gE7v1tZ6gTukUnVxbwHOYLht6ZuNeebI2yzPO7zYpB%2B0UTlMWK0Cn7hhsAJSTHurjUeWlpYJ1BqX82J17j8tmY%2FFz%2BvFZnHE%2FRuEGl%2FQiAYyuDDDJ%2BiU%3D
  56.  
  57. T 192.168.100.157:50039 -> 136.49.87.106:80 [AP] #57
  58. POST /srvc/enable/nsip/ HTTP/1.1.
  59. Referer: http://136.49.87.106/srvc/enable/nsip/.
  60. Content-Type: application/x-www-form-urlencoded.
  61. DNT: 1.
  62. User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E).
  63. Host: 136.49.87.106.
  64. Content-Length: 463.
  65. Connection: Keep-Alive.
  66. Cache-Control: no-cache.
  67. .
  68. w3xnfDQY90wZFj=KLtf%2B1vVHqoe3J76qmNw3QDNVl07XYd8xHapsomJ5qSKgU0JgYbUWy83paJPpAPl5SAstouTlY7J4%2ByQbfvmSHn9I9Fo58AB6XOtB9S4seMElT6jZ4%2FX25qvje9%2BF6Uh%2Fp%2BB45hh88%2BKh%2FungAYa9SaLSQGADS3G5DcWh6ylNBIwg4h9YUzOgK6DiDt8kW9MdW4%2BrVf2no797rIRFxo2zicb0mMdF%2FS3etHivGYRmkIMY5x9vZEpGtL7cXzZqlxgJV99u9HmvDzCrXdjgU5BITOoO1TsGy2Yjzd%2Flf2gE7v1tZ6gTukUnVxbwHOYLht6ZuNeebI2yzPO7zYpB%2B0UTlMWK0Cn7hhsAJSTHurjUeWlpYJ1BqX82J17j8tmY%2FFz%2BvFZnHE%2FRuEGl%2FQiAYyuDDDJ%2BiU%3D
  69.  
  70.  
  71.  
  72.  
  73. Hits:
  74. 04/02/2019-13:14:47.464039 [**] [1:2404302:5324] ET CNC Feodo Tracker Reported CnC Server group 3 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:49780 -> 154.120.228.126:8080
  75. 04/02/2019-13:14:52.780233 [**] [1:2404309:5324] ET CNC Feodo Tracker Reported CnC Server group 10 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:49861 -> 190.104.229.114:8090
  76. 04/02/2019-13:14:57.436173 [**] [1:2404304:5324] ET CNC Feodo Tracker Reported CnC Server group 5 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:49932 -> 181.118.101.22:8080
  77. 04/02/2019-13:15:00.749078 [**] [1:2404310:5324] ET CNC Feodo Tracker Reported CnC Server group 11 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:49983 -> 190.18.219.56:443
  78. 04/02/2019-13:14:47.464899 [**] [1:2835461:3] ETPRO TROJAN Win32/Emotet CnC Activity (POST) M2 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:49780 -> 154.120.228.126:8080
  79. 04/02/2019-13:14:47.464899 [**] [1:2835565:1] ETPRO TROJAN Win32/Emotet CnC Activity (POST) M3 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:49780 -> 154.120.228.126:8080
  80. 04/02/2019-13:14:47.464899 [**] [1:2835566:1] ETPRO TROJAN Win32/Emotet CnC Activity (POST) M4 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:49780 -> 154.120.228.126:8080
  81. 04/02/2019-13:14:52.781701 [**] [1:2835461:3] ETPRO TROJAN Win32/Emotet CnC Activity (POST) M2 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:49861 -> 190.104.229.114:8090
  82. 04/02/2019-13:14:52.781701 [**] [1:2835565:1] ETPRO TROJAN Win32/Emotet CnC Activity (POST) M3 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:49861 -> 190.104.229.114:8090
  83. 04/02/2019-13:14:52.781701 [**] [1:2835566:1] ETPRO TROJAN Win32/Emotet CnC Activity (POST) M4 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:49861 -> 190.104.229.114:8090
  84. 04/02/2019-13:15:00.751343 [**] [1:2835461:3] ETPRO TROJAN Win32/Emotet CnC Activity (POST) M2 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:49983 -> 190.18.219.56:443
  85. 04/02/2019-13:14:57.437446 [**] [1:2835461:3] ETPRO TROJAN Win32/Emotet CnC Activity (POST) M2 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:49932 -> 181.118.101.22:8080
  86. 04/02/2019-13:14:57.437446 [**] [1:2835565:1] ETPRO TROJAN Win32/Emotet CnC Activity (POST) M3 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:49932 -> 181.118.101.22:8080
  87. 04/02/2019-13:14:57.437446 [**] [1:2835566:1] ETPRO TROJAN Win32/Emotet CnC Activity (POST) M4 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:49932 -> 181.118.101.22:8080
  88. 04/02/2019-13:15:00.751343 [**] [1:2835565:1] ETPRO TROJAN Win32/Emotet CnC Activity (POST) M3 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:49983 -> 190.18.219.56:443
  89. 04/02/2019-13:15:04.375384 [**] [1:2835461:3] ETPRO TROJAN Win32/Emotet CnC Activity (POST) M2 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:50039 -> 136.49.87.106:80
  90. 04/02/2019-13:15:04.375384 [**] [1:2835565:1] ETPRO TROJAN Win32/Emotet CnC Activity (POST) M3 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:50039 -> 136.49.87.106:80
  91. 04/02/2019-13:15:00.751343 [**] [1:2835566:1] ETPRO TROJAN Win32/Emotet CnC Activity (POST) M4 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:49983 -> 190.18.219.56:443
  92. 04/02/2019-13:15:04.375384 [**] [1:2835566:1] ETPRO TROJAN Win32/Emotet CnC Activity (POST) M4 [**] [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.100.157:50039 -> 136.49.87.106:80
  93. 04/02/2019-13:15:00.751343 [**] [1:2013926:8] ET POLICY HTTP traffic on port 443 (POST) [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 192.168.100.157:49983 -> 190.18.219.56:443
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!