Globeimposter Ransomware Delivered via Necurs Botnet | Network
Try VMRay Analyzer
|
The sample contacted only unknown URLs. |
| URL | Connection Successful | Reputation Status |
|---|---|---|
| http://rorymartin8.info/hudgy356? |
|
Unknown
|
| Information | Value |
|---|---|
| Total Data Sent | 0.32 KB (332 bytes) |
| Total Data Received | 155.80 KB (159535 bytes) |
| Contacted Host Count | 1 |
| Contacted Hosts | rorymartin8.info |
| Information | Value |
|---|---|
| Used COM interface | Microsoft.XMLHTTP |
| User Agent | Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Win64; x64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729) |
| Server Name | rorymartin8.info |
| Server Port | 80 |
| Data Sent | 0.32 KB (332 bytes) |
| Data Received | 155.80 KB (159535 bytes) |
| Operation | Additional Information | Success | Count | Logfile |
|---|---|---|---|---|
| Open Session | user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Win64; x64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729), access_type = WINHTTP_ACCESS_TYPE_NO_PROXY, proxy_name = WINHTTP_NO_PROXY_NAME, proxy_bypass = WINHTTP_NO_PROXY_BYPASS |
|
1 | |
| Open Connection | protocol = http, server_name = rorymartin8.info, server_port = 80 |
|
1 | |
| Open HTTP Request | http_verb = GeT, http_version = HTTP 1.1, target_resource = /hudgy356 |
|
1 | |
| Send HTTP Request | url = http://rorymartin8.info/hudgy356? |
|
1 | |
| Receive HTTP Status | status = 200 |
|
1 | |
| Read Response | size_out = 159535 |
|
1 |
