Report - 221.6.36.213:18189/files/powershell

Report Overview

Visited public
2024-07-19 03:40:44
Tags
URL
221.6.36.213:18189/files/powershell_003/powercat.ps1
Finishing URL
221.6.36.213:18189/files/powershell_003/powercat.ps1
IP / ASN
221.6.36.213
#4837 CHINA UNICOM China169 Backbone
Title
221.6.36.213:18189/files/powershell_003/powercat.ps1

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-07-18 18:12:17	2.9 kB	8.0 kB	23.36.76.226
221.6.36.213:18189	unknown	unknown	No data	No data	802 B	70 kB	221.6.36.213

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-07-19 03:40:19	medium	Client IP	221.6.36.213	ET INFO PS1 Powershell File Request
2024-07-19 03:40:24	high	221.6.36.213	Client IP	ETPRO POLICY PS/PowerCat Inbound via HTTP

Threat Detection Systems

Public InfoSec YARA rules

Scan Date	Severity	Indicator	Alert
2024-07-19	medium	221.6.36.213:18189/files/powershell_003/powercat.ps1	Detects PowerCat hacktool

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-07-19	medium	221.6.36.213	Sinkholed
2024-07-19	medium	221.6.36.213	Sinkholed

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (11)

URL IP Response Size

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
df89293c476ae09fa6ea5ee32b70224e
e684c88f3ffd36b50489c5391a3637218329e080
1a09f23c5518140b3792a6c0729e19f7cd9c728016840567f7068b7df5bccb81

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "1A09F23C5518140B3792A6C0729E19F7CD9C728016840567F7068B7DF5BCCB81"
Last-Modified: Thu, 18 Jul 2024 08:21:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2245
Expires: Fri, 19 Jul 2024 04:17:43 GMT
Date: Fri, 19 Jul 2024 03:40:18 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
2c174cd9de141b9f3330d869df450834
251c8d7aa8126bfb9fa4c164ebb067b8929486f8
e79c4bb4566914535b10c91563e36d1768f5fc8e1933392cf130e2f4d776e296

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "E79C4BB4566914535B10C91563E36D1768F5FC8E1933392CF130E2F4D776E296"
Last-Modified: Thu, 18 Jul 2024 08:21:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12914
Expires: Fri, 19 Jul 2024 07:15:32 GMT
Date: Fri, 19 Jul 2024 03:40:18 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
ba83fc82f22d464fbc0a613d3224fdef
b8d2b3e057c0d01c05e3891f5b5cdaf09e001d3b
17205f996d5ce1462adb970516597f51763582906181b875e45b5b7535f38b8f

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "17205F996D5CE1462ADB970516597F51763582906181B875E45B5B7535F38B8F"
Last-Modified: Thu, 18 Jul 2024 08:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5620
Expires: Fri, 19 Jul 2024 05:13:59 GMT
Date: Fri, 19 Jul 2024 03:40:19 GMT
Connection: keep-alive

r10.o.lencr.org/

23.36.76.226

504 B

URL
r10.o.lencr.org/
IP
23.36.76.226:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
42e531d59be85c09ecc215208470d19e
75ec72c8c8e1de19407837d46d2ad7119770cdb0
38125115e22a9a58bf2df205bb09ae6c6fef4948b9de15b2f15f37d19aedf6a9

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "38125115E22A9A58BF2DF205BB09AE6C6FEF4948B9DE15B2F15F37D19AEDF6A9"
Last-Modified: Thu, 18 Jul 2024 07:16:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3971
Expires: Fri, 19 Jul 2024 04:46:30 GMT
Date: Fri, 19 Jul 2024 03:40:19 GMT
Connection: keep-alive

221.6.36.213:18189/files/powershell_003/powercat.ps1

221.6.36.213

200 OK

39 kB

URL User Request GET HTTP/1.1
221.6.36.213:18189/files/powershell_003/powercat.ps1
IP
221.6.36.213:18189
ASN
#4837 CHINA UNICOM China169 Backbone

File type
ASCII text, with CRLF line terminators
Size
39 kB (38613 bytes)
Hash
c325adaa2081543199068fdb333291f0
dcebed74b4f8b01a5d3ca914efbe024b8aa4e987
45c28cb6c7e34f27d73bd359a77c9fe3cbe7e55d32b5b8efe599e63d3fd59c8a

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detects PowerCat hacktool
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /files/powershell_003/powercat.ps1 HTTP/1.1
Host: 221.6.36.213:18189
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 19 Jul 2024 03:40:25 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
Last-Modified: Wed, 19 Jun 2024 08:06:57 GMT
ETag: "96d5-61b39aea9207b"
Accept-Ranges: bytes
Content-Length: 38613
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive

221.6.36.213:18189/favicon.ico

221.6.36.213

200 OK

31 kB

URL GET HTTP/1.1
221.6.36.213:18189/favicon.ico
IP
221.6.36.213:18189
ASN
#4837 CHINA UNICOM China169 Backbone

Requested by
http://221.6.36.213:18189/files/powershell_003/powercat.ps1

File type
MS Windows icon resource - 3 icons, 64x64, 32 bits/pixel, 48x48, 32 bits/pixel
Size
31 kB (30894 bytes)
Hash
6eb4a43cb64c97f76562af703893c8fd
c50c4273b9d2433c6069454f971ed6653e07c126
1d7c95c5eea00a8083a95810f902682f9e26e7fbb7876b022a403642d776d0c9

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 221.6.36.213:18189
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://221.6.36.213:18189/files/powershell_003/powercat.ps1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 19 Jul 2024 03:40:26 GMT
Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
Last-Modified: Thu, 16 Jul 2015 15:32:32 GMT
ETag: "78ae-51affc7a4c400"
Accept-Ranges: bytes
Content-Length: 30894
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/x-icon

r10.o.lencr.org/

2.23.172.203

504 B

URL
r10.o.lencr.org/
IP
2.23.172.203:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
9041c7b14ed56a170760ee187e59cb3d
4334c89d4af87a7d10b7cfd712cf6494bcbf2f04
da6d4b1554585f827dbf6b29b44389dc9d1b7ea24ac0bc5b078dcc7fc5c4e148

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "DA6D4B1554585F827DBF6B29B44389DC9D1B7EA24AC0BC5B078DCC7FC5C4E148"
Last-Modified: Thu, 18 Jul 2024 08:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16038
Expires: Fri, 19 Jul 2024 08:07:39 GMT
Date: Fri, 19 Jul 2024 03:40:21 GMT
Connection: keep-alive

r10.o.lencr.org/

2.23.172.203

504 B

URL
r10.o.lencr.org/
IP
2.23.172.203:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
9041c7b14ed56a170760ee187e59cb3d
4334c89d4af87a7d10b7cfd712cf6494bcbf2f04
da6d4b1554585f827dbf6b29b44389dc9d1b7ea24ac0bc5b078dcc7fc5c4e148

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "DA6D4B1554585F827DBF6B29B44389DC9D1B7EA24AC0BC5B078DCC7FC5C4E148"
Last-Modified: Thu, 18 Jul 2024 08:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16038
Expires: Fri, 19 Jul 2024 08:07:39 GMT
Date: Fri, 19 Jul 2024 03:40:21 GMT
Connection: keep-alive

r10.o.lencr.org/

2.23.172.203

504 B

URL
r10.o.lencr.org/
IP
2.23.172.203:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
9041c7b14ed56a170760ee187e59cb3d
4334c89d4af87a7d10b7cfd712cf6494bcbf2f04
da6d4b1554585f827dbf6b29b44389dc9d1b7ea24ac0bc5b078dcc7fc5c4e148

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "DA6D4B1554585F827DBF6B29B44389DC9D1B7EA24AC0BC5B078DCC7FC5C4E148"
Last-Modified: Thu, 18 Jul 2024 08:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16038
Expires: Fri, 19 Jul 2024 08:07:39 GMT
Date: Fri, 19 Jul 2024 03:40:21 GMT
Connection: keep-alive

r10.o.lencr.org/

2.23.172.203

504 B

URL
r10.o.lencr.org/
IP
2.23.172.203:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
9041c7b14ed56a170760ee187e59cb3d
4334c89d4af87a7d10b7cfd712cf6494bcbf2f04
da6d4b1554585f827dbf6b29b44389dc9d1b7ea24ac0bc5b078dcc7fc5c4e148

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "DA6D4B1554585F827DBF6B29B44389DC9D1B7EA24AC0BC5B078DCC7FC5C4E148"
Last-Modified: Thu, 18 Jul 2024 08:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16038
Expires: Fri, 19 Jul 2024 08:07:39 GMT
Date: Fri, 19 Jul 2024 03:40:21 GMT
Connection: keep-alive

r10.o.lencr.org/

2.23.172.203

504 B

URL
r10.o.lencr.org/
IP
2.23.172.203:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
9041c7b14ed56a170760ee187e59cb3d
4334c89d4af87a7d10b7cfd712cf6494bcbf2f04
da6d4b1554585f827dbf6b29b44389dc9d1b7ea24ac0bc5b078dcc7fc5c4e148

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "DA6D4B1554585F827DBF6B29B44389DC9D1B7EA24AC0BC5B078DCC7FC5C4E148"
Last-Modified: Thu, 18 Jul 2024 08:19:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16038
Expires: Fri, 19 Jul 2024 08:07:39 GMT
Date: Fri, 19 Jul 2024 03:40:21 GMT
Connection: keep-alive

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (11)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers