Suspicious GET Request: Do You Know What This Is?

Published: 2019-01-21. Last Updated: 2019-01-21 20:10:01 UTC
by Didier Stevens (Version: 1)
6 comment(s)

Reader Vinnie noticed following suspicious GET request directed at his web server:

My first idea was an attempt to abuse his web server as a proxy, or log SPAM.

Vinnie executed this request (hxxp://189[.]40[.]40[.]159:7771/u9licfgnx56ryp0jfdmis6s3hez4wij), and got text back:

171886eb9748eb13fc7548e018bf5b70jA0ECQMCkTJtXpMYj4b00ukBAU2wE+cAc+fGlL16GWLH6RAVc2yShs37UlBBj2cDX3s7FLGSshr...

I was able to make some sense of this: the first 32 characters are hexadecimal digits, and the rest is BASE64. That BASE64 string decodes to binary data that starts with the magic header for "GPG symmetrically encrypted data (AES256 cipher)": "8C 0D 04 09 03 02".

The data has a high entropy:

That's as far as I got.

We don't know if the server replying with this data is under the control of the attacker, or not. It could be an "innocent bystander".

Do you have any idea what this might be about, or what the data is? Please post a comment!

We're not asking to interact with this server, there's no need. We want to know if you have ideas about the request type or returned data. Should you still decide to interact with this server, be careful. We don't recommend it, we don't know what this server is or does. Don't do anything that might be considered hostile and don't do anything illegal.

If you want a second example of data, take a look at Shodan's report: https://www.shodan.io/host/189.40.40.159

Please post a comment, thanks!

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com DidierStevensLabs.com

Keywords: GET HTTP Suspicious
6 comment(s)

Comments

First look the url's could be privatebin url's AKA pasebin

Anonymous

Jan 21st 2019
5 years ago

Here's a not the first one to wonder...

https://www.reverse.it/sample/e5012144f3b85261f1035730aafdb7ae1c123ca6872b651c3ca86f2a0eb51770?environmentId=120

I also found

https://www.virustotal.com/#/url/40b3c1d5d30784fc448b6bbd0e8f9c09e89e8f993364ef480ed8e2022cc1d5fd/detection

and

https://www.virustotal.com/#/url/f1208e94f83eb37d21f0b02c32deb5e6fc1291ff7b7b88de526bfad054b13133/detection

in case that helps.

Anonymous

Jan 21st 2019
5 years ago

I guess you found this already:
https://www.reverse.it/sample/e5012144f3b85261f1035730aafdb7ae1c123ca6872b651c3ca86f2a0eb51770?environmentId=120

The response from the server changes. So far not pattern recognized.

Anonymous

Jan 21st 2019
5 years ago

I also found another related http request same IP and pattern but with different URI and returned content on URLscan.io
https://urlscan.io/result/e5fe3dec-d145-4526-a68d-26a42beccfe1#summary

Anonymous

Jan 21st 2019
5 years ago

Typically if someone's doing "GET http://..." I assume they're scanning for open proxy servers. "u9licfgnx56ryp0jfdmis6s3hez4wij" might uniquely identify Vinnie's server in the actor's data set. When the listener on port 7771 gets a request, the actor can look up the string and figure out the endpoint for the open proxy. (Looking at the connecting IP may not be good enough, in case the victim server is itself being proxied.)

The payload is the interesting part. I suppose using encrypted data has two benefits here. One, if he gets back anything at all, he knows the proxy isn't dropping traffic it can't "read." Two, if he can decrypt it, he knows the traffic made a full round-trip without being tampered with.

My guess: this is someone scanning for open proxies that don't have any DPI happening along the route.

Anonymous

Jan 22nd 2019
5 years ago

We had seen a few of those long string/GET URL requests last year (not seen one in a while) - I never was able to get a result when trying to fetch the URL myself. I was guessing it was a key string to show which server was vulnerable.

Anonymous

Jan 22nd 2019
5 years ago

Login here to join the discussion.


Top of page
Diary Archives