www.fortinet.com Open in urlscan Pro
13.56.33.144 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
Effective URL:
https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
Submission: On October 26 via api (October 26th 2020, 8:59:11 am UTC) from SI

Summary HTTP 84 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 38 IPs in 6 countries across 32 domains to perform 84 HTTP transactions. The main IP is 13.56.33.144, located in San Jose, United States and belongs to AMAZON-02, US. The main domain is www.fortinet.com.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on January 22nd 2019. Valid for: 2 years.

This is the only time www.fortinet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 11	13.56.33.144 13.56.33.144	16509 (AMAZON-02) (AMAZON-02)
9	2a02:26f0:2b0... 2a02:26f0:2b00:982::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 4	52.213.60.94 52.213.60.94	16509 (AMAZON-02) (AMAZON-02)
3	104.75.88.112 104.75.88.112	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	104.111.216.96 104.111.216.96	16625 (AKAMAI-AS) (AKAMAI-AS)
1	65.9.57.71 65.9.57.71	16509 (AMAZON-02) (AMAZON-02)
1	23.111.11.182 23.111.11.182	33438 (HIGHWINDS2) (HIGHWINDS2)
2	23.210.248.44 23.210.248.44	16625 (AKAMAI-AS) (AKAMAI-AS)
2	65.9.57.21 65.9.57.21	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:824::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:824::200e	15169 (GOOGLE) (GOOGLE)
1	65.9.57.77 65.9.57.77	16509 (AMAZON-02) (AMAZON-02)
1	65.9.57.82 65.9.57.82	16509 (AMAZON-02) (AMAZON-02)
1	34.242.246.49 34.242.246.49	16509 (AMAZON-02) (AMAZON-02)
2	15.237.136.106 15.237.136.106	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
5	23.111.11.71 23.111.11.71	33438 (HIGHWINDS2) (HIGHWINDS2)
1	54.74.233.68 54.74.233.68	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:806::2008	15169 (GOOGLE) (GOOGLE)
1	96.45.36.159 96.45.36.159	40934 (FORTINET) (FORTINET)
3	35.174.150.168 35.174.150.168	14618 (AMAZON-AES) (AMAZON-AES)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
2	2a02:26f0:eb:... 2a02:26f0:eb:3a3::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 6	54.77.58.217 54.77.58.217	16509 (AMAZON-02) (AMAZON-02)
1 5	23.46.252.132 23.46.252.132	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	2a05:f500:10:... 2a05:f500:10:101::b93f:9105	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:22::14 2620:1ec:22::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	172.217.22.2 172.217.22.2	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
1	104.244.42.69 104.244.42.69	13414 (TWITTER) (TWITTER)
1 2	99.81.127.175 99.81.127.175	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:81a::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
2 2	34.120.207.148 34.120.207.148	15169 (GOOGLE) (GOOGLE)
2 2	52.51.30.82 52.51.30.82	16509 (AMAZON-02) (AMAZON-02)
2 2	34.245.253.34 34.245.253.34	16509 (AMAZON-02) (AMAZON-02)
1 2	3.120.214.218 3.120.214.218	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:819::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
1	52.54.251.217 52.54.251.217	14618 (AMAZON-AES) (AMAZON-AES)
84	38

11 13.56.33.144 (San Jose, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-13-56-33-144.us-west-1.compute.amazonaws.com

www.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a02:26f0:2b00:982::1e80 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.213.60.94 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-60-94.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.75.88.112 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a104-75-88-112.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.216.96 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-216-96.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.57.71 (Seattle, United States)

ASN16509 (AMAZON-02, US)

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.11.182 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

a.opmnstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.210.248.44 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-44.deploy.static.akamaitechnologies.com

v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 65.9.57.21 (Seattle, United States)

ASN16509 (AMAZON-02, US)

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.57.77 (Seattle, United States)

ASN16509 (AMAZON-02, US)

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.57.82 (Seattle, United States)

ASN16509 (AMAZON-02, US)

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.242.246.49 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-242-246-49.eu-west-1.compute.amazonaws.com

fortinet.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.237.136.106 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-237-136-106.eu-west-3.compute.amazonaws.com

metrics.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.111.11.71 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

a.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.74.233.68 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-74-233-68.eu-west-1.compute.amazonaws.com

in.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 96.45.36.159 (San Jose, United States)

ASN40934 (FORTINET, US)

site.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.174.150.168 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: pi0-lba1-3-ue1.aws.pardot.com

pi.pardot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
go.fortinet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:eb:3a3::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 54.77.58.217 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-77-58-217.eu-west-1.compute.amazonaws.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.46.252.132 (United States) 1 redirects

ASN20940 (AKAMAI-ASN1, EU)
PTR: a23-46-252-132.deploy.static.akamaitechnologies.com

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:10:101::b93f:9105 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:22::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.22.2 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s14-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.69 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.81.127.175 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

d.adroll.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.207.148 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 148.207.120.34.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.51.30.82 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-51-30-82.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.245.253.34 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-245-253-34.eu-west-1.compute.amazonaws.com

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.120.214.218 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-120-214-218.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:819::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.54.251.217 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-54-251-217.compute-1.amazonaws.com

nextroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	fortinet.com 1 redirects www.fortinet.com metrics.fortinet.com site.fortinet.com go.fortinet.com	513 KB
9	adobedtm.com assets.adobedtm.com	78 KB
7	omappapi.com api.omappapi.com a.omappapi.com	180 KB
6	adroll.com 1 redirects s.adroll.com d.adroll.com	70 KB
6	ml314.com 1 redirects ml314.com	15 KB
5	googletagmanager.com www.googletagmanager.com	186 KB
5	demdex.net 1 redirects dpm.demdex.net fortinet.demdex.net	4 KB
4	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com in.hotjar.com	74 KB
4	addthis.com s7.addthis.com m.addthis.com	191 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	1 KB
2	google.de www.google.de	214 B
2	google.com www.google.com	626 B
2	eyeota.net 1 redirects ps.eyeota.net	1 KB
2	crwdcntrl.net 2 redirects sync.crwdcntrl.net	1008 B
2	adsrvr.org 2 redirects match.adsrvr.org	931 B
2	rlcdn.com 2 redirects idsync.rlcdn.com	807 B
2	doubleclick.net googleads.g.doubleclick.net	3 KB
2	facebook.com www.facebook.com	523 B
2	licdn.com snap.licdn.com	3 KB
2	facebook.net connect.facebook.net	92 KB
2	pardot.com pi.pardot.com	4 KB
2	google-analytics.com www.google-analytics.com	19 KB
1	nextroll.com nextroll.com	2 KB
1	consensu.org 1 redirects d.adroll.mgr.consensu.org	137 B
1	t.co t.co	447 B
1	twitter.com analytics.twitter.com	651 B
1	googleadservices.com www.googleadservices.com	12 KB
1	ads-twitter.com static.ads-twitter.com	2 KB
1	everesttech.net 1 redirects cm.everesttech.net	554 B
1	addthisedge.com v1.addthisedge.com	756 B
1	opmnstr.com a.opmnstr.com	62 KB
1	moatads.com z.moatads.com	1 KB
84	32

	Domain	Requested by
11	www.fortinet.com	1 redirects www.fortinet.com
9	assets.adobedtm.com	www.fortinet.com assets.adobedtm.com
6	ml314.com	1 redirects www.fortinet.com ml314.com
5	s.adroll.com	1 redirects www.fortinet.com s.adroll.com
5	a.omappapi.com	a.opmnstr.com www.fortinet.com
5	www.googletagmanager.com	www.fortinet.com www.googletagmanager.com assets.adobedtm.com
4	dpm.demdex.net	1 redirects www.fortinet.com
3	s7.addthis.com	assets.adobedtm.com s7.addthis.com
2	www.google.de
2	www.google.com
2	ps.eyeota.net	1 redirects
2	sync.crwdcntrl.net	2 redirects
2	match.adsrvr.org	2 redirects
2	idsync.rlcdn.com	2 redirects
2	googleads.g.doubleclick.net	www.googleadservices.com
2	www.facebook.com
2	px.ads.linkedin.com	1 redirects
2	snap.licdn.com	www.fortinet.com snap.licdn.com
2	connect.facebook.net	www.fortinet.com connect.facebook.net
2	pi.pardot.com	www.fortinet.com pi.pardot.com
2	metrics.fortinet.com	assets.adobedtm.com www.fortinet.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	api.omappapi.com	a.opmnstr.com
1	go.fortinet.com	pi.pardot.com
1	nextroll.com
1	d.adroll.com
1	d.adroll.mgr.consensu.org	1 redirects
1	t.co
1	analytics.twitter.com	static.ads-twitter.com
1	www.googleadservices.com	www.googletagmanager.com
1	www.linkedin.com	1 redirects
1	static.ads-twitter.com	www.fortinet.com
1	site.fortinet.com	www.fortinet.com
1	in.hotjar.com	script.hotjar.com
1	cm.everesttech.net	1 redirects
1	fortinet.demdex.net	assets.adobedtm.com
1	vars.hotjar.com	static.hotjar.com
1	script.hotjar.com	static.hotjar.com
1	m.addthis.com	s7.addthis.com
1	v1.addthisedge.com	s7.addthis.com
1	a.opmnstr.com	assets.adobedtm.com
1	static.hotjar.com	www.fortinet.com
1	z.moatads.com	s7.addthis.com
84	43

This site contains links to these domains. Also see Links.

Domain
www.virustotal.com
www.facebook.com
www.twitter.com
www.youtube.com
www.linkedin.com
www.instagram.com
fortiguard.com
secure.fortinet.com
fusecommunity.fortinet.com
cookie-script.com
www.addthis.com

Subject Issuer	Validity	Valid
*.fortinet.com DigiCert SHA2 High Assurance Server CA	`2019-01-22` - `2021-03-31`	2 years	crt.sh
assets.adobedtm.com DigiCert SHA2 High Assurance Server CA	`2019-10-22` - `2021-10-01`	2 years	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
odc-prod-01.oracle.com DigiCert Secure Site ECC CA-1	`2020-07-22` - `2021-10-13`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
*.hotjar.com Amazon	`2020-01-22` - `2021-02-22`	a year	crt.sh
*.opmnstr.com Go Daddy Secure Certificate Authority - G2	`2019-04-11` - `2021-04-11`	2 years	crt.sh
api.opmnstr.com Amazon	`2020-04-09` - `2021-05-09`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
metrics.fortinet.com DigiCert SHA2 High Assurance Server CA	`2019-01-29` - `2021-02-02`	2 years	crt.sh
*.omappapi.com Go Daddy Secure Certificate Authority - G2	`2020-03-16` - `2022-03-16`	2 years	crt.sh
pi.pardot.com DigiCert SHA2 Secure Server CA	`2019-12-26` - `2020-12-26`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
*.ml314.com Amazon	`2020-02-17` - `2021-03-17`	a year	crt.sh
*.adroll.com DigiCert SHA2 Secure Server CA	`2020-01-29` - `2021-04-29`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-08-05` - `2021-02-05`	6 months	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
adroll.mgr.consensu.org Amazon	`2020-10-08` - `2021-11-07`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.eyeota.net Let's Encrypt Authority X3	`2020-08-31` - `2020-11-29`	3 months	crt.sh
www.google.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
nextroll.com Let's Encrypt Authority X3	`2020-09-20` - `2020-12-19`	3 months	crt.sh
go.fortinet.com Let's Encrypt Authority X3	`2020-09-25` - `2020-12-24`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
Frame ID: 1925F21B7465AA1FCC97F44089FBEA55
Requests: 83 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 889B14AF5C86C352DE447EFDA0B896D2
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 05104F8DD96D5288AC8B8122F932D161
Requests: 1 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Frame ID: 48A10D96B3BC990BC6415CCEDED5361B
Requests: 1 HTTP requests in this frame

Frame: https://fortinet.demdex.net/dest5.html?d_nsid=0
Frame ID: 9CD2372C8A351E52EEDC4B9B8237E39C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html HTTP 301
https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Adobe DTM (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

script /\/\/assets.adobedtm.com\//i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

84
Requests

99 %
HTTPS

31 %
IPv6

32
Domains

43
Subdomains

38
IPs

6
Countries

1511 kB
Transfer

3980 kB
Size

23
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://www.virustotal.com/gui/file/35c0980e99987f4418c8d186b9d5514c340c05ec0470c485182d24868f2a37db/detection
Title: sample

Search URL Search Domain Scan URL

URL: https://www.facebook.com/fortinet
Title:

Search URL Search Domain Scan URL

URL: https://www.twitter.com/fortinet
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/SecureNetworks
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/fortinet
Title:

Search URL Search Domain Scan URL

URL: https://www.instagram.com/behindthefirewall/
Title:

Search URL Search Domain Scan URL

URL: https://fortiguard.com/
Title: FortiGuard Labs

Search URL Search Domain Scan URL

URL: https://secure.fortinet.com/fortiguard
Title: Threat Briefs

Search URL Search Domain Scan URL

URL: https://fusecommunity.fortinet.com/
Title: Fuse Community

Search URL Search Domain Scan URL

URL: https://cookie-script.com/
Title: Free cookie consent by cookie-script.com

Search URL Search Domain Scan URL

URL: https://www.addthis.com/website-tools/overview?utm_source=AddThis%20Tools&utm_medium=image
Title: AddThis

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html HTTP 301
https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://dpm.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1603702734525 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1603702734525

Request Chain 34

https://cm.everesttech.net/cm/dd?d_uuid=09763274553994976273686282242452160763 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X5aPzwAAB2jiOFL0

Request Chain 61

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1603702735763&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%26time%3D1603702735763%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog%252Fthreat-research%252Fmalware-analysis-revenge-rat-sample%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1603702735763&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&liSync=true

Request Chain 66

https://s.adroll.com/j/exp/7OBVBCAQE5FHDPFEAD5T4D/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 68

https://d.adroll.mgr.consensu.org/consent/iabcheck/7OBVBCAQE5FHDPFEAD5T4D?_s=1edc9f689b51be93a6fdbafa7a567fb9&_b=2 HTTP 302
https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=1edc9f689b51be93a6fdbafa7a567fb9&_b=2

Request Chain 73

https://idsync.rlcdn.com/395886.gif?partner_uid=3614090515462488139 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzYxNDA5MDUxNTQ2MjQ4ODEzORAAGg0Iz5_a_AUSBQjoBxAAQgBKAA HTTP 307
https://ml314.com/csync.ashx?fp=47b414d3498bd7c476d3f4b1ad705d17a52a975ee808952ee0af3d7b5fcac60ff4cb09cee1a4f8eb&person_id=3614090515462488139&eid=50082

Request Chain 74

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=1df2f5b3-d777-4f2a-8ce1-8b6deba86f33 HTTP 302
https://ml314.com/csync.ashx?fp=1df2f5b3-d777-4f2a-8ce1-8b6deba86f33&person_id=3614090515462488139&eid=53819

Request Chain 75

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3614090515462488139 HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3614090515462488139 HTTP 302
https://ml314.com/csync.ashx?fp=71eb7de2e3507d7919914a862dabf86a&eid=50146&person_id=3614090515462488139

Request Chain 76

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif

84 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request malware-analysis-revenge-rat-sample Show response
www.fortinet.com/blog/threat-research/
Redirect Chain

https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample.html
https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

74 KB
20 KB

183ms
182ms

Document
text/html

13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

2652081e4a7ba7f127db42258c27e8311e7840bbfaf1aa37f9a5c92f4934d9f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Host: www.fortinet.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: cookiesession1=2C6411B9LFQ0O7VGBR4UCQEG00HS1390
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=600, public
Content-Encoding: gzip
Content-Type: text/html;charset=utf-8
Date: Mon, 26 Oct 2020 08:58:54 GMT
ETag: "1281e-5b265bc2c1580-gzip"
Last-Modified: Sat, 24 Oct 2020 07:35:02 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding,User-Agent
X-Content-Type-Options: nosniff
X-Dispatcher: dispatcher1uswest1
X-Frame-Options: SAMEORIGIN
X-Vhost: publish
Content-Length: 19705
Connection: keep-alive

Redirect headers

Content-Type: text/html; charset=iso-8859-1
Date: Mon, 26 Oct 2020 08:58:54 GMT
Location: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Dispatcher: dispatcher2uswest1
X-Vhost: publish
Content-Length: 289
Connection: keep-alive
Set-Cookie: cookiesession1=2C6411B9LFQ0O7VGBR4UCQEG00HS1390;Path=/;HttpOnly

GET
H/1.1 200
OK clientlib-base.min.css
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 217 KB
27 KB 327ms
176ms Stylesheet
text/css 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.css

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

7ef0ff6db29fbb95501a2bbcbcb741474fa3cb3511009901a2fe7369084ae234

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Mon, 26 Oct 2020 08:58:54 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Vhost: publish
Connection: keep-alive
Vary: Accept-Encoding,User-Agent
Content-Length: 27147
Last-Modified: Wed, 09 Sep 2020 21:03:28 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "36377-5aee7c87f0800-gzip"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: text/css;charset=utf-8
Cache-Control: max-age=684000, public
Accept-Ranges: bytes

GET
H2 200 launch-EN23cb8375449840dc93b13f34d935b8b9.min.js Show response
assets.adobedtm.com/ 247 KB
60 KB 48ms
15ms Script
application/x-javascript 2a02:26f0:2b00:982::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2b00:982::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: fc5b6932c605af2013fb5ad7fb59d30d267a8a7623c352d1fddffe88bfce84ea

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:54 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:52 GMT
server: AkamaiNetStorage
status: 200
etag: "826090bcbe30f1049578ab162b96f733:1603326472.644124"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 60549
x-akamai-path-stats: [1:878:122],[1:14653:4294964643]
expires: Mon, 26 Oct 2020 09:58:54 GMT

GET
H/1.1 200
OK fortinet-logo-white.svg
www.fortinet.com/content/dam/fortinet-blog/ 32 KB
3 KB 681ms
175ms Image
image/svg+xml 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/fortinet-logo-white.svg

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Mon, 26 Oct 2020 08:58:55 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Vhost: publish
Content-Disposition: attachment; filename="fortinet-logo-white.svg"
Connection: keep-alive
Vary: Accept-Encoding,User-Agent
Content-Length: 1998
Last-Modified: Thu, 22 Feb 2018 23:16:01 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "7ebb-565d53a1d6e40-gzip"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/svg+xml
Cache-Control: max-age=684000, public
Accept-Ranges: bytes

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1603702734525
https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1603702734525

367 B
1 KB

132ms
131ms

XHR
application/json

52.213.60.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1603702734525

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.213.60.94 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-213-60-94.eu-west-1.compute.amazonaws.com

Software

Resource Hash

5e2e52d5c75b1c0007b1d9ff02438734abce2e25d37dd68a1c132b53489e57cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v001-031366761.edge-irl1.demdex.com 6.0.1.20201019151343-dev_async_test-SNAPSHOT
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: iyQG86fASo8=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.fortinet.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 307
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://www.fortinet.com
X-TID: BjFIxPrTTzs=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=ED8739F75677FE917F000101%40AdobeOrg&d_nsid=0&ts=1603702734525
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/ 33 KB
12 KB 16ms
15ms Script
application/x-javascript 2a02:26f0:2b00:982::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2b00:982::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:54 GMT
content-encoding: gzip
last-modified: Wed, 12 Aug 2020 22:09:52 GMT
server: AkamaiNetStorage
status: 200
etag: "f259ee6445c19c2ce3c64a1b117a4f35:1597270192.577101"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12184
expires: Mon, 26 Oct 2020 09:58:54 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/ 3 KB
2 KB 17ms
16ms Script
application/x-javascript 2a02:26f0:2b00:982::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2b00:982::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0486530f1e98818865754a08e1b5442ac5a6a36a6bf6042e3b3338a532e998d2

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:54 GMT
content-encoding: gzip
last-modified: Wed, 12 Aug 2020 22:09:52 GMT
server: AkamaiNetStorage
status: 200
etag: "5dedcda2c8a6c3a51fd419d306427010:1597270192.857753"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1594
x-akamai-path-stats: [1:1169:831]
expires: Mon, 26 Oct 2020 09:58:54 GMT

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 353 KB
114 KB 69ms
24ms Script
application/javascript 104.75.88.112
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: "5ed917ff-5834c"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
status: 200
cache-control: public, max-age=600
date: Mon, 26 Oct 2020 08:58:54 GMT
x-host: s7.addthis.com
content-length: 116324

GET
H/1.1 200
OK clientlib-base.min.js Show response
www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/ 167 KB
76 KB 367ms
182ms Script
application/javascript 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

1240dad403c8c0dae31b46cf4219409e27275153dda4086c2dddc9d1ed42d131

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Mon, 26 Oct 2020 08:58:54 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Vhost: publish
Connection: keep-alive
Vary: Accept-Encoding,User-Agent
content-length: 77154
Last-Modified: Mon, 10 Aug 2020 17:39:38 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
ETag: "29a67-5ac89704aca80-gzip"
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/javascript;charset=utf-8
Cache-Control: max-age=684000, public
Accept-Ranges: bytes

GET
H/1.1 200
OK revengerat-one.png
www.fortinet.com/content/dam/fortinet-blog/article-images/revenge-rat/ 54 KB
55 KB 448ms
177ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/revenge-rat/revengerat-one.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

c7c2a637412317b9e13fd52b5ecff08eb1b5da60b3d66a2a5b8eff7eec182a84

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Mon, 26 Oct 2020 08:58:55 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 12 Nov 2019 23:44:45 GMT
Server: Apache
ETag: "d92b-5972ed5371540"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 55595

GET
H/1.1 200
OK microsoft-vuln-three.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/bluekeep-vulnerability/ 20 KB
21 KB 598ms
174ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/bluekeep-vulnerability/microsoft-vuln-three.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

b2a69f81002746fb20a34679b10c764c2d5f664de10944230824289d55c38348

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Mon, 26 Oct 2020 08:58:55 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Jun 2019 22:25:37 GMT
Server: Apache
ETag: "51ca-58affa8cf3a40"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 20938

GET
H/1.1 200
OK tlr-quarter-one.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/threat-landscape-report-q1/ 130 KB
130 KB 610ms
170ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/threat-landscape-report-q1/tlr-quarter-one.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

5d7fda52442588c5ae334e48512e3bab1c0a34ed25a9c8ec0c8afe15df3f51d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Mon, 26 Oct 2020 08:58:55 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 17 May 2019 22:40:41 GMT
Server: Apache
ETag: "206f7-5891d12802c40"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 132855

GET
H/1.1 200
OK woocommerce-one.png.thumb.319.319.png
www.fortinet.com/content/dam/fortinet-blog/article-images/woo-commerce-blog/ 38 KB
38 KB 518ms
171ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/content/dam/fortinet-blog/article-images/woo-commerce-blog/woocommerce-one.png.thumb.319.319.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

87b784071fc3dd6fbe9f0ed8362565d37f3d3eadc97acfda6ec9b9f628ff076f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Mon, 26 Oct 2020 08:58:55 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 01 Mar 2019 23:10:40 GMT
Server: Apache
ETag: "9731-5831083f2dc00"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 38705

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 74ms
24ms Script
application/x-javascript 104.111.216.96
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.216.96 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-216-96.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:54 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: 6CDA04CEF72D568E
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=38548
accept-ranges: bytes
content-length: 948
x-amz-id-2: vmrAbpbzrBs8g4V4M3AoGAqwWb0EhELJ1wy9AWvX/tuPVstbiwgv0ja/UaK2kknp20dNDPCNIa4=

GET
H2 200 hotjar-1178304.js Show response
static.hotjar.com/c/ 4 KB
2 KB 152ms
64ms Script
application/javascript 65.9.57.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1178304.js?sv=6

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.57.71 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

c8db8c4bc51d0021afa5663a448a7fabfadd002c65ccef0752d256edf1d971f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: br
x-content-type-options: nosniff
x-cache-hit: 1
x-amz-cf-pop: ARN54-C1
status: 200
etag: W/a1927e236672b319da4beabae6e59e9d
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=60
content-length: 1688
via: 1.1 54dc93d23ebec5cb4513ba0ee9d6c2d8.cloudfront.net (CloudFront)
x-amz-cf-id: Qj7DK4Y67PauGGSHpRcwiriQtcRDJdi05FNmClooE9Ojx5B3mcksDg==

GET
H2 200 api.min.js Show response
a.opmnstr.com/app/js/ 210 KB
62 KB 58ms
20ms Script
application/javascript 23.111.11.182
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.opmnstr.com/app/js/api.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.182 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5474c8872e9ddf6d23aafbc1dd3d97580c3eb3cfaae5abccc6b110d680915756

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: gzip
last-modified: Fri, 23 Oct 2020 12:57:50 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 564A1B649F9292BF
etag: W/"0a4570ca9d3d6d54d718e6ffcc6729c9"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: ZcXgaUk0LGGvX2jeMdKtFGaANQQnSetqIleWGan8zOYJPMfQoLU66GexM9KBshhy6fEGwHG9KB0=
expires: Thu, 21 Oct 2021 08:58:55 GMT

GET
H2 200 RCc1e0e9525773456f8571be34d2bb1032-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/ 1 KB
835 B 16ms
16ms Script
application/x-javascript 2a02:26f0:2b00:982::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/RCc1e0e9525773456f8571be34d2bb1032-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2b00:982::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 97e95fcc66a29acfd27e371656c24da14947aace63dfa4db95fa8482f8bfb4bc

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:53 GMT
server: AkamaiNetStorage
status: 200
etag: "fe5d828f2f70432717ed446e55d13f5f:1603326473.299146"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 536
x-akamai-path-stats: [1:785:4294966511]
expires: Mon, 26 Oct 2020 09:58:55 GMT

GET
H2 200 RCb652faf409a54c3db318899e2cbcc95c-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/ 881 B
746 B 17ms
16ms Script
application/x-javascript 2a02:26f0:2b00:982::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/RCb652faf409a54c3db318899e2cbcc95c-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2b00:982::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: f692ee03941001acfb64ab453b8ad134f6d8b8927d29ef586ef052d848878cfd

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:53 GMT
server: AkamaiNetStorage
status: 200
etag: "fe5d828f2f70432717ed446e55d13f5f:1603326473.299146"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 452
x-akamai-path-stats: [1:848:152]
expires: Mon, 26 Oct 2020 09:58:55 GMT

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/ra-5d48adfc650f1a9e/ 2 KB
756 B 245ms
194ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/ra-5d48adfc650f1a9e/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 133debcec0026d79ced8d9d9504d6f95804410b4806b4b0b5f973f6ca529f5fb

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: gzip
etag: 1861047380--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: public, max-age=52, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 580

GET
H2 200 300lo.json Show response
m.addthis.com/live/red_lojson/ 89 B
249 B 179ms
128ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthis.com/live/red_lojson/300lo.json?si=5f968fcedb02faa8&bkl=0&bl=1&pdt=1117&sid=5f968fcedb02faa8&pub=ra-5d48adfc650f1a9e&rev=v8.28.7-wp&ln=en&pc=men&cb=0&ab=-&dp=www.fortinet.com&fp=blog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&mk=threat%20research%2CThreat%20Research%2Cmalware%20analysis%2CCybersecurity%20Architect&colc=1603702735145&jsl=1&uvs=5f968fce68840e7f000&skipb=1&callback=addthis.cbs.jsonp__71351853694398430
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fc8235bcff1ab60ad40f08a7f4e58ae704e86870207ec65b43906663e75c8f28

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Mon, 26 Oct 2020 08:58:55 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-disposition: attachment; filename=1.txt
content-length: 89
content-type: application/javascript;charset=utf-8

GET sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 889B 0
0

GET
H2 200 sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 0510 0
0 26ms
26ms Document
text/html 104.75.88.112
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: s7.addthis.com
:scheme: https
:path: /static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Response headers

status: 200
server: nginx/1.15.8
content-type: text/html
last-modified: Mon, 09 Sep 2019 15:34:57 GMT
etag: W/"5d767121-1115f"
timing-allow-origin: *
cache-control: public, max-age=86313600
p3p: CP="NON ADM OUR DEV IND COM STA"
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
content-length: 25412
date: Mon, 26 Oct 2020 08:58:55 GMT
vary: Accept-Encoding
x-host: s7.addthis.com

GET
H/1.1 200
OK revengerat-two.png
www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample/_jcr_content/root/responsivegrid/image_1779882811.img.png/1573604391748/ 48 KB
49 KB 197ms
187ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample/_jcr_content/root/responsivegrid/image_1779882811.img.png/1573604391748/revengerat-two.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

d223439f0a00d264eadf96d43a5245e291ff1504db055176eb8a3da4ef532cb4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher1uswest1
Date: Mon, 26 Oct 2020 08:58:55 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 13 Nov 2019 00:19:51 GMT
Server: Apache
ETag: "c12b-5972f52be17c0"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 49451

GET
H/1.1 200
OK revengerat-three.png
www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample/_jcr_content/root/responsivegrid/image_1095175056.img.png/1573604417171/ 91 KB
92 KB 192ms
179ms Image
image/png 13.56.33.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample/_jcr_content/root/responsivegrid/image_1095175056.img.png/1573604417171/revengerat-three.png

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

13.56.33.144 San Jose, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-56-33-144.us-west-1.compute.amazonaws.com

Software

Apache /

Resource Hash

d6df1bca3f52fafa22d16bb86bc71723212b30401ea887f94635bb855b2e4ca4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Dispatcher: dispatcher2uswest1
Date: Mon, 26 Oct 2020 08:58:55 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 13 Nov 2019 00:20:17 GMT
Server: Apache
ETag: "16dc2-5972f544ad240"
X-Vhost: publish
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: image/png
Cache-Control: max-age=684000, public
Strict-Transport-Security: max-age=31536000; includeSubDomains
Accept-Ranges: bytes
Content-Length: 93634

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 39852 Show response
api.omappapi.com/v2/embed/ 21 KB
5 KB 239ms
150ms XHR
application/json 65.9.57.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/39852
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.57.21 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Pagely Gateway/1.5.1 /
Resource Hash: 9b10abf6d444b80d370fa0641fa9cc25d353003d31ff60bbc60a9c37b84a9750

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: gzip
x-cache-config: 0 0
x-amz-cf-pop: ARN54-C1
x-cache-status: HIT
x-cache: Miss from cloudfront
status: 200
access-control-allow-headers: X-CSRF-Token
x-optinmonster-account: 45602
x-user-agent: standard--
last-modified: Fri, 16 Oct 2020 03:41:03 GMT
server: Pagely Gateway/1.5.1
etag: W/"86be8e88cc4ab784c976747902cb81c1"
vary: Accept-Encoding, User-Agent
content-type: application/json
via: 1.1 d661c8f821b4dd0011bb1bb50baf07c3.cloudfront.net (CloudFront)
access-control-expose-headers: X-OptinMonster-Account, X-User-Agent
access-control-allow-origin: *
x-amz-cf-id: qpYjcKSes2ZQlkKTltUFxANCvfY8e9aCCOrisa4HOq7R5w2ePjNj4g==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 94 KB
37 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d7b144a39a2d1f833fd452dc44a83ea505f8946a426d177e2e99bc2efba44e48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37906
x-xss-protection: 0
last-modified: Mon, 26 Oct 2020 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 26 Oct 2020 08:58:55 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 6187
date: Mon, 26 Oct 2020 07:15:48 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Mon, 26 Oct 2020 09:15:48 GMT

GET
H2 200 modules.b98d976b35a426609eb5.js Show response
script.hotjar.com/ 361 KB
71 KB 141ms
54ms Script
application/javascript 65.9.57.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.b98d976b35a426609eb5.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1178304.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.57.77 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

4bd60fc7b2e0c630d954762ccb91f3aeca0836fbf313776be1e664821921a529

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 23 Oct 2020 09:53:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 255912
x-cache: Hit from cloudfront
status: 200
content-length: 72436
access-control-allow-origin: *
last-modified: Fri, 23 Oct 2020 09:49:39 GMT
etag: "5e236c4a7b222f7b0d0d60eecb9d7d12"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 fa679145440a8b5dfc579eecfc89d9d8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: ARN54-C1
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: 0HmAyfj67Vz76lOZ6EHi_qI96fVGeb-8XW3p2PEm5XhO_p5rfbbipw==

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 1 B
409 B 39ms
12ms XHR
text/plain 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&a=1458355527&t=pageview&_s=1&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&ul=en-us&de=UTF-8&dt=Double%20Trouble%3A%20RevengeRAT%20and%20WSHRAT&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=1469426681&gjid=1886027489&cid=45146499.1603702735&tid=UA-767980-1&_gid=2013261930.1603702735&_r=1&gtm=2ouae1&z=688920103

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 26 Oct 2020 08:58:55 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 box-469cf41adb11dc78be68c1ae7f9457a4.html
vars.hotjar.com/ Frame 48A1 0
0 134ms
45ms Document
text/html 65.9.57.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1178304.js?sv=6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.57.82 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-469cf41adb11dc78be68c1ae7f9457a4.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Response headers

status: 200
content-type: text/html
content-length: 851
date: Mon, 05 Oct 2020 13:02:45 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
etag: "d594f1d4c3e5dbd6b556c60d34e0daea"
last-modified: Mon, 05 Oct 2020 11:02:22 GMT
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 dddc8f2bbf76628526b9a5a150e6e5bb.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN54-C1
x-amz-cf-id: m8R006X4QB9dR0S4ayZBt_GxRfZtzb3uOwxs8AeaV5wTlQ7Pa-S7wg==
age: 1799770

GET
H2 200 layers.33f5b85045a5f2308467.js Show response
s7.addthis.com/static/ 263 KB
76 KB 26ms
26ms Script
application/javascript 104.75.88.112
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.33f5b85045a5f2308467.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.88.112 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-75-88-112.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
server: nginx/1.15.8
etag: W/"5ed917ff-41b9f"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
date: Mon, 26 Oct 2020 08:58:55 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77540

GET
H/1.1 200
OK Cookie set dest5.html
fortinet.demdex.net/ Frame 9CD2 0
0 151ms
38ms Document
text/html 34.242.246.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fortinet.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.242.246.49 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-242-246-49.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: fortinet.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=09763274553994976273686282242452160763
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Thu, 15 Oct 2020 13:59:48 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=09763274553994976273686282242452160763;Path=/;Domain=.demdex.net;Expires=Sat, 24-Apr-2021 08:58:55 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: wvlsAV1kQsA=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 id Show response
metrics.fortinet.com/ 48 B
512 B 113ms
30ms XHR
application/x-javascript 15.237.136.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.fortinet.com/id?d_visid_ver=5.0.1&d_fieldgroup=A&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&mid=09397731926264007873724032911323898227&ts=1603702735417

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.237.136.106 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-237-136-106.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

ab4780c284e32f34ae320f9c2420d2be6f9caeff7601f7668759ebc73db5536c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Mon, 26 Oct 2020 08:58:55 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-7dd9449d74-x4xxl
vary: Origin
x-c: master-1397.I728fb3.M0-462
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.fortinet.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=X5aPzwAAB2jiOFL0
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=09763274553994976273686282242452160763
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X5aPzwAAB2jiOFL0

42 B
915 B

38ms
38ms

Image
image/gif

52.213.60.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=X5aPzwAAB2jiOFL0

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.213.60.94 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-213-60-94.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v084-081967b82.edge-irl1.demdex.com 5.78.2.20201014153347 1ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: 3nerGLePRzw=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Mon, 26 Oct 2020 08:58:54 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=X5aPzwAAB2jiOFL0
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
DATA 200
OK truncated
/ 443 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 json Show response
api.omappapi.com/v3/geolocate/ 567 B
974 B 151ms
151ms XHR
application/json 65.9.57.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v3/geolocate/json
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.57.21 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Pagely Gateway/1.5.1 /
Resource Hash: 132f25101b254611152002e28a0ee9049bccfc5a10e98fd7e5bfa956653abbd7

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
via: 1.1 d661c8f821b4dd0011bb1bb50baf07c3.cloudfront.net (CloudFront)
x-cache-config: 0 0
x-amz-cf-pop: ARN54-C1
x-cache-status: BYPASS
x-cache: Miss from cloudfront
status: 200
content-length: 567
x-user-agent: standard--
server: Pagely Gateway/1.5.1
x-ratelimit-remaining: 999
content-type: application/json
access-control-allow-origin: *
x-ratelimit-reset: 1603702795
x-ratelimit-limit: 1000
x-pagely-debug: mainblock
x-amz-cf-id: Sc2UW3qPDXuerDXcenIaG7thCLdHkElglFiJ7w5xuUHiigFZm-H8FQ==

GET
H2 200 webfont.js Show response
a.omappapi.com/app/js/webfont/1.5.18/ 16 KB
7 KB 59ms
19ms Script
application/javascript 23.111.11.71
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/webfont/1.5.18/webfont.js
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.71 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 20:09:04 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 8B671F9707D00D47
etag: W/"593e60ad549e46f8ca9a60755336c7df"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: 9npExxaRtT8FoDZ8IPP3v09WxPX+jM5XRWDOXVCxOLy9yio6KNer03zES7p0TYj/qrNd1piwzkM=
expires: Thu, 21 Oct 2021 08:58:55 GMT

GET
H2 200 moment.min.js Show response
a.omappapi.com/app/js/moment.js/2.24.0/ 52 KB
20 KB 71ms
32ms Script
application/javascript 23.111.11.71
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/moment.js/2.24.0/moment.min.js
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.71 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e22419e8154be2a34a950dbb4c4c448413751c53ef02f00c6c56af28aa2c4964

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 20:09:04 GMT
server: NetDNA-cache/2.2
x-amz-request-id: C11A6CD7F1B440CF
etag: W/"761502841c035afcf6a9bdc5d0a20d11"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: R6Qiy/HyfObHpUXxOf4ue45LSglCcvr2LkUtpyhhD2mYp4qzEBv59oXpkW8oT3GciAGqdLhFnqQ=
expires: Thu, 21 Oct 2021 08:58:55 GMT

GET
H2 200 be4ae086a16ba13fb5ebdbd263d65913-optin.json Show response
a.omappapi.com/app/campaign-views/df0603609574/qxx1b0gslklfu2kjckea/ 16 KB
3 KB 57ms
18ms XHR
application/json 23.111.11.71
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/campaign-views/df0603609574/qxx1b0gslklfu2kjckea/be4ae086a16ba13fb5ebdbd263d65913-optin.json
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.71 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 27c7d95f98767a71d39b0b5b4dc4eb6874a7f3710e45db2da8585b4c0e37cfae

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: gzip
x-amz-request-id: CF3489CCB30D228A
x-cache: HIT
status: 200
x-amz-meta-date: 1602790797
x-amz-id-2: vZU/aqmV8pk9QjiBYNo+NtnnyF91ZqvJNTGZpYEv2CjMrZfwzkO40bBEhtXcZdxQSpNeGLXUSWY=
x-amz-meta-level: pro
last-modified: Thu, 15 Oct 2020 19:39:58 GMT
server: NetDNA-cache/2.2
etag: W/"be4ae086a16ba13fb5ebdbd263d65913"
content-type: application/json
access-control-allow-origin: *
x-amz-meta-title: be4ae086a16ba13fb5ebdbd263d65913-optin.json
cache-control: max-age=31104000
expires: Thu, 21 Oct 2021 08:58:55 GMT

GET
H2 200 s04334100666597
metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.22.0-LAWA/ 43 B
329 B 29ms
29ms Image
image/gif 15.237.136.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics.fortinet.com/b/ss/fortinetincproduction/1/JS-2.22.0-LAWA/s04334100666597?AQB=1&ndh=1&pf=1&t=26%2F9%2F2020%209%3A58%3A55%201%20-60&mid=09397731926264007873724032911323898227&aamlh=6&ce=UTF-8&pageName=en%3Ablog%3Athreat-research%3Amalware-analysis-revenge-rat-sample&g=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&cc=USD&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&v1=www.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&c7=Entire%20Site&c8=New&v27=BLOG&v33=en%3Ablog%3Athreat-research%3Amalware-analysis-revenge-rat-sample&v35=Enabled&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=ED8739F75677FE917F000101%40AdobeOrg&AQE=1

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.237.136.106 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-237-136-106.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
x-content-type-options: nosniff
x-c: master-1397.I728fb3.M0-462
p3p: CP="This is not a P3P policy"
status: 200
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 27 Oct 2020 08:58:55 GMT
server: jag
xserver: anedge-7dd9449d74-b5z85
etag: 3443925399750672384-4621725588386975077
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Sun, 25 Oct 2020 08:58:55 GMT

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/1178304/ 178 B
321 B 112ms
42ms XHR
application/json 54.74.233.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/1178304/visit-data?sv=6
Requested by: Host: script.hotjar.com
URL: https://script.hotjar.com/modules.b98d976b35a426609eb5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.74.233.68 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-74-233-68.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6154d5f7f6961e042d013bab33fd02b691970d873f44f3c32d8fcc6e79ef5bcd

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: br
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
access-control-allow-credentials: true

GET
H2 200 68cbeabff9f01602790731-training-banner.jpg
a.omappapi.com/users/df0603609574/images/ 133 KB
133 KB 20ms
20ms Image
image/jpeg 23.111.11.71
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.omappapi.com/users/df0603609574/images/68cbeabff9f01602790731-training-banner.jpg
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.71 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ea7b8aff4830d0c5ca09b5e0f0567349323f48b73cef7c4fb77d48248979d16f

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
x-amz-request-id: 0AA166069F3A3568
x-cache: HIT
status: 200
x-amz-meta-optin: qxx1b0gslklfu2kjckea
x-amz-meta-userid: 39852
x-amz-meta-siteid: 5ab4105aee546
content-length: 135838
x-amz-id-2: UPSTpOl8UET0LVTl3YUnS9oEpJVMRt0l0IPp7L30p/UtnMO59ZH3GXgNgVJm0h2yXA1kopCUI3M=
x-amz-meta-date: 1602790731
x-amz-meta-level: pro
x-amz-meta-dimensions: 1024 x 160
last-modified: Thu, 15 Oct 2020 19:39:18 GMT
server: NetDNA-cache/2.2
x-amz-meta-accountid: 45602
etag: "722442ead4852dac1e522a915e5a217b"
content-type: image/jpeg
access-control-allow-origin: *
x-amz-meta-title: 68cbeabff9f01602790731-training-banner.jpg
cache-control: max-age=31104000
accept-ranges: bytes
expires: Thu, 21 Oct 2021 08:58:55 GMT

GET
H2 200 moment-timezone-with-data-2012-2022.min.js Show response
a.omappapi.com/app/js/moment-timezone/0.5.23/ 32 KB
11 KB 41ms
41ms Script
application/javascript 23.111.11.71
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/moment-timezone/0.5.23/moment-timezone-with-data-2012-2022.min.js
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.71 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 23190e1539469cc8b5faccb038b260ccda2cc62672c70efa1900a51a8e3d1be5

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: gzip
last-modified: Mon, 28 Sep 2020 20:09:04 GMT
server: NetDNA-cache/2.2
x-amz-request-id: B1D1931EC7C08C5B
etag: W/"fb7fbe56bb07e1bb4ead7d6ef061dbac"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: fxkYQ4w7zvdHPvW8lBfTu7Pk4DyRTbi6SqIJWvs/eFnz9TNCo7Kkf/SWzIrkkHYPU3IOuw58I30=
expires: Thu, 21 Oct 2021 08:58:55 GMT

GET
H2 200 RCf9ff76cf31c74379bd3f3a2cf11481b5-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/ 1021 B
900 B 17ms
17ms Script
application/x-javascript 2a02:26f0:2b00:982::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/RCf9ff76cf31c74379bd3f3a2cf11481b5-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2b00:982::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 6071bd6cb72a22908968609c8f71c3a4c35d8a800167fd458542a32780445252

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:53 GMT
server: AkamaiNetStorage
status: 200
etag: "fe5d828f2f70432717ed446e55d13f5f:1603326473.299146"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 601
x-akamai-path-stats: [1:1292:4294967004]
expires: Mon, 26 Oct 2020 09:58:55 GMT

GET
H2 200 RC4a2e638109b443d5b84d8f2e2216b80e-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/ 819 B
768 B 18ms
18ms Script
application/x-javascript 2a02:26f0:2b00:982::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/RC4a2e638109b443d5b84d8f2e2216b80e-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2b00:982::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9d1b840480f23fb32f2a58063761424456b59f139d4609b5e7b0610dd2fc6237

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:53 GMT
server: AkamaiNetStorage
status: 200
etag: "fe5d828f2f70432717ed446e55d13f5f:1603326473.299146"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 502
expires: Mon, 26 Oct 2020 09:58:55 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 94 KB
37 KB 41ms
23ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cdebb9617bcda474bd09c07b66bf49608fc1606962c8e837bdd4124a552b6355

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37970
x-xss-protection: 0
last-modified: Mon, 26 Oct 2020 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 26 Oct 2020 08:58:55 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 94 KB
37 KB 48ms
29ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-10050195&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

06182b83bd033b6cda0e4e82b71d11a78d7e8b2641fe10109708664a2ca08760

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37966
x-xss-protection: 0
last-modified: Mon, 26 Oct 2020 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 26 Oct 2020 08:58:55 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 94 KB
38 KB 39ms
22ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-767980-1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

504cb84b076d359d547193e04f2d82b90d79f7591c7218cad2fefda54a82ab02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37969
x-xss-protection: 0
last-modified: Mon, 26 Oct 2020 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 26 Oct 2020 08:58:55 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 94 KB
37 KB 39ms
22ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-609297413&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f7453f56f31ea4a02de5fa02b986a20224ff7463d7bdeb19810e6c4edd02a6e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37951
x-xss-protection: 0
last-modified: Mon, 26 Oct 2020 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 26 Oct 2020 08:58:55 GMT

GET
H2 200 RC0a0605f4b42e425fa678ffc6c2d94fb3-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/ 847 B
771 B 16ms
15ms Script
application/x-javascript 2a02:26f0:2b00:982::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/RC0a0605f4b42e425fa678ffc6c2d94fb3-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2b00:982::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9a7f564316dc7303685d94451d6c9fc9dae613ec562b18a91c04ef32a63bd994

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:53 GMT
server: AkamaiNetStorage
status: 200
etag: "fe5d828f2f70432717ed446e55d13f5f:1603326473.299146"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 477
x-akamai-path-stats: [1:795:205]
expires: Mon, 26 Oct 2020 09:58:55 GMT

GET
H2 200 RC7aad8f7422fa440982b5442a32fa8e4e-source.min.js Show response
assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/ 664 B
699 B 16ms
16ms Script
application/x-javascript 2a02:26f0:2b00:982::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/b359cfb740b4/a792d4e6ffcd/4c621e841835/RC7aad8f7422fa440982b5442a32fa8e4e-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN23cb8375449840dc93b13f34d935b8b9.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:2b00:982::1e80 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: e3921284615c40654c9e00e3c672b92a639096d4d3712274184344b371fbfda7

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 00:27:53 GMT
server: AkamaiNetStorage
status: 200
etag: "fe5d828f2f70432717ed446e55d13f5f:1603326473.299146"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.fortinet.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 400
x-akamai-path-stats: [1:766:4294966530]
expires: Mon, 26 Oct 2020 09:58:55 GMT

GET
H/1.1 200 ipinfo Show response
site.fortinet.com/utilservice/ 213 B
745 B 523ms
174ms Script
application/json 96.45.36.159
FORTINET

General

Check archive.org

Show headers Download Go to

Full URL

https://site.fortinet.com/utilservice/ipinfo?site=fortinet.com&callback=jQuery22009753210657410152_1603702735130&_=1603702735131

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/etc.clientlibs/fortinet-blog/clientlibs/clientlib-base.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.45.36.159 San Jose, United States, ASN40934 (FORTINET, US),

Reverse DNS

Software

nginx/1.14.0 /

Resource Hash

4b70d151a449f1544c28524b9f77d78ed41e1fd8e6e6b4c54ad3ee1ff9b4a857

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' .fortinet.com .myfortinet.com fortinet.my.salesforce.com;
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors 'self' *.fortinet.com *.myfortinet.com fortinet.my.salesforce.com;
Server: nginx/1.14.0
Date: Mon, 26 Oct 2020 08:58:56 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: application/json;charset=UTF-8
Connection: keep-alive
Content-Length: 213
Front-End-Https: on

GET
H/1.1 200
OK pd.js Show response
pi.pardot.com/ 5 KB
2 KB 413ms
103ms Script
application/javascript 35.174.150.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/pd.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.150.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-3-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: 925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 26 Oct 2020 08:58:56 GMT
Content-Encoding: gzip
X-Pardot-Route: ea50fcd3dcf777490e1499615b883deb
X-Pardot-LB: a083ac6fc1531fb089982e922db67d20
Last-Modified: Fri, 13 Mar 2020 19:44:11 GMT
Server: PardotServer
ETag: "1442-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Cache-Control: max-age=63072000
Accept-Ranges: bytes
Content-Length: 1842
Expires: Wed, 26 Oct 2022 08:58:56 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 88 KB
23 KB 20ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e37570ef85a3553930ba20dfab7280bfcead8a2238b536b5c03c629c35b3d4ca

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23070
x-xss-protection: 0
pragma: public
x-fb-debug: cN5pfhEtnExi6gruPYBkekRZkdxfHaXvCei7ib/xkfP+8EFNFHJHRewiKcPsO0/YOp95thidSkG7RXcLFEPrnA==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Mon, 26 Oct 2020 08:58:55 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 65ms
21ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: gzip
age: 41182
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-hhn4037-HHN
last-modified: Wed, 21 Oct 2020 21:46:56 GMT
x-timer: S1603702736.747226,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 965 B
760 B 10ms
8ms Script
application/x-javascript 2a02:26f0:eb:3a3::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:eb:3a3::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 26 Oct 2020 08:58:55 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=8877
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 448

GET
H/1.1 200
OK tag.aspx Show response
ml314.com/ 26 KB
12 KB 148ms
38ms Script
application/javascript 54.77.58.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?269
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.58.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-58-217.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 390a28be2ca4bcea5b71fe050295281a1a8fc99175690cdd62de378190400acb

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 26 Oct 2020 08:58:55 GMT
Content-Encoding: gzip
Last-Modified: Mon, 26 Oct 2020 07:34:58 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=81362
Connection: keep-alive
Content-Length: 11933
Expires: Tue, 27 Oct 2020 07:34:58 GMT

GET
H/1.1 200
OK insight.beta.min.js Show response
snap.licdn.com/li.lms-analytics/ 4 KB
2 KB 7ms
7ms Script
application/x-javascript 2a02:26f0:eb:3a3::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:eb:3a3::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 26 Oct 2020 08:58:55 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=9425
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1799

GET
H2 200 177020962864941 Show response
connect.facebook.net/signals/config/ 234 KB
68 KB 8ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/177020962864941?v=2.9.27&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

50767a5dcab4f4ae0aa05bb3bf246815cb41da175707ac7a39c837ded7e89250

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 69831
x-xss-protection: 0
pragma: public
x-fb-debug: NHot6szxjKYaGx2iHQcWDbTKomiYWZ1dWW0wjKQiVAmO8km/Te/D8wqPO0CKeJevfA34ADEKzTvT/28AbYCltg==
x-fb-trip-id: 664085054
date: Mon, 26 Oct 2020 08:58:55 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 39 KB
13 KB 102ms
33ms Script
text/javascript 23.46.252.132
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.fortinet.com
URL: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.46.252.132 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a23-46-252-132.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: c248f8404721d961fff789b4916e8b2f3ac975ffde32bb370374814712055d59

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: j1Ukz68kZImBJrgt6DlzhQICmRxkgWbz
Content-Encoding: gzip
ETag: "505601f096ee8dbb7ca2aafa3009e00c"
x-amz-request-id: D91F8E470C8CC2C3
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 12342
x-amz-id-2: bL03wB8pPVX2ij/eIDZ4iohM+F58aPOvpCs8Qq22vqvmGAFf99z+L3BBpjfoZgdaJAtQBwclvyw=
Last-Modified: Wed, 14 Oct 2020 20:21:11 GMT
Server: AmazonS3
Date: Mon, 26 Oct 2020 08:58:55 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1603702735763&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7120%26time%3D1603702735763%26url%3Dhttps%253A%252F%252Fwww.fortinet.com%252Fblog...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1603702735763&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&liSync=true

0
101 B

144ms
143ms

Image
application/javascript

2a05:f500:10:101::b93f:9105
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1603702735763&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&liSync=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:56 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-ltx1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 0
x-li-uuid: r/RnRiR/QRawP6W4KysAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-content-type-options: nosniff
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: cnQGQCR/QRZgcwQiFysAAA==
pragma: no-cache
x-li-pop: afd-prod-eda6
x-msedge-ref: Ref A: 2ED985E4AE7B48E4ACFB4FAA41867570 Ref B: VIEEDGE1515 Ref C: 2020-10-26T08:58:55Z
x-frame-options: sameorigin
date: Mon, 26 Oct 2020 08:58:55 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
x-li-fabric: prod-ltx1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7120&time=1603702735763&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 30 KB
12 KB 80ms
29ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-662878185&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

0bfb81a6d3e2ed2e0cb381a9f933355ff00e64cd0d80724e83559861cad12711

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11472
x-xss-protection: 0
server: cafe
etag: 8286593240961886057
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 26 Oct 2020 08:58:55 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
377 B 27ms
9ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=177020962864941&ev=PageView&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&rl=&if=false&ts=1603702735830&sw=1600&sh=1200&v=2.9.27&r=stable&ec=0&o=30&fbp=fb.1.1603702735826.963824337&it=1603702735723&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:55 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 26 Oct 2020 08:58:55 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
651 B 190ms
135ms Script
application/javascript 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nxlzj&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 111
pragma: no-cache
last-modified: Mon, 26 Oct 2020 08:58:55 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 4b65fe29216cdd7404c69e8ec956f125
x-transaction: 006c01710001330f
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
447 B 193ms
140ms Image
image/gif 104.244.42.69
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=nxlzj&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.69 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 116
pragma: no-cache
last-modified: Mon, 26 Oct 2020 08:58:55 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 80e11410164b965eac8fb2cdc109c741
x-transaction: 00d5a91200b296f9
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/7OBVBCAQE5FHDPFEAD5T4D/index.js
https://s.adroll.com/j/exp/index.js

28 B
747 B

30ms
30ms

Script
application/javascript

23.46.252.132
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.46.252.132 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a23-46-252-132.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 2U8XMvdFINXJNFsilaXONuSvqmREKV3.
Content-Encoding: gzip
ETag: "5816cced8568d223aa09d889f300692b"
x-amz-request-id: BN1H3SFMAQ9G4T8Y
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 48
x-amz-id-2: DlLnJ7bw2Njgi5+3vlXKD5CvlNfwUZLA6breINs7cgJR0G6R/KP2H6pi34kzopj5ZN5q4Vf6rHo=
Last-Modified: Fri, 31 Jul 2020 16:11:15 GMT
Server: AmazonS3
Date: Mon, 26 Oct 2020 08:58:56 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

Date: Mon, 26 Oct 2020 08:58:56 GMT
Server: AkamaiGHost
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 0

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/ 1 KB
1 KB 94ms
33ms Script
text/javascript 23.46.252.132
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/7OBVBCAQE5FHDPFEAD5T4D/GIVUJ77KRNF4LOPGYJ6RS5/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.46.252.132 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a23-46-252-132.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: cbce85e96b7752208ce15a09ea4d5a58b792edc9e77f1c5ccf46c01935970f9d

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 78pdTWhYCcNLDObQ8lSzqsb8wIk9HFoE
Content-Encoding: gzip
ETag: "3996d65282dd996ee0d7d4c90c139158"
x-amz-request-id: 3E8F860749CFEAA3
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 635
x-amz-id-2: HufuHWENaXRzyAUINJrlOMMQCn0IPBRY28vw/AONTSS5wXm36ydW5JRnXBR8tnbcQxyDkuZ+VRg=
Last-Modified: Sun, 25 Oct 2020 08:37:15 GMT
Server: AmazonS3
Date: Mon, 26 Oct 2020 08:58:55 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
X-Akamai-Path-Stats: [1:11120:4294957176]

GET
H2

200

/ Show response
d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/
Redirect Chain

https://d.adroll.mgr.consensu.org/consent/iabcheck/7OBVBCAQE5FHDPFEAD5T4D?_s=1edc9f689b51be93a6fdbafa7a567fb9&_b=2
https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=1edc9f689b51be93a6fdbafa7a567fb9&_b=2

385 B
477 B

37ms
36ms

Script
application/javascript

99.81.127.175
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=1edc9f689b51be93a6fdbafa7a567fb9&_b=2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.81.127.175 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 9b0c4a0514d2f7619fc9273fdd6261152fd343c3ecfef7b7b4e29dfb958aa21d

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Mon, 26 Oct 2020 08:58:55 GMT
server: nginx/1.18.0
content-length: 385
content-type: application/javascript

Redirect headers

status: 302
date: Mon, 26 Oct 2020 08:58:55 GMT
server: nginx/1.18.0
content-length: 105
location: https://d.adroll.com/consent/check/7OBVBCAQE5FHDPFEAD5T4D/?_s=1edc9f689b51be93a6fdbafa7a567fb9&_b=2

GET
H/1.1 200
OK utsync.ashx Show response
ml314.com/ 644 B
1 KB 37ms
37ms Script
application/javascript 54.77.58.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=54820&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&pv=1603702735846_47d6avnli&bl=en-us&cb=5413954&return=&ht=&d=&dc=&si=1603702735846_47d6avnli&cid=&s=1600x1200&rp=
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?269
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.58.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-58-217.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 4156ed27f5edada8040e5f315bc3f7a1d701efa910060b95df3ec4d5def1346f

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 26 Oct 2020 08:58:55 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control: private
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 468
Expires: 0

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/ 2 KB
1 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:81a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/662878185/?random=1603702735874&cv=9&fst=1603702735874&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&tiba=Double%20Trouble%3A%20RevengeRAT%20and%20WSHRAT&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ec091cd729ce2970dfa6f6408c0c03e261b22a84a4c3439a36b735d83363a254

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1077
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/ 2 KB
2 KB 42ms
27ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/609297413/?random=1603702735878&cv=9&fst=1603702735878&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&tiba=Double%20Trouble%3A%20RevengeRAT%20and%20WSHRAT&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b4f03553697b0070e4e9bad0d2bf064a725e878c1c934d7cec377d5b78520e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Oct 2020 08:58:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1077
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK ibs:dpid=22052&dpuuid=3614090515462488139&redir=
dpm.demdex.net/ 42 B
915 B 41ms
40ms Image
image/gif 52.213.60.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3614090515462488139&redir=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.213.60.94 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-213-60-94.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v084-0e86d1d22.edge-irl1.demdex.com 5.78.2.20201014153347 0ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: Xf5GhLkfRGE=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://idsync.rlcdn.com/395886.gif?partner_uid=3614090515462488139
https://idsync.rlcdn.com/1000.gif?memo=CO6UGBIeChoIARCuXxoTMzYxNDA5MDUxNTQ2MjQ4ODEzORAAGg0Iz5_a_AUSBQjoBxAAQgBKAA
https://ml314.com/csync.ashx?fp=47b414d3498bd7c476d3f4b1ad705d17a52a975ee808952ee0af3d7b5fcac60ff4cb09cee1a4f8eb&person_id=3614090515462488139&eid=50082

43 B
312 B

36ms
36ms

Image
image/gif

54.77.58.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=47b414d3498bd7c476d3f4b1ad705d17a52a975ee808952ee0af3d7b5fcac60ff4cb09cee1a4f8eb&person_id=3614090515462488139&eid=50082
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.58.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-58-217.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 26 Oct 2020 08:58:55 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Tue, 27 Oct 2020 04:58:56 GMT

Redirect headers

date: Mon, 26 Oct 2020 08:58:55 GMT
via: 1.1 google
status: 307
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://ml314.com/csync.ashx?fp=47b414d3498bd7c476d3f4b1ad705d17a52a975ee808952ee0af3d7b5fcac60ff4cb09cee1a4f8eb&person_id=3614090515462488139&eid=50082
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=1df2f5b3-d777-4f2a-8ce1-8b6deba86f33
https://ml314.com/csync.ashx?fp=1df2f5b3-d777-4f2a-8ce1-8b6deba86f33&person_id=3614090515462488139&eid=53819

43 B
312 B

75ms
36ms

Image
image/gif

54.77.58.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=1df2f5b3-d777-4f2a-8ce1-8b6deba86f33&person_id=3614090515462488139&eid=53819
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.58.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-58-217.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 26 Oct 2020 08:58:55 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Tue, 27 Oct 2020 04:58:56 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 26 Oct 2020 08:58:55 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Location: https://ml314.com/csync.ashx?fp=1df2f5b3-d777-4f2a-8ce1-8b6deba86f33&person_id=3614090515462488139&eid=53819
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0,Tue, 27 Oct 2020 04:58:56 GMT

GET
H/1.1

200
OK

csync.ashx
ml314.com/
Redirect Chain

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3614090515462488139
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3614090515462488139
https://ml314.com/csync.ashx?fp=71eb7de2e3507d7919914a862dabf86a&eid=50146&person_id=3614090515462488139

43 B
312 B

59ms
37ms

Image
image/gif

54.77.58.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=71eb7de2e3507d7919914a862dabf86a&eid=50146&person_id=3614090515462488139
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.58.217 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-58-217.eu-west-1.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 26 Oct 2020 08:58:55 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 43
Expires: Tue, 27 Oct 2020 04:58:56 GMT

Redirect headers

pragma: no-cache
date: Mon, 26 Oct 2020 08:58:56 GMT
status: 302
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://ml314.com/csync.ashx?fp=71eb7de2e3507d7919914a862dabf86a&eid=50146&person_id=3614090515462488139
cache-control: no-cache
x-server: 10.45.16.8
content-length: 0
expires: 0

GET
H/1.1

200
OK

/
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif

0
344 B

24ms
23ms

Image
text/plain

3.120.214.218
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 3.120.214.218 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-120-214-218.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 26 Oct 2020 08:58:56 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location: /pixel/bounce/?pid=r8hrb20&t=gif
Date: Mon, 26 Oct 2020 08:58:56 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H2 200 /
www.google.com/pagead/1p-user-list/662878185/ 42 B
107 B 22ms
21ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/662878185/?random=1603702735874&cv=9&fst=1603699200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&tiba=Double%20Trouble%3A%20RevengeRAT%20and%20WSHRAT&async=1&fmt=3&is_vtc=1&random=803165283&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Oct 2020 08:58:56 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/662878185/ 42 B
107 B 20ms
20ms Image
image/gif 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/662878185/?random=1603702735874&cv=9&fst=1603699200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&tiba=Double%20Trouble%3A%20RevengeRAT%20and%20WSHRAT&async=1&fmt=3&is_vtc=1&random=803165283&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Oct 2020 08:58:56 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/609297413/ 42 B
519 B 42ms
27ms Image
image/gif 2a00:1450:4001:819::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/609297413/?random=1603702735878&cv=9&fst=1603699200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&tiba=Double%20Trouble%3A%20RevengeRAT%20and%20WSHRAT&async=1&fmt=3&is_vtc=1&random=2776202353&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:819::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Oct 2020 08:58:56 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/609297413/ 42 B
107 B 19ms
18ms Image
image/gif 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/609297413/?random=1603702735878&cv=9&fst=1603699200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaae1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&tiba=Double%20Trouble%3A%20RevengeRAT%20and%20WSHRAT&async=1&fmt=3&is_vtc=1&random=2776202353&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Oct 2020 08:58:56 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK consent_tcfv2.js Show response
s.adroll.com/j/ 396 KB
55 KB 43ms
42ms Script
application/javascript 23.46.252.132
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/consent_tcfv2.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.46.252.132 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a23-46-252-132.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 1e8c2c1c69e177db8aab839264b26577c44af29b75cc4edb25b5021b0b4538e3

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: RrXoTAgO8kW4lHaNUHggiN0CFoNQqBuA
Content-Encoding: gzip
ETag: "14827d9b396da2c054681d43b60bfefa"
x-amz-request-id: 76F12FA15BDAFC59
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
Vary: Accept-Encoding
x-amz-id-2: zH6QsAfGnIWSUTiEG9AqM5cTy1MrSMnyErTIXInSiqTQ6hRltipZOFWr9gLBHEbjf+I28kWOqw8=
Last-Modified: Wed, 21 Oct 2020 17:43:14 GMT
Server: AmazonS3
Date: Mon, 26 Oct 2020 08:58:56 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=300, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H/1.0 200
OK analytics Show response
pi.pardot.com/ 2 KB
2 KB 307ms
306ms Script
text/javascript 35.174.150.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=14084&account_id=873291&title=Double%20Trouble%3A%20RevengeRAT%20and%20WSHRAT&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&referrer=
Requested by: Host: pi.pardot.com
URL: https://pi.pardot.com/pd.js
Protocol: HTTP/1.0
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.150.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-3-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: 25cf3029abc1e4c0d4da2a9e190f6120cd73d7657ab3cc184732213f4447153a

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 26 Oct 2020 08:58:56 GMT
Content-Encoding: gzip
X-Pardot-Route: 13c7a24cfc43e49b0467af9964bf67ec
X-Pardot-LB: a083ac6fc1531fb089982e922db67d20
X-Pardot-Rsp: 16/2/82
Vary: Accept-Encoding,User-Agent
P3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Content-Length: 838
Server: PardotServer
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK favicon-32x32.png
nextroll.com/ 2 KB
2 KB 326ms
108ms Image
image/png 52.54.251.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nextroll.com/favicon-32x32.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.54.251.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-251-217.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 26 Oct 2020 08:58:56 GMT
Via: 1.1 vegur
Last-Modified: Thu, 15 Oct 2020 16:16:02 GMT
Server: Apache
Etag: "64f-5b1b7f6d77480"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1615

GET
H2 200 /
www.facebook.com/tr/ 44 B
146 B 6ms
5ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=177020962864941&ev=Microdata&dl=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&rl=&if=false&ts=1603702736334&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Double%20Trouble%3A%20%20RevengeRAT%20and%20WSHRAT%22%2C%22meta%3Akeywords%22%3A%22threat%20research%2CThreat%20Research%2Cmalware%20analysis%2CCybersecurity%20Architect%22%2C%22meta%3Adescription%22%3A%22Learn%20more%20about%20a%20new%20Revenge%20RAT%20sample%20recently%20captured%20in%20the%20wild%20by%20our%20FortiGuard%20Labs%20team.%20%22%7D&cd[OpenGraph]=%7B%22og%3Asite_name%22%3A%22Fortinet%20Blog%22%2C%22og%3Atitle%22%3A%22Double%20Trouble%3A%20%20RevengeRAT%20and%20WSHRAT%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample.html%22%2C%22og%3Atype%22%3A%22article%22%2C%22og%3Adescription%22%3A%22Learn%20more%20about%20a%20new%20Revenge%20RAT%20sample%20recently%20captured%20in%20the%20wild%20by%20our%20FortiGuard%20Labs%20team.%20%E2%80%A6%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fwww.fortinet.com%2Fcontent%2Fdam%2Ffortinet-blog%2Farticle-images%2Frevenge-rat%2Frevengerat-one.png%22%2C%22twitter%3Acard%22%3A%22summary%22%2C%22twitter%3Asite%22%3A%22%40Fortinet%22%2C%22article%3Aauthor%22%3A%22Chris%20Navarrete%20and%20Xiaopeng%20Zhang%22%2C%22article%3Asection%22%3A%22Threat%20Research%22%2C%22article%3Apublished_time%22%3A%222019-11-13T00%3A00%3A00.000-08%3A00%22%2C%22article%3Atag%22%3A%22Cybersecurity%20Architect%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.27&r=stable&ec=1&o=30&fbp=fb.1.1603702735826.963824337&it=1603702735723&coo=false&es=automatic&tm=3&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 26 Oct 2020 08:58:56 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 26 Oct 2020 08:58:56 GMT

GET
H/1.0 200
OK analytics Show response
go.fortinet.com/ 52 B
1 KB 478ms
173ms Script
text/javascript 35.174.150.168
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://go.fortinet.com/analytics?conly=true&visitor_id=36719395&visitor_id_sign=ae16deae3193d5d5ed511bc0536e50d7689af238c8ba1e50fc682253fea8cc540c755c2bc3a7c5c8a896c441292bdc113e5bbfe2&pi_opt_in=&campaign_id=14084&account_id=873291&title=Double%20Trouble:%20RevengeRAT%20and%20WSHRAT&url=https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample&referrer=
Requested by: Host: pi.pardot.com
URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=14084&account_id=873291&title=Double%20Trouble%3A%20RevengeRAT%20and%20WSHRAT&url=https%3A%2F%2Fwww.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample&referrer=
Protocol: HTTP/1.0
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.150.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-3-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: eca19fb64be166fabab688d0cdb2ae946d3370f8124ff0f3f18119cc2d4eb825

Request headers

Referer: https://www.fortinet.com/blog/threat-research/malware-analysis-revenge-rat-sample
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 26 Oct 2020 08:58:56 GMT
X-Pardot-Route: 13c7a24cfc43e49b0467af9964bf67ec
X-Pardot-LB: a083ac6fc1531fb089982e922db67d20
X-Pardot-Rsp: 16/51/79
Vary: User-Agent
P3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Content-Length: 52
Server: PardotServer
Expires: Thu, 19 Nov 1981 08:52:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s7.addthis.com
URL: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

196 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

23 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.fortinet.com/	1970-01-19 14:11:34	Name: omSeen-qxx1b0gslklfu2kjckea Value: 1603702735643
.fortinet.com/	1970-01-20 06:59:31	Name: AMCV_ED8739F75677FE917F000101%40AdobeOrg Value: 359503849%7CMCIDTS%7C18562%7CMCMID%7C09397731926264007873724032911323898227%7CMCAAMLH-1604307535%7C6%7CMCAAMB-1604307535%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1603709935s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18569%7CvVersion%7C5.0.1
www.fortinet.com/	1970-01-19 13:28:22	Name: _hjIncludedInSessionSample Value: 1
.fortinet.com/	1970-01-19 13:28:24	Name: _hjAbsoluteSessionInProgress Value: 0
www.fortinet.com/	1970-01-19 13:28:22	Name: _hjIncludedInPageviewSample Value: 1
.addthis.com/	1970-01-19 22:58:37	Name: loc Value: MDAwMDBFVUJFMDAyMzEwMTgzNjAwMDAwMDBDSA==
.fortinet.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.fortinet.com/	1970-01-19 15:37:58	Name: s_getNewRepeat Value: 1603702735571-New
.fortinet.com/	1970-01-19 13:28:24	Name: gpv_pn Value: www.fortinet.com%2Fblog%2Fthreat-research%2Fmalware-analysis-revenge-rat-sample
.fortinet.com/	1970-01-20 06:59:34	Name: s_ecid Value: MCMID%7C09397731926264007873724032911323898227
.fortinet.com/	1970-01-19 13:28:22	Name: _gat_gtag_UA_767980_1 Value: 1
www.fortinet.com/	1969-12-31 23:59:59	Name: cookiesession1 Value: 2C6411B9LFQ0O7VGBR4UCQEG00HS1390
www.fortinet.com/	1970-01-19 13:28:23	Name: _omappvs Value: 1603702735245
.fortinet.com/	1970-01-19 13:29:49	Name: _gid Value: GA1.2.2013261930.1603702735
.demdex.net/	1970-01-19 17:47:34	Name: demdex Value: 09763274553994976273686282242452160763
.fortinet.com/	1970-01-20 06:59:34	Name: _ga Value: GA1.2.45146499.1603702735
.addthis.com/	1970-01-19 22:58:37	Name: uvc Value: 1%7C44
www.fortinet.com/	1970-01-19 22:58:37	Name: __atuvc Value: 1%7C44
.fortinet.com/	1969-12-31 23:59:59	Name: _hjTLDTest Value: 1
.fortinet.com/	1970-01-19 22:13:58	Name: _hjid Value: b8fc25ae-0251-49fa-aa9e-64419b6de11f
www.fortinet.com/	1970-01-23 13:26:56	Name: _omappvp Value: sreLZVsQzrXyVRJduIhMl6R5DpgOfoffGI5p6HOUfaPbxVyT8dvpVcuWY65PzVNtBpWqrqHv9CUfnu9Ffq6b5HH6K3EIrBWs
.fortinet.com/	1969-12-31 23:59:59	Name: AMCVS_ED8739F75677FE917F000101%40AdobeOrg Value: 1
www.fortinet.com/	1970-01-19 13:28:24	Name: __atuvs Value: 5f968fce68840e7f000

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.omappapi.com
a.opmnstr.com
analytics.twitter.com
api.omappapi.com
assets.adobedtm.com
cm.everesttech.net
connect.facebook.net
d.adroll.com
d.adroll.mgr.consensu.org
dpm.demdex.net
fortinet.demdex.net
go.fortinet.com
googleads.g.doubleclick.net
idsync.rlcdn.com
in.hotjar.com
m.addthis.com
match.adsrvr.org
metrics.fortinet.com
ml314.com
nextroll.com
pi.pardot.com
ps.eyeota.net
px.ads.linkedin.com
s.adroll.com
s7.addthis.com
script.hotjar.com
site.fortinet.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
sync.crwdcntrl.net
t.co
v1.addthisedge.com
vars.hotjar.com
www.facebook.com
www.fortinet.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
z.moatads.com
s7.addthis.com
104.111.216.96
104.244.42.131
104.244.42.69
104.75.88.112
13.56.33.144
15.237.136.106
151.101.112.157
172.217.22.2
23.111.11.182
23.111.11.71
23.210.248.44
23.46.252.132
2620:1ec:22::14
2a00:1450:4001:802::2003
2a00:1450:4001:806::2008
2a00:1450:4001:808::2002
2a00:1450:4001:819::2004
2a00:1450:4001:81a::2002
2a00:1450:4001:824::2008
2a00:1450:4001:824::200e
2a02:26f0:2b00:982::1e80
2a02:26f0:eb:3a3::25ea
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:10:101::b93f:9105
3.120.214.218
34.120.207.148
34.242.246.49
34.245.253.34
35.174.150.168
52.213.60.94
52.51.30.82
52.54.251.217
54.74.233.68
54.77.58.217
65.9.57.21
65.9.57.71
65.9.57.77
65.9.57.82
66.117.28.86
96.45.36.159
99.81.127.175
0486530f1e98818865754a08e1b5442ac5a6a36a6bf6042e3b3338a532e998d2
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
06182b83bd033b6cda0e4e82b71d11a78d7e8b2641fe10109708664a2ca08760
0bfb81a6d3e2ed2e0cb381a9f933355ff00e64cd0d80724e83559861cad12711
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1240dad403c8c0dae31b46cf4219409e27275153dda4086c2dddc9d1ed42d131
132f25101b254611152002e28a0ee9049bccfc5a10e98fd7e5bfa956653abbd7
133debcec0026d79ced8d9d9504d6f95804410b4806b4b0b5f973f6ca529f5fb
137e41c449677deb7c8da3afde63fc781b095bb028f78b789be44192e8e3f4be
1b4f03553697b0070e4e9bad0d2bf064a725e878c1c934d7cec377d5b78520e8
1e8c2c1c69e177db8aab839264b26577c44af29b75cc4edb25b5021b0b4538e3
23190e1539469cc8b5faccb038b260ccda2cc62672c70efa1900a51a8e3d1be5
25cf3029abc1e4c0d4da2a9e190f6120cd73d7657ab3cc184732213f4447153a
2652081e4a7ba7f127db42258c27e8311e7840bbfaf1aa37f9a5c92f4934d9f9
27c7d95f98767a71d39b0b5b4dc4eb6874a7f3710e45db2da8585b4c0e37cfae
390a28be2ca4bcea5b71fe050295281a1a8fc99175690cdd62de378190400acb
4156ed27f5edada8040e5f315bc3f7a1d701efa910060b95df3ec4d5def1346f
4b70d151a449f1544c28524b9f77d78ed41e1fd8e6e6b4c54ad3ee1ff9b4a857
4bd60fc7b2e0c630d954762ccb91f3aeca0836fbf313776be1e664821921a529
504cb84b076d359d547193e04f2d82b90d79f7591c7218cad2fefda54a82ab02
50767a5dcab4f4ae0aa05bb3bf246815cb41da175707ac7a39c837ded7e89250
5474c8872e9ddf6d23aafbc1dd3d97580c3eb3cfaae5abccc6b110d680915756
5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba
5b4c9abcf01dcf74e0adf075ff4d47464c62c84307ae5ebd115d45da70e6443d
5d7fda52442588c5ae334e48512e3bab1c0a34ed25a9c8ec0c8afe15df3f51d0
5e2e52d5c75b1c0007b1d9ff02438734abce2e25d37dd68a1c132b53489e57cf
6071bd6cb72a22908968609c8f71c3a4c35d8a800167fd458542a32780445252
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
6154d5f7f6961e042d013bab33fd02b691970d873f44f3c32d8fcc6e79ef5bcd
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7ef0ff6db29fbb95501a2bbcbcb741474fa3cb3511009901a2fe7369084ae234
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
87b784071fc3dd6fbe9f0ed8362565d37f3d3eadc97acfda6ec9b9f628ff076f
925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8
97e95fcc66a29acfd27e371656c24da14947aace63dfa4db95fa8482f8bfb4bc
9a7f564316dc7303685d94451d6c9fc9dae613ec562b18a91c04ef32a63bd994
9b0c4a0514d2f7619fc9273fdd6261152fd343c3ecfef7b7b4e29dfb958aa21d
9b10abf6d444b80d370fa0641fa9cc25d353003d31ff60bbc60a9c37b84a9750
9d1b840480f23fb32f2a58063761424456b59f139d4609b5e7b0610dd2fc6237
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f
ab4780c284e32f34ae320f9c2420d2be6f9caeff7601f7668759ebc73db5536c
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2a69f81002746fb20a34679b10c764c2d5f664de10944230824289d55c38348
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355
c248f8404721d961fff789b4916e8b2f3ac975ffde32bb370374814712055d59
c7c2a637412317b9e13fd52b5ecff08eb1b5da60b3d66a2a5b8eff7eec182a84
c8db8c4bc51d0021afa5663a448a7fabfadd002c65ccef0752d256edf1d971f2
cbce85e96b7752208ce15a09ea4d5a58b792edc9e77f1c5ccf46c01935970f9d
cdebb9617bcda474bd09c07b66bf49608fc1606962c8e837bdd4124a552b6355
ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4
d223439f0a00d264eadf96d43a5245e291ff1504db055176eb8a3da4ef532cb4
d2afd46ac58cd7e89b3fdfd790300d69034e94151ed45acf83d7b6d5dccfdb17
d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32
d6df1bca3f52fafa22d16bb86bc71723212b30401ea887f94635bb855b2e4ca4
d7b144a39a2d1f833fd452dc44a83ea505f8946a426d177e2e99bc2efba44e48
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e22419e8154be2a34a950dbb4c4c448413751c53ef02f00c6c56af28aa2c4964
e37570ef85a3553930ba20dfab7280bfcead8a2238b536b5c03c629c35b3d4ca
e3921284615c40654c9e00e3c672b92a639096d4d3712274184344b371fbfda7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea7b8aff4830d0c5ca09b5e0f0567349323f48b73cef7c4fb77d48248979d16f
eb12a261a24e54883613710a4c12f4d9205f634ca1a29d1df07f90105a93e746
ec091cd729ce2970dfa6f6408c0c03e261b22a84a4c3439a36b735d83363a254
eca19fb64be166fabab688d0cdb2ae946d3370f8124ff0f3f18119cc2d4eb825
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f692ee03941001acfb64ab453b8ad134f6d8b8927d29ef586ef052d848878cfd
f7453f56f31ea4a02de5fa02b986a20224ff7463d7bdeb19810e6c4edd02a6e7
fc5b6932c605af2013fb5ad7fb59d30d267a8a7623c352d1fddffe88bfce84ea
fc8235bcff1ab60ad40f08a7f4e58ae704e86870207ec65b43906663e75c8f28

www.fortinet.com Open in urlscan Pro 13.56.33.144 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

84 Requests

99 %HTTPS

31 %IPv6

32 Domains

43 Subdomains

38 IPs

6 Countries

1511 kBTransfer

3980 kBSize

23 Cookies

11 Outgoing links

Page URL History

Redirected requests

84 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.fortinet.com Open in urlscan Pro
13.56.33.144 Public Scan

Screenshot
Live screenshot

Full Image

84
Requests

99 %
HTTPS

31 %
IPv6

32
Domains

43
Subdomains

38
IPs

6
Countries

1511 kB
Transfer

3980 kB
Size

23
Cookies

84 HTTP transactions
3 data transactions