Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

PUBLIC PAGE

<Click here: to download BotHunter>

26 September 2009
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:32:00 WinXP 96.48.251.154 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SURREY, BRITISH COLUMBIA, CA. (DSL) n/a 135 pcap raw alerts
ruleset other
458 lines Yeah : 1.3
profile none summary
tarball 38 of 41 88d0adb0e6
NEW 69756b9676 [0] none:none
Armadillo| none trace

T:01:09:00 WinXP 203.96.11.30 (GLOBAL-GATEWAY.NET.NZ):
NZGATE AGGREGATE NETWORKS,
AUCKLAND, AUCKLAND, NZ. (DSL) 213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 40 of 41 0f00f88a4c
NEW a4764f38a7 [0] none:none
PolyEnE| none trace

T:01:21:00 WinXP 188.193.126.234 (SUPERKABEL.DE):
KABEL-DEUTSCHLAND-CUSTOMER-SERVICES,
DE. (DSL) 66.252.13.214:2081 US:s.unicat.org 445 pcap raw alerts
ruleset ftp
irc
33 lines Yeah : 1.3
profile none summary
tarball 37 of 41 67a66839f7
NEW 7b1fc808a3 [0] none:none
none|none none trace

T:01:39:00 WinXP 98.141.17.72 (CAVTEL.NET):
CAVALIER TELEPHONE,
HAMPTON, VIRGINIA, US. (DSL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:01:54:00 WinXP 93.148.223.22 (DSL.VODAFONE.IT):
IP ADDRESSES ALLOCATED TO DSL CUSTOMERS,
GENOA, LIGURIA, IT. (DSL) n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 36 of 41 1a1d4bfca9
NEW fb72032c4b [0] none:none
Stranik| none trace

T:02:32:00 WinXP 24.85.50.32 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 37 of 40
38 of 40 2721d2b151
NEW
b044168966
NEW fde14d4abe [0]
b02ac1f831[0]
b02ac1f831[0] none:none
none:none
Armadillo|
tElock| none
none trace
trace

T:03:14:00 WinXP 83.68.71.143 (TNP.PL):
TELENETCENTRUM-NET,
WARSAW, WARSZAWA, PL. (DSL) 213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 32 of 32 5818023061
NEW none [0] ASM:Graph
PolyEnE| lines=68 trace

T:04:18:00 WinXP 24.48.131.45 (USA2NET.NET):
FLORIDA CABLE INC,
US. (DSL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:05:48:00 WinXP 202.163.160.216 (TCNET.NE.JP):
TONAMI INTERNET SERVICE(TONAMI TRANSPORTATIONCO. LTD.),
JP. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 40 of 41 57ef739a9e
NEW fbdf9f6053 [0] none:none
none|none none trace

T:06:33:00 WinXP 82.54.185.3 (RETAIL.TELECOMITALIA.IT):
TELECOM ITALIA S.P.A. TIN EASY LITE,
PADOVA, VENETO, IT. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
12 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:06:40:00 Win2K-f 114.36.214.143 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) 66.252.13.214:2081 US:s.unicat.org 445 pcap raw alerts
ruleset ftp
irc
30 lines Yeah : 1.3
profile none summary
tarball 35 of 41 aab88c1c51
NEW cf93cc0212 [0] none:none
none|none none trace

T:07:18:00 Win2K-f 125.58.94.139 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, TOKYO, JP. (DSL) 92.240.234.164:3305 :cx10man.weedns.com 135 pcap raw alerts
ruleset irc
603 lines Yeah : 1.8
profile none summary
tarball 39 of 41 dba298277c
NEW e499a208a6 [0] none:none
StarForce| none trace

T:07:38:00 Win2K-f 121.121.141.60 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a CZ:qtas.net
CZ:mi.thelive-photo.com
US:immmsn.info 445 pcap raw alerts
ruleset http
44 lines Yeah : 0.8
profile none summary
tarball 16 of 41 881ae35d5c
NEW 528f6cdd14 [0] none:none
FASM| none trace

T:07:49:00 WinXP 94.153.162.168 (KYIVSTAR.NET):
UA-KYIVSTAR,
KIEV, KYYIV, UA. (DSL) n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 21 of 41 7a9197cbce
NEW none [4] none:none
PolyEnE| none trace

T:08:42:00 Win2K-f 71.127.246.59 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
RED BANK, NEW JERSEY, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
89 lines Yeah : 1.3
profile none summary
tarball 33 of 33
38 of 41 53bfe15e91
NEW
5a3c22be2f
NEW 1473091351 [0]
e0aed91229[0]
e0aed91229[0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
none trace
trace

T:09:02:00 WinXP 75.47.165.149 (SBCGLOBAL.NET):
AT&T INTERNET SERVICES,
LOS ANGELES, CALIFORNIA, US. (DSL) n/a EU:siliconfireware.ru
GB:welcome3.smile.co.uk
:wpad
GB:195.92.84.198:80
DE:212.227.111.29:80
EU:78.47.200.154:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
NEW none [0] none:none
ASPack| lines=281
embedded dns trace

T:09:06:00 WinXP 118.87.20.81 (ODWR.J-CNET.JP):
ODAWARA CABLETV INTERNET SERVICE,
ODAWARA, KANAGAWA, JP. (DSL) n/a :xx.enterhere.biz
:xx.nadnadzz.info 135 pcap raw alerts
ruleset other
332 lines Yeah : 1.3
profile none summary
tarball 38 of 41 820b27d4c6
NEW 1102de0215 [0] none:none
Armadillo| none trace

T:09:19:00 Win2K-f 220.131.171.82 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) 66.252.13.214:2081 US:s.unicat.org 445 pcap raw alerts
ruleset ftp
irc
27 lines Yeah : 1.3
profile none summary
tarball 39 of 41 06ef44511e
NEW f70bd5a7e5 [0] none:none
none|none none trace

T:09:50:00 WinXP 87.62.253.62 (DSL.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
HERNING, RINGKOBING, DK. (DSL) 213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 41 of 41 b26ed6eeac
NEW 97c1157bf8 [0] none:none
PolyEnE| none trace

T:09:52:00 Win2K-f 98.141.163.84 (CAVTEL.NET):
CAVALIER TELEPHONE,
PHILADELPHIA, PENNSYLVANIA, US. (DSL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:10:34:00 WinXP 72.187.130.172 (RR.COM):
ROAD RUNNER HOLDCO LLC,
TAMPA, FLORIDA, US. (100Mbps) n/a RU:citi-bank.ru
RU:213.219.245.212:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 9d8ec60aeb
NEW 97d170c714 [0] none:none
PolyEnE| none trace

T:10:43:00 WinXP 83.92.147.243 (DSL.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
COPENHAGEN, KOBENHAVN, DK. (DSL) n/a RU:citi-bank.ru
RU:213.219.245.212:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 1fcc146d70
NEW none [0] none:none
PolyEnE| lines=68 trace

T:12:17:00 WinXP 63.28.80.62 (UU.NET):
UUNET TECHNOLOGIES INC,
WINCHESTER, VIRGINIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:12:41:00 WinXP 76.177.75.149 (RR.COM):
ROAD RUNNER HOLDCO LLC,
LONDON, KENTUCKY, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:13:48:00 Win2K-f 172.163.138.42 (AOL.COM):
AMERICA ONLINE,
US. (DIAL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:14:23:00 Win2K-f 69.193.78.147 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:15:34:00 WinXP 75.43.208.109 (SBCGLOBAL.NET):
AT&T INTERNET SERVICES,
PASADENA, CALIFORNIA, US. (DSL) n/a DE:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
GB:welcome3.smile.co.uk
:wpad
GB:195.92.84.198:80 445 pcap raw alerts
ruleset http
http
http
19 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
NEW none [0] none:none
ASPack| lines=281
embedded dns trace

T:19:05:00 WinXP 76.177.215.165 (RR.COM):
ROAD RUNNER HOLDCO LLC,
WINCHESTER, KENTUCKY, US. (DSL) n/a RU:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 38 of 41 b0f5cdb8a4
NEW f1b4a841e9 [0] none:none
PolyEnE| none trace

T:19:27:00 WinXP 122.49.246.145 (CCNET-AI.NE.JP):
COMMUNITY NETWORK CENTER INC,
TOYOKAWA, AICHI, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 0 of 32
33 of 33 07fabc79ef
NEW
53bfe15e91
NEW none[0]
1473091351[0]
1473091351[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=81
lines=75
embedded dns trace
trace

T:20:30:00 WinXP 122.106.6.78 (OPTUSNET.COM.AU):
OPTUS INTERNET - RETAIL,
SYDNEY, NEW SOUTH WALES, AU. (DSL) n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none [0] none:none
PolyEnE| lines=68 trace

T:21:43:00 WinXP 190.209.40.215 (-):
TELMEX CHILE S.A HFC,
SANTIAGO, REGION METROPOLITANA, CL. (DSL) n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 40 of 41 dcc4d7f9bb
NEW f63727b2f4 [0] none:none
PolyEnE| none trace

T:22:27:00 Win2K-f 173.16.120.174 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
FRANKLIN, NORTH CAROLINA, US. (DSL) 200.49.145.197:3305 FI:cx10man.weedns.com
TH:fx010413.whyI.org
AR:gynoman.weedns.com
FI:g.0x20.biz
92.240.234.164:3305 135 pcap raw alerts
ruleset irc
713 lines Yeah : 1.8
profile none summary
tarball 31 of 41 cc88f4f016
NEW 3d17903825 [0] none:none
StarForce| none trace

T:22:47:00 Win2K-f 4.188.205.185 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
GRANT PARK, ILLINOIS, US. (DSL) n/a 135 pcap raw alerts
ruleset other
291 lines Yeah : 1.3
profile none summary
tarball 38 of 41 5ae3290323
NEW c23bccc06a [0] none:none
PolyEnE| none trace