Cluster M
107 samples (Win2K-f (100%))
Ports
Infection
Listen
Upload
445 (100%)
135 (100%)
500 (100%)
1026 (100%)
44445 (100%)
44445 (100%)
Snort IDs
1:2000032 (100%)
1:2000046 (100%)
1:2466 (100%)
1:3000004 (100%)
1:99906 (100%)
Network chatter
FTP
user=a (100%)
pass=a (88%)
server=WinFtpd 1.2 (69%)
exec=resource32w.exe (56%)
Static analysis
MD5
diversity: N/A
