Cluster O

93 samples (WinXP (100%))


Ports
InfectionEgg-downloadUpload
445 (69%)1032 (61%)
1031 (39%)		1032 (61%)
1031 (39%)
Filenames
ProcessesExecutables
LOGONUI.EXE (100%)
MSMSGS.EXE (100%)

random 5/6/7/8
character filename		ftpupd.exe (100%)

random 5/6/7/8
character filename
Registry keys
...Microsoft\Wireless (100%)

full list

Snort IDs
1:2000032 (100%)
1:2000033 (100%)
1:2001683 (100%)
1:2466 (100%)
1:3000000 (100%)
1:3000003 (100%)

full list

Static analysis
MD5Antivirus labels
7d99b0... (42%)
a0139d... (14%)
3ae357... (12%)
1fcc14... (6%)
986b59... (5%)
d6df39... (5%)

diversity: 19.4%

full list

korgo (100%)
padobot (99%)
lsabot (98%)
paradrop (22%)