Score: 1.3 (>= 0.8) Infected Target: 130.107.206.166 Infector List: 125.0.239.62 Egg Source List: 125.0.239.62 C & C List: Peer Coord. List: Resource List: Observed Start: 05/19/2008 00:40:15.836 PDT Report End: 05/19/2008 00:40:18.275 PDT Gen. Time: 05/19/2008 00:40:22.773 PDT INBOUND SCAN EXPLOIT 125.0.239.62 (7) (00:40:15.836 PDT-00:40:18.275 PDT) event=1:2001056 {tcp} E2[rb] BLEEDING-EDGE VIRUS W32/Sasser.worm.b -NAI-) 1033<-3232 (00:40:21.081 PDT) ------------------------- event=1:2466 (2) {tcp} E2[rb] NETBIOS SMB-DS IPC$ unicode share access 445<-3033 (00:40:15.836 PDT) 445<-3097 (00:40:17.842 PDT) ------------------------- event=1:99913 (4) {tcp} E2[rb] SHELLCODE x86 0x90 unicode NOOP 2: 445<-3097 (00:40:18.273 PDT-00:40:18.275 PDT) 2: 445<-3033 (00:40:16.279 PDT-00:40:16.281 PDT) EXPLOIT (slade) EGG DOWNLOAD 125.0.239.62 (2) (00:40:19.766 PDT) event=1:2000047 {tcp} E3[rb] BLEEDING-EDGE VIRUS Sasser Transfer _up.exe 9996<-3157 (00:40:19.766 PDT) ------------------------- event=1:3000004 {tcp} E3[rb] BotHunter Scrip-based Windows egg download .exe 9996->3157 (00:40:19.910 PDT) C and C TRAFFIC PEER COORDINATION OUTBOUND SCAN 125.0.239.62 (00:40:22.773 PDT) event=555:5555005 {tcp} E5[sc] scade detected scanning of 21 IPs (fail ratio=0:1/21): 0->0 (00:40:22.773 PDT) 66.87.106.53 (00:40:22.773 PDT) event=1:2001569 {tcp} E5[rb] BLEEDING-EDGE Behavioral Unusual Port 445 traffic, Potential Scan or Infection 1085->445 (00:40:22.773 PDT) ATTACK PREP DECLARE BOT tcpslice 1211182815.836 1211182818.276 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 130.107.206.166' ============================== SEPARATOR ================================