Score: 0.8 (>= 0.8) Infected Target: 130.107.199.1 Infector List: 89.207.69.38 Egg Source List: C & C List: 210.245.211.11 Peer Coord. List: Resource List: Observed Start: 08/20/2008 03:26:24.504 PDT Report End: 08/20/2008 03:26:25.509 PDT Gen. Time: 08/20/2008 03:28:26.526 PDT INBOUND SCAN EXPLOIT 89.207.69.38 (9) (03:26:24.504 PDT-03:26:25.509 PDT) event=1:22000032 {tcp} E2[rb] BLEEDING-EDGE EXPLOIT LSA exploit 445<-51640 (03:26:25.509 PDT) ------------------------- event=1:22466 {tcp} E2[rb] NETBIOS SMB-DS IPC$ unicode share access 445<-51640 (03:26:24.504 PDT) ------------------------- event=1:292000032 (2) {tcp} E2[rb] BotHunter EXPLOIT LSA exploit 2: 445<-51640 (03:26:25.509 PDT-03:26:25.509 PDT) ------------------------- event=1:299906 (5) {tcp} E2[rb] SHELLCODE x86 0x90 unicode NOOP 5: 445<-51640 (03:26:25.257 PDT-03:26:25.509 PDT) EXPLOIT (slade) EGG DOWNLOAD C and C TRAFFIC 210.245.211.11 (03:28:26.526 PDT) event=1:2003603 {tcp} E4[rb] ET TROJAN W32.Virut.A joining an IRC Channel 1028->65520 (03:28:26.526 PDT) PEER COORDINATION OUTBOUND SCAN ATTACK PREP DECLARE BOT tcpslice 1219227984.504 1219227985.510 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 130.107.199.1' ============================== SEPARATOR ================================