Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
T:00:58:00 | Win2K-f | 173.45.91.154 (-): . |
n/a | US:www.maxmind.com US:www.getmyip.org :getmyip.co.uk US:checkip.dyndns.org US:67.15.94.80:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
01:01:00 | Win2K-f | 118.169.202.4 (-): . |
n/a | US:www.maxmind.com US:www.getmyip.org EU:checkip.dyndns.org US:67.15.94.80:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
T:01:28:00 | Win2K-f | 64.55.167.119 (XO.NET): XO COMMUNICATIONS, HOPKINTON, MASSACHUSETTS, US. |
n/a | US:www.maxmind.com US:www.getmyip.org :getmyip.co.uk :checkip.dyndns.org 208.78.68.70:80 US:67.15.94.80:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | dc331fb791 NEW |
none[3] | none:none |
UPX| | none | trace |
01:46:00 | Win2K-f | 173.45.91.154 (-): . |
n/a | US:www.maxmind.com :checkip.dyndns.org US:www.getmyip.org :getmyip.co.uk US:204.13.249.70:80 US:67.15.94.80:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
02:08:00 | Win2K-f | 67.95.199.5 (ALGX.NET): XO COMMUNICATIONS, SAN JOSE, CALIFORNIA, US. |
n/a | US:www.maxmind.com US:www.getmyip.org US:checkip.dyndns.org :getmyip.co.uk US:67.15.94.80:80 US:75.126.138.202:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
2 of 37 | d60e538e72 NEW |
none[3] | none:none |
UPX| | none | trace |
05:23:00 | Win2K-f | 94.76.206.159 (-): . |
n/a | US:www.maxmind.com US:www.getmyip.org EU:checkip.dyndns.org :getmyip.co.uk US:67.15.94.80:80 US:75.126.138.202:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
05:28:00 | Win2K-f | 64.55.167.119 (XO.NET): XO COMMUNICATIONS, HOPKINTON, MASSACHUSETTS, US. |
n/a | US:www.maxmind.com US:www.getmyip.org :checkip.dyndns.org :getmyip.co.uk US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | dc331fb791 NEW |
none[3] | none:none |
UPX| | none | trace |
T:05:38:00 | Win2K-f | 114.78.243.180 (-): . |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
35 of 40 36 of 40 |
2543dd1ec2 NEW a44c4d2b4b NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
06:06:00 | Win2K-f | 220.136.12.225 (HINET.NET): CHTD CHUNGHWA TELECOM CO. LTD, TAIPEI, T'AI-PEI, TW. |
n/a | US:www.maxmind.com US:www.getmyip.org :getmyip.co.uk :checkip.dyndns.org 208.78.68.70:80 US:67.15.94.80:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
T:06:25:00 | Win2K-f | 220.136.12.225 (HINET.NET): CHTD CHUNGHWA TELECOM CO. LTD, TAIPEI, T'AI-PEI, TW. |
n/a | US:www.maxmind.com US:www.getmyip.org :getmyip.co.uk US:checkip.dyndns.org US:67.15.94.80:80 US:75.126.138.202:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
07:34:00 | Win2K-f | 220.130.54.227 (HINET.NET): CHTD CHUNGHWA TELECOM CO. LTD, TAIPEI, T'AI-PEI, TW. |
n/a | US:www.maxmind.com EU:checkip.dyndns.org US:www.getmyip.org :getmyip.co.uk US:67.15.94.80:80 US:75.126.138.202:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
11:29:00 | Win2K-f | 186.0.9.255 (-): . |
n/a | US:www.maxmind.com :getmyip.co.uk US:www.getmyip.org :checkip.dyndns.org US:67.15.94.80:80 US:75.126.138.202:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
12:57:00 | Win2K-f | 187.40.53.185 (-): . |
n/a | US:www.maxmind.com :checkip.dyndns.org :getmyip.co.uk US:www.getmyip.org US:67.15.94.80:80 US:75.126.138.202:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
14:08:00 | Win2K-f | 123.49.42.151 (123.IN-ADDR.ARPA): BTTB, BD. |
n/a | US:www.maxmind.com US:checkip.dyndns.org :getmyip.co.uk US:www.getmyip.org US:67.15.94.80:80 US:75.126.138.202:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
T:14:08:00 | Win2K-f | 123.49.42.151 (123.IN-ADDR.ARPA): BTTB, BD. |
n/a | US:www.maxmind.com EU:checkip.dyndns.org :getmyip.co.uk US:www.getmyip.org 208.78.69.70:80 US:67.15.94.80:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
14:15:00 | Win2K-f | 81.56.168.144 (PROXAD.NET): PROXAD / FREE SAS, PARIS, ILE-DE-FRANCE, FR. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org US:www.getmyip.org :getmyip.co.uk 208.78.68.70:80 US:67.15.94.80:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
T:14:22:00 | Win2K-f | 220.128.128.86 (HINET.NET): CHTD CHUNGHWA TELECOM CO. LTD, TW. |
n/a | US:www.maxmind.com :checkip.dyndns.org US:64.246.48.99:666 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
15:14:00 | Win2K-f | 173.45.90.155 (-): . |
n/a | US:www.maxmind.com :getmyip.co.uk US:checkip.dyndns.org US:www.getmyip.org US:67.15.94.80:80 US:75.126.138.202:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
T:15:22:00 | Win2K-f | 173.29.140.48 (-): . |
n/a | US:www.maxmind.com EU:checkip.dyndns.org US:www.getmyip.org :getmyip.co.uk 208.78.69.70:80 US:67.15.94.80:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
2 of 37 | d60e538e72 NEW |
none[3] | none:none |
UPX| | none | trace |
T:15:35:00 | Win2K-f | 212.72.182.106 (EKB-KIESERLING.DE): ARTFILES NEW MEDIA GMBH, HAMBURG, HAMBURG, DE. |
n/a | US:www.maxmind.com :checkip.dyndns.org US:www.getmyip.org :getmyip.co.uk 208.78.68.70:80 US:67.15.94.80:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
15:36:00 | Win2K-f | 212.72.182.106 (EKB-KIESERLING.DE): ARTFILES NEW MEDIA GMBH, HAMBURG, HAMBURG, DE. |
n/a | US:www.maxmind.com :checkip.dyndns.org US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
15:40:00 | Win2K-f | 190.51.236.101 (COM.AR): TELEFONICA DE ARGENTINA, AR. |
n/a | US:www.maxmind.com US:www.getmyip.org US:checkip.dyndns.org :getmyip.co.uk US:67.15.94.80:80 US:75.126.138.202:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
T:15:58:00 | Win2K-f | 123.204.153.223 (SEED.NET.TW): DIGITAL UNITED INC, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:www.maxmind.com US:www.getmyip.org EU:checkip.dyndns.org :getmyip.co.uk 208.78.69.70:80 US:67.15.94.80:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
16:48:00 | Win2K-f | 78.111.96.202 (APEXCOVANTAGE.COM): EU-ZZ, UK. |
n/a | US:www.maxmind.com US:www.getmyip.org :checkip.dyndns.org :getmyip.co.uk US:67.15.94.80:80 US:75.126.138.202:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
7 of 37 | 7587773eea NEW |
none[3] | none:none |
StarForce| | none | trace |
T:16:54:00 | WinXP | 70.70.29.246 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, CHILLIWACK, BRITISH COLUMBIA, CA. (DSL) |
n/a | CN:proxim.ircgalaxy.pl RU:citi-bank.ru 114.80.101.21:80 |
445 | pcap | raw alerts ruleset |
http irc 3 lines |
Yeah : 0.8 profile |
none | summary tarball |
34 of 36 | 58daa6ab61 NEW |
none[none] | none:none |
none|none | none | none |
T:17:06:00 | Win2K-f | 189.28.177.42 (BRASILTELECOM.NET.BR): COMITE GESTOR DA INTERNET NO BRASIL, BR. |
n/a | US:www.maxmind.com :checkip.dyndns.org :getmyip.co.uk US:www.getmyip.org 208.78.69.70:80 US:67.15.94.80:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
9 of 37 | 156dd59d9a NEW |
none[3] | none:none |
UPX| | none | trace |
17:11:00 | Win2K-f | 200.82.38.1 (NET.AR): APOLO -GOLD-TELECOM-PER, BUENOS AIRES, BUENOS AIRES, AR. |
n/a | US:www.maxmind.com US:www.getmyip.org :getmyip.co.uk US:checkip.dyndns.org 208.78.68.70:80 US:67.15.94.80:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
7 of 37 | 7587773eea NEW |
none[3] | none:none |
StarForce| | none | trace |
17:21:00 | Win2K-f | 84.41.57.217 (KABELNET.NET): ANSAT D.O.O, SI. |
n/a | US:www.maxmind.com :getmyip.co.uk EU:checkip.dyndns.org US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | dc331fb791 NEW |
none[3] | none:none |
UPX| | none | trace |
17:33:00 | Win2K-f | 189.28.177.42 (BRASILTELECOM.NET.BR): COMITE GESTOR DA INTERNET NO BRASIL, BR. |
n/a | US:www.maxmind.com US:www.getmyip.org :getmyip.co.uk :checkip.dyndns.org US:67.15.94.80:80 US:75.126.138.202:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
18:28:00 | Win2K-f | 190.188.239.146 (NET.AR): PRIMA S.A, AR. |
n/a | US:www.maxmind.com :getmyip.co.uk US:www.getmyip.org :checkip.dyndns.org US:67.15.94.80:80 US:75.126.138.202:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | dc331fb791 NEW |
none[3] | none:none |
UPX| | none | trace |
T:19:11:00 | Win2K-f | 118.232.27.253 (-): . |
n/a | US:www.maxmind.com US:checkip.dyndns.org US:www.getmyip.org :getmyip.co.uk 208.78.69.70:80 US:64.246.48.99:666 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 4 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
19:39:00 | Win2K-f | 200.45.194.2 (NET.AR): MIDAS-TELECOM, AR. |
n/a | US:www.maxmind.com US:www.getmyip.org :getmyip.co.uk EU:checkip.dyndns.org US:67.15.94.80:80 US:75.126.138.202:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
7 of 37 | 507252387e NEW |
none[3] | none:none |
UPX| | none | trace |
T:19:48:00 | Win2K-f | 78.111.96.202 (APEXCOVANTAGE.COM): EU-ZZ, UK. |
n/a | US:www.maxmind.com :getmyip.co.uk :checkip.dyndns.org US:www.getmyip.org 208.78.69.70:80 US:67.15.94.80:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
7 of 37 | 7587773eea NEW |
none[3] | none:none |
StarForce| | none | trace |
21:50:00 | Win2K-f | 200.71.98.112 (TELESAT.COM.CO): COLDECON, CALI, VALLE DEL CAUCA, CO. |
n/a | US:www.maxmind.com US:www.getmyip.org :getmyip.co.uk :checkip.dyndns.org US:67.15.94.80:80 US:75.126.138.202:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
T:21:56:00 | Win2K-f | 94.102.7.53 (-): . |
n/a | US:www.maxmind.com :getmyip.co.uk US:www.getmyip.org US:checkip.dyndns.org 208.78.69.70:80 US:67.15.94.80:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
22:01:00 | Win2K-f | 94.102.7.53 (-): . |
n/a | US:www.maxmind.com EU:checkip.dyndns.org US:www.getmyip.org :getmyip.co.uk 208.78.68.70:80 US:67.15.94.80:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
22:37:00 | Win2K-f | 118.232.20.254 (-): . |
n/a | US:www.maxmind.com :getmyip.co.uk US:www.getmyip.org :checkip.dyndns.org US:67.15.94.80:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |