Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

29 July 2009
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:25:00 Win2K-f 4.226.225.15 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
BANDERA, TEXAS, US. (DIAL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:01:05:00 WinXP 124.195.59.78 (-):
PT INDOSAT TBK,
ID. n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 41 77f827fe3d
NEW 0450c8318a [0] none:none
PolyEnE| none trace

T:01:46:00 WinXP 118.87.18.132 (-):
. n/a US:microsoft.com 135 pcap raw alerts
ruleset other
122 lines Yeah : 1.3
profile none summary
tarball 32 of 36
34 of 36 0b951c2832
NEW
e4ed4df0f0
NEW 5fe761661a [0]
de471fc380[0] none:none
none:none
Armadillo|
tElock| none
none trace
trace

T:02:15:00 Win2K-f 216.9.145.92 (-):
NEW CONCEPTS COMMUNICATIONS INC,
LINTON, INDIANA, US. 67.43.236.67:10324 CA:xx.nadnadzz.info
:nadsamcabran12.com 135 pcap raw alerts
ruleset irc
http
571 lines Yeah : 1.8
profile none summary
tarball 25 of 41
32 of 38
27 of 32 47d76e8dce
NEW
524bc0f75c
NEW
d00b0ae77c
NEW 457779e597 [0]
d3e9510bb3[0]
423a668612[0] none:none
none:none
none:none
Neolite|
PENinja S|
Armadillo| none
none
none trace
trace
trace

T:02:16:00 WinXP 173.19.219.214 (-):
. n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 41
38 of 41 2d5fe9850a
NEW
63b64adf8b
NEW 2233a191b2 [0]
b4e67ccf8a[0] none:none
none:none
tElock|
Armadillo| none
none trace
trace

T:03:28:00 WinXP 193.219.119.92 (-):
S.C.TORO ELECTRONIC SRL,
RO. 213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 40 of 41 119ec42aa0
NEW fd3c61c261 [0] none:none
PolyEnE| none trace

T:03:44:00 Win2K-f 118.221.36.99 (-):
. 221.5.74.39:65520 CN:proxim.ircgalaxy.pl
US:microsoft.com
CN:put.ghura.pl
IL:xt67ur.wwlax.com
IL:bugreport.waverevenue.com
CN:brenz.pl
IL:xul93.pubdomainstr.com
CN:lometr.pl
CN:tayforlive.ru
IL:rec.bestrevenue.net
:onuka.cn
CN:218.93.205.24:65520
97.74.67.227:80 135 pcap raw alerts
ruleset irc
http
154 lines Yeah : 1.8
profile none summary
tarball 19 of 41
28 of 41
38 of 40
27 of 41
5 of 41
38 of 40
30 of 41 176f4e0237
NEW
6648e7022b
NEW
66863cfb13
NEW
6f8772fb4c
NEW
d06d0f7c93
NEW
e8dfca0741
NEW
fd2814ef63
NEW 971b66b4c6 [0]
0ad0f97bcc[0]
fca240f318[0]
72c4861af2[0]
5ab57bf0dc[0]
20dfd2147c[0]
53d312e1c4[0] none:none
none:none
none:none
none:none
none:none
none:none
none:none
none|none
UPX|
Armadillo|
UPX|
Xtreme-Pr|
tElock|
none|none none
none
none
none
none
none
none trace
trace
trace
trace
trace
trace
trace

T:06:41:00 WinXP 124.66.254.235 (FCH.NE.JP):
FUREAI CHANNEL INC,
HIROSHIMA, HIROSHIMA, JP. 213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 41 of 41 a769511504
NEW 7ecd054f18 [0] none:none
PolyEnE| none trace

T:07:06:00 WinXP 118.223.162.86 (-):
. n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 39 of 41
3 of 41 29546fd87c
NEW
e17e2834ac
NEW 2665d1ed69 [0]
abf684db50[0] none:none
none:none
tElock|
Armadillo| none
none trace
trace

T:07:08:00 WinXP 24.79.163.124 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
EDMONTON, ALBERTA, CA. (DSL) 221.5.74.39:65520 CN:proxim.ircgalaxy.pl
CN:brenz.pl
CN:lometr.pl 445 pcap raw alerts
ruleset http
irc
19 lines Yeah : 1.3
profile none summary
tarball 19 of 41
9 of 41
14 of 41
37 of 39 176f4e0237
NEW
1da3a4f356
NEW
a036b3aec2
NEW
dab4da4e21
NEW 971b66b4c6 [0]
1ef0af6554[0]
none [4]
e63b813015[0] none:none
none:none
none:none
ASM:Graph
none|none
Armadillo|
none|none
PolyEnE| none
none
none
lines=134 trace
trace
trace
trace

T:08:07:00 WinXP 4.137.192.23 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
CHARLOTTE, NORTH CAROLINA, US. (DIAL) n/a 135 pcap raw alerts
ruleset other
65 lines Yeah : 1.3
profile none summary
tarball 0 of 33 a08f3b74a4
NEW none[0] none:none
Armadillo| lines=90 trace

T:08:23:00 Win2K-f 61.215.129.213 (CABLENET.NE.JP):
CABLENET SAITAMA CO. LTD,
TOKYO, TOKYO, JP. (DSL) 72.10.172.211:8080 CA:xx.ka3ek.com
:nadsamcabran12.com 135 pcap raw alerts
ruleset irc
http
277 lines Yeah : 1.8
profile none summary
tarball 25 of 41
32 of 38
31 of 33 47d76e8dce
NEW
524bc0f75c
NEW
954a98c971
NEW 457779e597 [0]
d3e9510bb3[0]
cdd769f7a4[0] none:none
none:none
none:none
Neolite|
PENinja S|
FSG| none
none
none trace
trace
trace

T:08:48:00 WinXP 92.114.192.48 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 218.93.205.24:65520 CN:proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset http
irc
3 lines Yeah : 1.3
profile none summary
tarball 37 of 39 dab4da4e21
NEW e63b813015 [0] ASM:Graph
PolyEnE| lines=134 trace

T:08:53:00 Win2K-f 130.13.211.16 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. 61.120.62.28:3305 GB:cx10man.weedns.com 135 pcap raw alerts
ruleset shell
ftp
irc
23 lines Yeah : 1.8
profile none summary
tarball 28 of 41 b8076e37ae
NEW 52953fed05 [0] none:none
StarForce| none trace

T:09:05:00 WinXP 207.5.196.113 (SUSCOM-MAINE.NET):
GREAT WORKS INTERNET,
BRUNSWICK, MAINE, US. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:09:10:00 WinXP 12.215.122.116 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
OTTAWA, ILLINOIS, US. (100Mbps) n/a RU:citi-bank.ru
RU:213.219.245.212:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:09:30:00 Win2K-f 125.4.240.60 (ZAQ.NE.JP):
KITAKAWACHI CABLE NET CO LTD,
JP. 67.43.236.67:10324 CA:xx.nadnadzz.info
NL:xx.sqlteam.info
:xx.enterhere.biz
CA:67.43.236.67:10324
NL:83.68.16.6:5190 135 pcap raw alerts
ruleset other
251 lines Yeah : 1.8
profile none summary
tarball 39 of 41 86c31a45fe
NEW 8663930785 [0] none:none
none|none none trace

T:11:18:00 WinXP 85.85.169.179 (CLIENTES.EUSKALTEL.ES):
EUSKALTEL,
ES. 221.5.74.39:65520 CN:proxim.ircgalaxy.pl
CN:brenz.pl
CN:lometr.pl
CN:218.93.205.24:65520 445 pcap raw alerts
ruleset http
irc
29 lines Yeah : 1.3
profile none summary
tarball 19 of 41
35 of 36
8 of 39 176f4e0237
NEW
7fd7475c63
NEW
b28099b772
NEW 971b66b4c6 [0]
8dcf239714[0]
d43389c576[0] none:none
none:none
none:none
none|none
PolyEnE|
Armadillo| none
none
none trace
trace
trace

T:12:26:00 WinXP 91.148.103.127 (BEOTEL.NET):
BEOTELNET ISP,
CS. (DSL) n/a RU:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 40 of 40 824d6a706e
NEW a66fd13bcb [0] none:none
PolyEnE| none trace

T:13:39:00 WinXP 4.183.140.143 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
ST. PETERSBURG, FLORIDA, US. (DIAL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
85 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:14:53:00 Win2K-f 63.17.194.209 (UU.NET):
UUNET TECHNOLOGIES INC,
US. n/a 135 pcap raw alerts
ruleset other
1008 lines Yeah : 1.3
profile none summary
tarball 7 of 41 b1f58ef783
NEW none[3] none:none
none|none none trace

T:15:38:00 WinXP 173.168.253.0 (-):
. n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:16:15:00 Win2K-f 76.185.10.241 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:16:36:00 WinXP 24.103.196.250 (-):
. 83.68.16.6:5190 67.43.236.67:10324 72.10.172.211:8080 NL:xx.sqlteam.info
CA:xx.ka3ek.com
CA:xx.nadnadzz.info
:xx.enterhere.biz
CA:67.43.226.242:8080
CA:67.43.236.66:8080
CA:67.43.236.67:10324
CA:72.10.172.211:8080
NL:83.68.16.6:5190 135 pcap raw alerts
ruleset other
345 lines Yeah : 1.8
profile none summary
tarball 37 of 40 a0a15f5ebf
NEW c506c7cc86 [0] none:none
Mew| none trace

T:18:34:00 WinXP 173.171.242.179 (-):
. n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:19:07:00 WinXP 67.125.140.230 (PACBELL.NET):
AT&T INTERNET SERVICES,
FRESNO, CALIFORNIA, US. n/a US:microsoft.com 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:20:07:00 Win2K-f 71.148.35.37 (SBCGLOBAL.NET):
KASSA KASSA,
PLANO, TEXAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:20:21:00 WinXP 70.182.172.62 (COX.NET):
COX COMMUNICATIONS,
ATLANTA, GEORGIA, US. n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:20:31:00 WinXP 69.85.123.4 (SPEAKEASY.NET):
US. 213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 35 of 35 9716d7995a
NEW c3a5354b6f [0] none:none
PolyEnE| none trace

T:21:25:00 WinXP 4.87.97.51 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
US. n/a US:microsoft.com 135 pcap raw alerts
ruleset other
175 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:23:23:00 Win2K-f 173.29.142.5 (-):
. n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 36 of 41
38 of 40 067917e07b
NEW
d764c1dcb2
NEW dae35b319c [0]
3d2bc60c5d[0] none:none
none:none
Armadillo|
tElock| none
none trace
trace

T:23:25:00 WinXP 70.184.102.222 (COX.NET):
COX COMMUNICATIONS,
CHANDLER, ARIZONA, US. 221.5.74.39:65520 69.162.84.186:80 CN:proxim.ircgalaxy.pl
US:microsoft.com
CN:put.ghura.pl
CN:brenz.pl
CN:lometr.pl
:onuka.cn
:mxs.mail.ru
:alt4.gmail-smtp-in.l.google.com
US:in1.smtp.messagingengine.com
US:mail7.digitalwaves.co.nz
CN:211.95.79.6:80 135 pcap raw alerts
ruleset irc
http
147 lines Yeah : 1.8
profile none summary
tarball 19 of 41
15 of 41
12 of 40
32 of 36
16 of 41
35 of 36 176f4e0237
NEW
409536c6f3
NEW
852eec7620
NEW
bea8cb1865
NEW
e5176f95e0
NEW
fac78fde16
NEW 971b66b4c6 [0]
8dfee3b93a[0]
af9f5e5446[0]
154de51a66[0]
none [4]
882896ab05[0] none:none
none:none
none:none
ASM:Graph
none:none
none:none
none|none
Armadillo|
none|none
Armadillo|
StarForce|
tElock| none
none
none
lines=91
none
none trace
trace
trace
trace
trace
trace