|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:01:12:00 | WinXP | 116.81.71.33 (INFOWEB.NE.JP): INFOWEB(FUJITSU LTD.), JP. |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 111 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 40 of 41 |
03eb887daa NEW 1179d0de83 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:03:09:00 | WinXP | 60.249.37.247 (HINET.NET): CHTD CHUNGHWA TELECOM CO. LTD, TW. |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
34 of 38 35 of 38 |
38ed850a0e NEW b9297745a1 NEW |
46990f37cd [0] 4294884d84[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=91 lines=64 embedded dns |
trace trace |
| T:04:36:00 | WinXP | 203.91.165.198 (STARCAT.NE.JP): KMN CORPORATION, NAGOYA, AICHI, JP. |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 59 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 8 of 33 |
53bfe15e91 NEW b7082104e4 NEW |
1473091351 [0] c5b49e7b82[0] |
ASM:Graph ASM:Graph |
tElock| tElock| |
lines=75 embedded dns lines=41 |
trace trace |
| 04:40:00 | WinXP | 79.163.105.168 (-): IDEA, PL. |
n/a | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
40 of 41 | 708f64b1b7 NEW |
none[none] | none:none |
none|none | none | none |
| T:05:19:00 | WinXP | 66.19.204.182 (USLEC.NET): USLEC CORP, US. |
213.219.245.212:80 | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 3 lines |
Yeah : 1.3 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:07:14:00 | Win2K-f | 96.8.226.180 (-): . |
n/a | 135 | pcap | raw alerts ruleset |
other 6 lines |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| 08:21:00 | Win2K-f | 78.34.78.109 (NETCOLOGNE.DE): NETCOLOGNE GMBH, KOELN, NORDRHEIN-WESTFALEN, DE. |
n/a | US:www.w3.org :wkzvqflji.com US:ggknbwan.org :dvlox.net :clweptdgu.biz :xjcfgiya.net US:phazhfdr.info :uteyntvf.com :fefjnlu.net US:ighycfdbfw.info :uxtstmjhkoi.biz :vkquzhkfhu.net :roxhaa.net :xnvdxxydud.net :rgexm.net :pwaxmdz.com :twwaip.net US:pszulmygmma.org :jiwcc.com :pvwyljqp.net :fenynvwudqo.net :jdydglygo.com :vgutuuln.com :nctmoybmije.info :pqbrhcpup.net NL:ugnwbjnn.org US:ighnttdal.info :cagfcyyn.com US:zzrhatdgcx.org US:bcmjdjqv.info :jwbrnnecdx.net US:idrzlwen.info :ajoompyi.net :fznneq.com :qfachl.com :mlmfkgbmb.net :sheafkbdi.biz NL:audyuarznnd.info US:qgadr.org :hupvpcsal.biz :qwtaevgvo.net :rxourzqbsao.biz :dflxuuuj.info NL:dzlbsfozyw.info :bdftewse.com :ibeepc.net :trmacsn.com :sdchrxke.biz :uheopnyx.com US:vogxog.info :mgxvebjakt.net :jigrwgqy.net :qyyhlkwo.net US:tpaclk.org US:aenwnmuq.org :mngrkm.biz US:ozjnjrggnp.info :vhzaffxsg.com :poufyhueqgj.net :qzcfxtvu.biz :sqqxvsm.net US:pelgztsr.org US:dmduz.org :nxzmwqbrfr.net :cuidzdfrdn.org NL:gtncmcfcqvr.info :cnhorno.biz :ymmjdhqobso.biz :aaetdoj.net :dzuafrei.net US:sqzvzqykb.org US:204.152.184.139:80 US:74.208.64.145:80 |
445 | pcap | raw alerts ruleset |
http 6 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:09:16:00 | Win2K-f | 72.184.72.205 (RR.COM): ROAD RUNNER HOLDCO LLC, LAKELAND, FLORIDA, US. |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:12:44:00 | WinXP | 88.186.189.50 (PROXAD.NET): PROXAD / FREE SAS, FR. |
n/a | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
40 of 41 | 4d4b114a18 NEW |
2414a15ebd [0] | none:none |
PolyEnE| | none | trace |
| T:14:02:00 | Win2K-f | 173.168.161.44 (-): . |
n/a | 135 | pcap | raw alerts ruleset |
other 1002 lines |
Yeah : 1.3 profile |
none | summary tarball |
6 of 41 | 7c2318cf9b NEW |
none[none] | none:none |
none|none | none | none | |
| T:15:46:00 | WinXP | 74.67.21.238 (RR.COM): ROAD RUNNER HOLDCO LLC, DELANSON, NEW YORK, US. |
n/a | DE:siliconfireware.ru US:searchportal.information.com US:spi.domainsponsor.com GB:welcome3.smile.co.uk :wpad GB:195.92.84.198:80 |
445 | pcap | raw alerts ruleset |
http http http 20 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a12cab51ef NEW |
none[0] | none:none |
ASPack| | lines=281 embedded dns |
trace |
| T:15:47:00 | Win2K-f | 96.51.132.196 (-): . |
n/a | :dong.nagitiriheiwu.net :japan.youngpeyatech.info CN:done.blacktiehsbdcs.com |
135 | pcap | raw alerts ruleset |
irc http 263 lines |
Yeah : 1.3 profile |
none | summary tarball |
19 of 41 37 of 41 |
205bf6f449 NEW bd133be999 NEW |
7f52ad5fa7 [0] 503a67cfa9[0] |
none:none none:none |
StarForce| StarForce| |
none none |
trace trace |
| T:16:03:00 | Win2K-f | 74.214.47.11 (METROCAST.NET): GMP CABLE TV, BERWICK, PENNSYLVANIA, US. |
n/a | 135 | pcap | raw alerts ruleset |
other 98 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 | e30fb27bda NEW |
90ee26f451 [0] | ASM:Graph |
MEW| | lines=185 embedded dns |
trace | |
| T:16:45:00 | Win2K-f | 67.10.91.238 (RR.COM): ROAD RUNNER HOLDCO LLC, HOUSTON, TEXAS, US. (100Mbps) |
194.109.11.65:6556 194.109.11.65:1023 | NL:0x80.online-software.org | 135 | pcap | raw alerts ruleset |
other 190 lines |
Yeah : 1.8 profile |
none | summary tarball |
32 of 32 | 15d4d85dc0 NEW |
4c95ae4b3d [0] | ASM:Graph |
StarForce| | lines=212 embedded dns |
trace |
| 17:38:00 | Win2K-f | 125.229.128.68 (HINET.NET): CHTD CHUNGHWA TELECOM CO. LTD, TW. |
n/a | US:www.maxmind.com :checkip.dyndns.org US:getmyip.co.uk US:www.getmyip.org DE:131.220.6.26:80 208.78.70.70:80 US:65.254.39.170:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 4 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:20:38:00 | WinXP | 186.9.45.60 (-): . |
n/a | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:21:02:00 | Win2K-f | 59.94.100.72 (10/24.BSNL.IN): NIB (NATIONAL INTERNET BACKBONE), GURGAON, HARYANA, IN. (DSL) |
n/a | CZ:qtas.net | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
12 of 40 | a486c7e36a NEW |
none[none] | none:none |
none|none | none | none |
| T:21:46:00 | Win2K-f | 210.233.203.146 (MEDIATTI.NET): MEDIATTI COMMUNICATIONS INC, OKINAWA, OKINAWA, JP. |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 93 lines |
Yeah : 1.3 profile |
none | summary tarball |
3 of 33 33 of 33 |
3ed16ae12d NEW 79c01ec060 NEW |
none[0] 1bfd34056c[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=81 lines=64 embedded dns |
trace trace |
| T:22:06:00 | WinXP | 207.32.63.92 (SOUTHSLOPE.NET): SOUTH SLOPE COOPERATIVE TELEPHONE COMPANY, NEVADA, IOWA, US. (DSL) |
n/a | :moscow-advokat.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
39 of 41 | 534ccf8cdb NEW |
4473c170f3 [0] | none:none |
PolyEnE| | none | trace |
| T:22:12:00 | Win2K-f | 66.166.25.4 (GLOBALINVESTMENTDEV.COM): COVAD COMMUNICATIONS CO, LOS ANGELES, CALIFORNIA, US. |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |