|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:02:25:00 | Win2K-f | 207.5.236.176 (SUSCOM-MAINE.NET): GREAT WORKS INTERNET, BRUNSWICK, MAINE, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:04:50:00 | WinXP | 78.55.104.96 (ALICEDSL.DE): HANSENET-ADSL, ULM, BADEN-WÜRTTEMBERG, DE. (DSL) |
n/a | :moscow-advokat.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
39 of 41 | 9d94bc6743 NEW |
a42cc1cd6b [0] | none:none |
PolyEnE| | none | trace |
| T:06:17:00 | WinXP | 86.155.17.20 (BTOPENWORLD.COM): BT BROADBAND, LONDON, ENGLAND, UK. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 14 lines |
Yeah : 1.3 profile |
none | summary tarball |
29 of 29 | 831f4ee0a7 NEW |
none[0] | ASM:Graph |
none|none | lines=61 | trace | |
| T:06:34:00 | WinXP | 81.9.190.30 (CM-81-9-237-10.TELECABLE.ES): TELECABLE, OVIEDO, ASTURIAS, ES. (DSL) |
n/a | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
32 of 32 | b502f83a7c NEW |
28f5be93b0 [0] | none:none |
PolyEnE| | none | trace |
| T:07:08:00 | WinXP | 208.100.229.26 (1DIAL.COM): AD-BASE SYSTEMS INC. (DBA GLOBALPOPS), CHARLOTTE, NORTH CAROLINA, US. (DIAL) |
213.219.245.212:80 | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 3 lines |
Yeah : 1.3 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:07:09:00 | WinXP | 90.150.118.96 (PERMONLINE.RU): DYNAMIC DISTRIBUTION IP'S FOR BROADBAND SERVICES, MOSCOW, MOSCOW CITY, RU. (DSL) |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 | f08c74bfc5 NEW |
7452386708 [0] | none:none |
PolyEnE| | none | trace |
| T:07:54:00 | WinXP | 75.43.193.230 (SBCGLOBAL.NET): AT&T INTERNET SERVICES, LOS ANGELES, CALIFORNIA, US. (DSL) |
n/a | DE:siliconfireware.ru US:searchportal.information.com US:spi.domainsponsor.com GB:welcome3.smile.co.uk :wpad GB:195.92.84.198:80 US:204.13.161.51:80 |
445 | pcap | raw alerts ruleset |
http http http 9 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a12cab51ef NEW |
none[0] | none:none |
ASPack| | lines=281 embedded dns |
trace |
| T:08:02:00 | Win2K-f | 203.76.105.17 (NEKSUS.COM): LINK3 TECHNOLOGIES LTD, DHAKA, DHAKA, BD. (DIAL) |
n/a | 135 | pcap | raw alerts ruleset |
other 345 lines |
Yeah : 1.3 profile |
none | summary tarball |
31 of 41 | cc88f4f016 NEW |
3d17903825 [0] | none:none |
StarForce| | none | trace | |
| T:11:16:00 | WinXP | 211.127.186.122 (-): JAPAN SYSTEM CARE CO. LTD, TOKYO, TOKYO, JP. (DSL) |
n/a | EU:siliconfireware.ru US:searchportal.information.com RU:www.bbin.ru RU:www.binbank.ru :wpad US:spi.domainsponsor.com US:208.73.210.125:80 |
445 | pcap | raw alerts ruleset |
http http http http 27 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a12cab51ef NEW |
none[0] | none:none |
ASPack| | lines=281 embedded dns |
trace |
| T:12:00:00 | WinXP | 174.6.21.151 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, WINNIPEG, MANITOBA, CA. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 61 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 33 | a08f3b74a4 NEW |
none[0] | none:none |
Armadillo| | lines=90 | trace | |
| T:12:05:00 | Win2K-f | 110.9.234.154 (-): HANARO TELECOM, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 113 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 5 of 41 |
14f47ffd1e NEW 50437008d9 NEW |
90bf4b99ff [0] c1b09ac5d7[0] |
none:none none:none |
tElock| Armadillo| |
none none |
trace trace |
| T:14:12:00 | Win2K-f | 65.191.64.185 (RR.COM): ROAD RUNNER HOLDCO LLC, FAYETTEVILLE, NORTH CAROLINA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 33 33 of 33 |
4c3df24b32 NEW 53bfe15e91 NEW |
none[0] 1473091351[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=81 lines=75 embedded dns |
trace trace |
| 17:24:00 | Win2K-f | 201.213.51.223 (NET.AR): PRIMA S.A, AR. (DSL) |
n/a | US:www.maxmind.com US:getmyip.co.uk US:www.getmyip.org :checkip.dyndns.org DE:131.220.6.26:80 US:65.254.36.202:80 US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 6 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:17:33:00 | Win2K-f | 201.213.51.223 (NET.AR): PRIMA S.A, AR. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org DE:131.220.6.26:80 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:18:40:00 | Win2K-f | 203.82.112.238 (MEDIATTI.NET): MEDIATTI COMMUNICATIONS INC, OKINAWA, OKINAWA, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 85 lines |
Yeah : 1.3 profile |
none | summary tarball |
3 of 33 33 of 33 |
3ed16ae12d NEW 79c01ec060 NEW |
none[0] 1bfd34056c[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=81 lines=64 embedded dns |
trace trace |
| T:18:55:00 | Win2K-f | 61.105.173.199 (KRLINE.NET): KRNIC, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
218.93.205.30:65520 | CN:proxim.ircgalaxy.pl US:microsoft.com CN:dl.guarddog2009.com EU:gidromash.cn EU:ottopay.cn US:64.235.53.208:80 |
135 | pcap | raw alerts ruleset |
irc http 140 lines |
Yeah : 1.8 profile |
none | summary tarball |
30 of 33 28 of 33 15 of 41 7 of 41 |
533d15b5ce NEW 58c343a8d8 NEW 83192a6119 NEW c7830331fc NEW |
c67adf46e2 [0] none [0] fdc95e1fab[0] 7953649664[0] |
ASM:Graph none:none none:none none:none |
tElock| Armadillo| none|none tElock| |
lines=126 embedded dns lines=91 none none |
trace trace trace trace |
| T:19:04:00 | WinXP | 125.4.229.201 (ZAQ.NE.JP): J:COM WEST CO. LTD, TOKYO, TOKYO, JP. (DSL) |
n/a | CN:italian.swiifatecihno.com :fuck.urpal43sourpalhuh.com :japan.youngpeyatech.info :dong.nagitiriheiwu.net CN:218.61.22.10:7382 |
135 | pcap | raw alerts ruleset |
other 612 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 | 8ca2204d15 NEW |
b4b671eb52 [0] | none:none |
ASPack| | none | trace |
| T:19:05:00 | WinXP | 70.184.102.222 (COX.NET): COX COMMUNICATIONS, PHOENIX, ARIZONA, US. (100Mbps) |
91.212.220.75:65520 | CN:proxim.ircgalaxy.pl US:microsoft.com CN:www.brans.pl EU:gidromash.cn EU:ottopay.cn US:64.235.53.208:80 |
135 | pcap | raw alerts ruleset |
irc http 124 lines |
Yeah : 1.8 profile |
none | summary tarball |
7 of 41 32 of 36 7 of 41 35 of 36 |
18dfbbc85b NEW bea8cb1865 NEW c7830331fc NEW fac78fde16 NEW |
4f6fcecea3 [0] 154de51a66[0] 7953649664[0] 882896ab05[0] |
none:none ASM:Graph none:none none:none |
UPX| Armadillo| tElock| tElock| |
none lines=91 none none |
trace trace trace trace |
| T:19:41:00 | Win2K-f | 203.118.238.245 (-): GRAND TAINAN TECHNOLOGY CO.LTD, TAINAN, T'AI-WAN, TW. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:23:16:00 | WinXP | 125.2.115.180 (INFOWEB.NE.JP): INFOWEB(FUJITSU LTD.), KAWASAKI, KANAGAWA, JP. (DIAL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 15 lines |
Yeah : 1.3 profile |
none | summary tarball |
31 of 32 | 741e3b03b3 NEW |
none[0] | none:none |
none|none | lines=61 | trace |