|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:10:47:00 | WinXP | 213.99.250.230 (-): TELEFONICA MOVILES ESPANA (NCC#2006042768), ES. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 14 lines |
Yeah : 1.3 profile |
none | summary tarball |
29 of 29 | 1a2c0e6130 NEW |
none[0] | none:none |
none|none | lines=60 | trace | |
| T:11:51:00 | Win2K-f | 96.8.227.187 (GVTC.COM): GUADALUPE VALLEY TELEPHONE COOPERATIVE INC, NEW BRAUNFELS, TEXAS, US. (DSL) |
92.240.234.164:3305 | :cx10man.weedns.com | 135 | pcap | raw alerts ruleset |
irc 577 lines |
Yeah : 1.8 profile |
none | summary tarball |
23 of 41 | a0e262b14d NEW |
4ae21c0514 [0] | none:none |
StarForce| | none | trace |
| T:12:29:00 | Win2K-f | 75.179.184.106 (RR.COM): ROAD RUNNER HOLDCO LLC, BLACKLICK, OHIO, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 40 of 41 |
63546c3b33 NEW 895c10c5ed NEW |
52748673c6 [0] eabab17862[0] |
none:none none:none |
Armadillo| tElock| |
none none |
trace trace |
| T:12:38:00 | WinXP | 196.208.67.97 (TELKOMADSL.CO.ZA): AFRINIC, JOHANNESBURG, GAUTENG, ZA. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 107 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 | 7389a9a1ee NEW |
7389a9a1ee [1] | ASM:Graph |
Armadillo| | lines=82 | trace | |
| T:13:20:00 | WinXP | 76.178.216.195 (RR.COM): ROAD RUNNER HOLDCO LLC, WHITEFIELD, NEW HAMPSHIRE, US. (DSL) |
n/a | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:13:22:00 | WinXP | 69.193.74.22 (RR.COM): ROAD RUNNER HOLDCO LLC, HERNDON, VIRGINIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:14:22:00 | Win2K-f | 70.167.73.201 (COX.NET): COX COMMUNICATIONS, OCEANSIDE, CALIFORNIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:16:25:00 | Win2K-f | 75.15.233.189 (SBCGLOBAL.NET): AT&T INTERNET SERVICES, BAKERSFIELD, CALIFORNIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 40 of 41 |
1e12f5145a NEW f208493e65 NEW |
617af909de [0] 5100adb4f9[0] |
none:none none:none |
Armadillo| tElock| |
none none |
trace trace |
| T:16:52:00 | Win2K-f | 41.206.137.35 (NILE-ONLINE.NET): AFRINIC, CAIRO, AL QAHIRAH, EG. (DSL) |
n/a | CZ:qtas.net CZ:mi.thelive-photo.com US:immmsn.info |
445 | pcap | raw alerts ruleset |
http 59 lines |
Yeah : 0.8 profile |
none | summary tarball |
19 of 41 | 317ee65ae3 NEW |
efd210fbfe [0] | none:none |
FASM| | none | trace |
| T:17:20:00 | WinXP | 63.25.243.12 (UU.NET): UUNET TECHNOLOGIES INC, BATON ROUGE, LOUISIANA, US. (DSL) |
n/a | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | 8ae2cc2e80 NEW |
none[0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:18:45:00 | WinXP | 74.65.164.131 (RR.COM): ROAD RUNNER HOLDCO LLC, SOUTH PORTLAND, MAINE, US. (DSL) |
n/a | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:19:26:00 | WinXP | 68.203.225.236 (RR.COM): ROAD RUNNER HOLDCO LLC, ORANGE, TEXAS, US. (100Mbps) |
213.219.245.212:80 | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 3 lines |
Yeah : 1.3 profile |
none | summary tarball |
32 of 32 | b502f83a7c NEW |
28f5be93b0 [0] | none:none |
PolyEnE| | none | trace |
| T:20:31:00 | WinXP | 130.13.181.244 (QWEST.NET): QWEST BROADBAND SERVICES INC, GILBERT, ARIZONA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
shell ftp shell 31 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:20:32:00 | WinXP | 130.15.189.92 (QUEENSU.CA): QUEEN'S UNIVERSITY, KINGSTON, ONTARIO, CA. (100Mbps) |
n/a | 135 | pcap | raw alerts ruleset |
shell ftp shell 30 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:21:05:00 | Win2K-f | 116.127.8.208 (-): HANARO TELECOM, BUCHEON CITY, SEOUL-T'UKPYOLSI, KR. (DSL) |
218.93.205.30:65520 | EU:proxima.ircgalaxy.pl US:microsoft.com EU:gidromash.cn EU:ottopay.cn CN:www.brans.pl :www.petdoso.com 174.36.176.242:81 CN:218.93.205.30:65520 EU:91.206.201.39:80 |
135 | pcap | raw alerts ruleset |
irc http 113 lines |
Yeah : 1.8 profile |
none | summary tarball |
7 of 41 17 of 41 34 of 36 29 of 32 7 of 41 |
18dfbbc85b NEW 1c5e79f5f4 NEW 99b248336f NEW 9d677c3f70 NEW c7830331fc NEW |
4f6fcecea3 [0] none [4] c64bd1a776[0] 77e75ff10f[0] 7953649664[0] |
none:none none:none none:none none:none none:none |
UPX| FSG| Armadillo| tElock| tElock| |
none none none none none |
trace trace trace trace trace |
| T:21:13:00 | WinXP | 71.108.153.125 (VERIZON.NET): VERIZON INTERNET SERVICES INC, LONG BEACH, CALIFORNIA, US. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 15 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 | 320195e2d3 NEW |
ce4cf37946 [0] | none:none |
none|none | none | trace | |
| T:21:21:00 | WinXP | 63.246.122.215 (ALTUSCGI.NET): PRIVATE CABLE ISP SUBSCRIBER (GEORGETOWN SC MARKET), GEORGETOWN, SOUTH CAROLINA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:21:28:00 | WinXP | 98.30.117.179 (RR.COM): ROAD RUNNER HOLDCO LLC, UPPER SANDUSKY, OHIO, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 77 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:22:53:00 | Win2K-f | 172.190.85.123 (AOL.COM): AMERICA ONLINE, RESTON, VIRGINIA, US. (DIAL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
37 of 41 36 of 40 |
47d3548e36 NEW d8722af110 NEW |
ab13346633 [0] ab30a55931[0] |
none:none none:none |
Armadillo| tElock| |
none none |
trace trace |
| T:23:48:00 | WinXP | 110.15.219.65 (-): HANARO TELECOM, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
218.93.205.30:65520 | EU:proxim.ircgalaxy.pl US:microsoft.com EU:gidromash.cn EU:ottopay.cn :www.petdoso.com 174.36.176.242:81 |
135 | pcap | raw alerts ruleset |
irc http 140 lines |
Yeah : 1.8 profile |
none | summary tarball |
17 of 41 29 of 32 28 of 32 7 of 41 |
1c5e79f5f4 NEW 8a75955033 NEW 9276c8b36b NEW c7830331fc NEW |
none[4] 2bf3e548b9[0] none [0] 7953649664[0] |
none:none ASM:Graph ASM:Graph none:none |
FSG| tElock| Armadillo| tElock| |
none lines=126 embedded dns lines=81 none |
trace trace trace trace |
| T:23:52:00 | WinXP | 95.84.165.38 (NATIONALCABLENETWORKS.RU): NCNET BROADBAND CUSTOMERS, MOSCOW, MOSCOW CITY, RU. (DSL) |
n/a | DE:siliconfireware.ru US:searchportal.information.com US:spi.domainsponsor.com :wpad |
445 | pcap | raw alerts ruleset |
http http http 27 lines |
Yeah : 0.8 profile |
none | summary tarball |
41 of 41 | 2949a0ad17 NEW |
0b5f65174a [0] | none:none |
ASPack| | none | trace |