Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
T:02:36:00 | WinXP | 173.23.56.33 (MCHSI.COM): MEDIACOM COMMUNICATIONS CORP, CRESTWOOD, KENTUCKY, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
T:02:48:00 | Win2K-f | 173.24.242.116 (MCHSI.COM): MEDIACOM COMMUNICATIONS CORP, HUNTSVILLE, ALABAMA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 40 38 of 40 |
474acf88e5 NEW 68f0c14692 NEW |
1f53944b24 [0] ccc1b24d53[0] |
none:none none:none |
tElock| Armadillo| |
none none |
trace trace |
T:03:27:00 | WinXP | 207.5.161.171 (SUSCOM-MAINE.NET): GREAT WORKS INTERNET, BRUNSWICK, MAINE, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
T:03:29:00 | Win2K-f | 152.48.222.137 (UNC.EDU): NORTH CAROLINA RESEARCH AND EDUCATION NETWORK, DURHAM, NORTH CAROLINA, US. (100Mbps) |
n/a | 135 | pcap | raw alerts ruleset |
other 186 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 40 | d82349e3d4 NEW |
61ea52e328 [0] | none:none |
none|none | none | trace | |
T:05:49:00 | WinXP | 114.48.39.170 (E-MOBILE.NE.JP): EMOBILE LTD, TOKYO, TOKYO, JP. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 15 lines |
Yeah : 1.3 profile |
none | summary tarball |
37 of 40 | 5285741560 NEW |
60590b8b67 [0] | ASM:Graph |
none|none | lines=59 | trace | |
T:06:46:00 | WinXP | 95.75.12.125 (-): TELECOM ITALIA MOBILE, IT. (DSL) |
n/a | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
39 of 41 | f2a8dafb30 NEW |
1d0f660523 [0] | none:none |
PolyEnE| | none | trace |
T:07:02:00 | WinXP | 71.75.210.142 (RR.COM): ROAD RUNNER HOLDCO LLC, CHARLOTTE, NORTH CAROLINA, US. (DSL) |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
T:07:05:00 | Win2K-f | 173.29.134.242 (MCHSI.COM): MEDIACOM COMMUNICATIONS CORP, CHANHASSEN, MINNESOTA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
36 of 41 38 of 40 |
067917e07b NEW d764c1dcb2 NEW |
dae35b319c [0] 3d2bc60c5d[0] |
none:none none:none |
Armadillo| tElock| |
none none |
trace trace |
T:07:51:00 | WinXP | 70.20.173.109 (VERIZON.NET): VERIZON INTERNET SERVICES INC, PHILADELPHIA, PENNSYLVANIA, US. (100Mbps) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 16 lines |
Yeah : 1.3 profile |
none | summary tarball |
31 of 32 | 741e3b03b3 NEW |
none[0] | none:none |
none|none | lines=61 | trace | |
T:09:06:00 | WinXP | 60.249.37.247 (HINET.NET): CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 111 lines |
Yeah : 1.3 profile |
none | summary tarball |
34 of 38 35 of 38 |
38ed850a0e NEW b9297745a1 NEW |
46990f37cd [0] 4294884d84[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=91 lines=64 embedded dns |
trace trace |
T:09:20:00 | WinXP | 61.221.196.205 (HINET.NET): TAINAN-CITY-GOVE-TNCS, TAINAN, T'AI-WAN, TW. (100Mbps) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW 57ce4acac2 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
T:09:52:00 | Win2K-f | 124.9.74.210 (TFN.NET.TW): TAIWAN FIXED NETWORK CO. LTD, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 302 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 40 of 41 |
088c8ea72a NEW 47280d3256 NEW |
7ccfe164f3 [0] none [4] |
none:none none:none |
Armadillo| tElock| |
none none |
trace trace |
T:10:11:00 | WinXP | 202.45.170.4 (CCNET-AI.NE.JP): COMMUNITY NETWORK CENTER INC, TOYOKAWA, AICHI, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 87 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 33 of 33 |
07fabc79ef NEW 53bfe15e91 NEW |
none[0] 1473091351[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=81 lines=75 embedded dns |
trace trace |
T:10:12:00 | WinXP | 79.162.128.173 (CENTERTEL.PL): PTK CENTERTEL BROADBAND SERVICES, WARSAW, WARSZAWA, PL. (DSL) |
n/a | CN:proxim.ircgalaxy.pl RU:citi-bank.ru FR:193.104.94.11:65520 RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http irc 3 lines |
Yeah : 0.8 profile |
none | summary tarball |
34 of 36 | 9bb68450cd NEW |
c2d5ac2315 [0] | ASM:Graph |
PolyEnE| | lines=73 embedded dns |
trace |
T:10:51:00 | WinXP | 188.97.241.70 (ARCOR-IP.NET): ARCOR-DSL-NET, DORTMUND, NORDRHEIN-WESTFALEN, DE. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 14 lines |
Yeah : 1.3 profile |
none | summary tarball |
32 of 32 | 03f912899b NEW |
none[0] | none:none |
none|none | lines=64 | trace | |
T:13:27:00 | Win2K-f | 24.83.172.82 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, VANCOUVER, BRITISH COLUMBIA, CA. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 598 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 40 | b12412de39 NEW |
7469c546da [0] | none:none |
StarForce| | none | trace | |
T:14:40:00 | WinXP | 189.49.188.41 (VELOXZONE.COM.BR): COMITE GESTOR DA INTERNET NO BRASIL, SãO PAULO, SAO PAULO, BR. (DSL) |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
37 of 39 | 49abc59e37 NEW |
1adfddcbc5 [0] | none:none |
PolyEnE| | none | trace |
T:15:34:00 | Win2K-f | 70.71.230.45 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, LANGLEY, BRITISH COLUMBIA, CA. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 1008 lines |
Yeah : 1.3 profile |
none | summary tarball |
31 of 41 | 682a384fe9 NEW |
none[3] | none:none |
none|none | none | trace | |
T:15:51:00 | Win2K-f | 63.246.125.200 (ALTUSCGI.NET): PRIVATE CABLE ISP SUBSCRIBER (GEORGETOWN SC MARKET), GEORGETOWN, SOUTH CAROLINA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
T:17:27:00 | Win2K-f | 4.242.233.19 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, PORTLAND, OREGON, US. (DIAL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
T:18:46:00 | WinXP | 65.29.64.213 (RR.COM): ROAD RUNNER HOLDCO LLC, INDIANAPOLIS, INDIANA, US. (DSL) |
n/a | DE:siliconfireware.ru US:searchportal.information.com US:spi.domainsponsor.com RU:www.bbin.ru RU:www.binbank.ru :wpad US:204.13.161.51:80 |
445 | pcap | raw alerts ruleset |
http http http http 28 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a12cab51ef NEW |
none[0] | none:none |
ASPack| | lines=281 embedded dns |
trace |
T:20:03:00 | Win2K-f | 116.126.109.69 (-): HANARO TELECOM, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
193.104.94.11:65520 | CN:proxima.ircgalaxy.pl US:microsoft.com EU:sleepatnight.cn CN:www.petdoso.com GB:www.businesstomb.com FR:193.104.94.11:65520 GB:212.117.177.140:80 |
135 | pcap | raw alerts ruleset |
irc http 120 lines |
Yeah : 1.8 profile |
none | summary tarball |
31 of 33 17 of 41 31 of 33 15 of 41 16 of 41 13 of 41 |
168aab35a3 NEW 1c5e79f5f4 NEW 667f0c59f3 NEW a0e59e4658 NEW e1cdc5a168 NEW f725e57065 NEW |
60b730b97e [0] none [4] 8fe2be2095[0] none [4] none [4] 3f11911aa9[0] |
ASM:Graph none:none ASM:Graph none:none none:none none:none |
tElock| FSG| Armadillo| Obsidium| ASProtect| tElock| |
lines=120 embedded dns none lines=91 none none none |
trace trace trace trace trace trace |
T:20:17:00 | Win2K-f | 75.28.129.113 (SBCGLOBAL.NET): AT&T INTERNET SERVICES, LOS ANGELES, CALIFORNIA, US. (DSL) |
218.93.205.30:65520 | :komojoke.cn CN:config1007.iwillhavesexygirls.com CN:maillist.iwillhavesexygirls.com US:microsoft.com GB:212.117.177.140:80 |
135 | pcap | raw alerts ruleset |
irc http 11 lines |
Yeah : 1.3 profile |
none | summary tarball |
5 of 40 8 of 40 13 of 41 |
1a19c1d029 NEW a01973751b NEW f725e57065 NEW |
da7e1ed2fa [0] ab2b3c46fa[0] 3f11911aa9[0] |
none:none none:none none:none |
StarForce| Armadillo| tElock| |
none none none |
trace trace trace |
T:20:18:00 | WinXP | 119.92.108.19 (PLDT.NET): IPG, PH. (DSL) |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
35 of 36 | b27d73bfcb NEW |
473c6454ce [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
T:20:46:00 | Win2K-f | 98.117.213.91 (VERIZON.NET): VERIZON INTERNET SERVICES INC, SEVERNA PARK, MARYLAND, US. (DSL) |
218.93.205.30:65520 | GB:www.businesstomb.com CN:proxima.ircgalaxy.pl :komojoke.cn :bfkq.com :jsactivity.com EU:sleepatnight.cn US:search.toptravellingtips.com CN:www.petdoso.com :www.toptravellingtips.com :sendfan.com :www.sendfan.com 174.36.138.68:80 CN:202.97.184.196:81 |
445 | pcap | raw alerts ruleset |
http irc 265 lines |
Yeah : 0.8 profile |
none | summary tarball |
10 of 40 7 of 40 17 of 41 0 of 40 13 of 41 |
007aa1a2f9 NEW 05b2c6ee2b NEW 1c5e79f5f4 NEW 2f1c973c21 NEW f725e57065 NEW |
396306e500 [0] 837da8c998[0] none [4] none [4] 3f11911aa9[0] |
none:none none:none none:none none:none none:none |
Neolite| StarForce| FSG| none|none tElock| |
none none none none none |
trace trace trace trace trace |
T:20:53:00 | WinXP | 4.227.195.35 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, DENVER, COLORADO, US. (DIAL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 77 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
T:20:57:00 | Win2K-f | 4.175.36.106 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, PHILADELPHIA, PENNSYLVANIA, US. (DIAL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 98 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
T:23:23:00 | Win2K-f | 118.221.35.162 (-): HANARO TELECOM, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
193.104.94.11:65520 | CN:proxim.ircgalaxy.pl US:microsoft.com EU:sleepatnight.cn CN:www.petdoso.com CN:202.97.184.196:81 |
135 | pcap | raw alerts ruleset |
irc http 209 lines |
Yeah : 1.8 profile |
none | summary tarball |
17 of 41 40 of 41 39 of 41 13 of 41 |
1c5e79f5f4 NEW 1eafd24c64 NEW b5edcbfd2a NEW f725e57065 NEW |
none[4] 91efa90c65[0] c30d825691[0] 3f11911aa9[0] |
none:none none:none none:none none:none |
FSG| StarForce| Armadillo| tElock| |
none none none none |
trace trace trace trace |
T:23:40:00 | Win2K-f | 92.46.179.94 (DIAL.ONLINE.KZ): JSC KAZAKHTELECOM PAVLODAR AFFILIATE, PAVLODAR, PAVLODAR, KZ. (DSL) |
218.93.205.30:65520 | CN:proxim.ircgalaxy.pl EU:sleepatnight.cn |
445 | pcap | raw alerts ruleset |
irc http 12 lines |
Yeah : 0.8 profile |
none | summary tarball |
13 of 41 | f725e57065 NEW |
3f11911aa9 [0] | none:none |
tElock| | none | trace |