|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:00:55:00 | WinXP | 222.230.153.141 (VECTANT.NE.JP): SEIKA CORPORATION, YOKOHAMA, KANAGAWA, JP. (100Mbps) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 14 lines |
Yeah : 1.3 profile |
none | summary tarball |
29 of 29 | 831f4ee0a7 NEW |
none[0] | ASM:Graph |
none|none | lines=61 | trace | |
| T:02:45:00 | WinXP | 125.58.85.33 (STARCAT.NE.JP): KMN CORPORATION, NAGOYA, TOKYO, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:03:12:00 | WinXP | 67.55.178.248 (NETINS.NET): WESTERN IOWA TELEPHONE, MOVILLE, IOWA, US. (DSL) |
89.208.33.88:3305 | AR:cx10man.weedns.com TH:fx010413.whyI.org 92.240.234.164:3305 |
135 | pcap | raw alerts ruleset |
irc 608 lines |
Yeah : 1.8 profile |
none | summary tarball |
40 of 41 | 123d7e4180 NEW |
2e4e5e0e9a [0] | none:none |
StarForce| | none | trace |
| T:03:24:00 | Win2K-f | 63.27.211.29 (UU.NET): UUNET TECHNOLOGIES INC, DOWAGIAC, MICHIGAN, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 4 lines |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:03:38:00 | WinXP | 125.4.220.52 (ZAQ.NE.JP): J:COM WEST CO. LTD, TOKYO, TOKYO, JP. (DSL) |
92.240.234.164:3305 | :cx10man.weedns.com | 135 | pcap | raw alerts ruleset |
irc 704 lines |
Yeah : 1.8 profile |
none | summary tarball |
28 of 41 | b8076e37ae NEW |
52953fed05 [0] | none:none |
StarForce| | none | trace |
| T:04:51:00 | WinXP | 62.45.97.25 (CAIWAY.NL): KABELFOON, NIJMEGEN, GELDERLAND, NL. (DSL) |
n/a | :moscow-advokat.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
40 of 41 | 973b7d1bee NEW |
922ddaf1ee [0] | none:none |
PolyEnE| | none | trace |
| T:05:23:00 | Win2K-f | 203.82.86.102 (-): CELCOM INTERNET SERVICE PROVIDER, KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 123 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 38 of 41 |
164196d773 NEW c505f21e5b NEW |
293b07a5b3 [0] 6d77c1618c[0] |
none:none none:none |
tElock| Armadillo| |
none none |
trace trace |
| T:05:34:00 | WinXP | 93.102.64.47 (REV.OPTIMUS.PT): OPTIMUS PORTUGAL, COIMBRA, COIMBRA, PT. (DSL) |
n/a | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
41 of 41 | a769511504 NEW |
7ecd054f18 [0] | none:none |
PolyEnE| | none | trace |
| T:05:45:00 | WinXP | 114.48.28.229 (E-MOBILE.NE.JP): EMOBILE LTD, TOKYO, TOKYO, JP. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 14 lines |
Yeah : 1.3 profile |
none | summary tarball |
37 of 40 | 5285741560 NEW |
60590b8b67 [0] | ASM:Graph |
none|none | lines=59 | trace | |
| T:06:18:00 | Win2K-f | 70.167.73.201 (COX.NET): COX COMMUNICATIONS, OCEANSIDE, CALIFORNIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:08:06:00 | WinXP | 64.33.132.45 (AIRSTREAMCOMM.NET): TRI COUNTY TELEPHONE, WISCONSIN, US. (DIAL) |
n/a | DE:siliconfireware.ru US:searchportal.information.com US:spi.domainsponsor.com RU:www.bbin.ru RU:www.binbank.ru :wpad US:204.13.161.51:80 |
445 | pcap | raw alerts ruleset |
http http http http 37 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a12cab51ef NEW |
none[0] | none:none |
ASPack| | lines=281 embedded dns |
trace |
| T:08:29:00 | Win2K-f | 202.219.192.54 (INFOWEB.NE.JP): INFOWEB, TOKYO, TOKYO, JP. (DIAL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 187 lines |
Yeah : 1.3 profile |
none | summary tarball |
37 of 41 40 of 41 |
89747f56b8 NEW a837a477d5 NEW |
bd6821b297 [0] 62f046a268[0] |
none:none none:none |
Armadillo| tElock| |
none none |
trace trace |
| T:11:09:00 | WinXP | 186.97.66.230 (-): . |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 | 8015c2d45f NEW |
749cbc2739 [0] | none:none |
PolyEnE| | none | trace |
| T:11:17:00 | WinXP | 87.173.122.25 (T-DIALIN.NET): DEUTSCHE TELEKOM AG, MAGDEBURG, SACHSEN-ANHALT, DE. (DIAL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 14 lines |
Yeah : 1.3 profile |
none | summary tarball |
31 of 32 | 741e3b03b3 NEW |
none[0] | none:none |
none|none | lines=61 | trace | |
| T:11:48:00 | WinXP | 62.169.93.108 (REV.OPTIMUS.PT): OPTIMUS PORTUGAL, LISBON, LISBOA, PT. (DSL) |
n/a | US:www.altavista.com :www.google.com.au :jbeegvia.ru |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
31 of 32 | 17028f1eda NEW |
none[3] | none:none |
tElock| | none | trace |
| T:11:52:00 | Win2K-f | 203.118.238.245 (-): GRAND TAINAN TECHNOLOGY CO.LTD, TAINAN, T'AI-WAN, TW. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:13:04:00 | WinXP | 208.126.189.97 (NETINS.NET): CASCADE COMMUNICATIONS, CASCADE, IOWA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 1009 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 40 15 of 41 |
6b702f62ee NEW a36cb429f9 NEW |
9d20beb668 [0] none [3] |
none:none none:none |
StarForce| StarForce| |
none none |
trace trace |
|
| T:13:21:00 | Win2K-f | 70.184.102.222 (COX.NET): COX COMMUNICATIONS, PHOENIX, ARIZONA, US. (100Mbps) |
193.104.94.11:65520 | FR:proxim.ircgalaxy.pl US:microsoft.com CN:dl.guarddog2009.com :komojoke.cn EU:colopin.cn CN:config1007.iwillhavesexygirls.com CN:maillist.iwillhavesexygirls.com :doretorza.com US:mx1.hotmail.com US:mx2.hotmail.com US:mx4.hotmail.com US:mx3.hotmail.com US:b.mx.mail.yahoo.com US:c.mx.mail.yahoo.com :e.mx.mail.yahoo.com :f.mx.mail.yahoo.com :g.mx.mail.yahoo.com :a.mx.mail.yahoo.com US:alt1.gmail-smtp-in.l.google.com :alt2.gmail-smtp-in.l.google.com US:alt3.gmail-smtp-in.l.google.com US:alt4.gmail-smtp-in.l.google.com DE:mx-ha01.web.de DE:mx-ha02.web.de :moanzjeyrjaok.net |
135 | pcap | raw alerts ruleset |
irc http 12886 lines |
Yeah : 1.8 profile |
none | summary tarball |
29 of 41 15 of 41 14 of 41 32 of 36 11 of 41 4 of 41 34 of 41 35 of 36 |
785e86954f NEW 83192a6119 NEW b048088ffb NEW bea8cb1865 NEW bff227df8f NEW d95b694263 NEW f5a689cfe8 NEW fac78fde16 NEW |
c6edee8e8b [0] fdc95e1fab[0] 664cdbe63c[0] 154de51a66[0] 5e80234b13[0] e13aff1a50[0] 22c703369e[0] 882896ab05[0] |
none:none none:none none:none ASM:Graph none:none none:none none:none none:none |
PeStubOEP| none|none StarForce| Armadillo| Armadillo| StarForce| StarForce| tElock| |
none none none lines=91 none none none none |
trace trace trace trace trace trace trace trace |