Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

18 December 2009
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:14:00 Win2K-f 125.4.19.94 (ZAQ.NE.JP):
J:COM WEST CO. LTD,
OSAKA, OSAKA, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 0 of 32
33 of 33 07fabc79ef
NEW
53bfe15e91
NEW none[0]
1473091351[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=81
lines=75
embedded dns trace
trace

T:00:19:00 Win2K-f 4.224.135.175 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SOUTH BEND, INDIANA, US. (DIAL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
128 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33 53bfe15e91
NEW
b7082104e4
NEW 1473091351 [0]
c5b49e7b82[0] ASM:Graph
ASM:Graph
tElock|
tElock| lines=75
embedded dns
lines=41 trace
trace

T:00:35:00 Win2K-f 203.114.106.149 (-):
BAMNETNARONGWITAYAKOMSCHOOL,
BANGKOK, KRUNG THEP, TH. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
79 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:00:45:00 Win2K-f 69.193.74.22 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:00:45:00 Win2K-f 4.245.92.39 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
ST. LOUIS, MISSOURI, US. (DIAL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
151 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:01:09:00 Win2K-f 110.12.44.199 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 88.198.228.238:65520 US:microsoft.com
DE:proxim.ircgalaxy.pl
CN:q.kfgrtjer.cn
:colopin.cn
CN:config1130.iwillhavesexygirls.com
CN:russia.2288.org
:wws.mobiec.net
:commerceclick.co.uk
CN:www.petdoso.com
EU:ya.ru
CN:202.97.184.196:81
CN:218.10.18.119:44
69.197.161.10:14724
69.197.161.10:80 135 pcap raw alerts
ruleset irc
http
http
http
145 lines Yeah : 1.8
profile none summary
tarball 15 of 41
15 of 41
29 of 32
28 of 32
19 of 41
6 of 41 4a534adb42
NEW
869e3715f5
NEW
8a75955033
NEW
9276c8b36b
NEW
a8f0ebdde6
NEW
e5772d7d3f
NEW none[none]
none [none]
2bf3e548b9[0]
none [0]
none [none]
none [none] none:none
none:none
ASM:Graph
ASM:Graph
none:none
none:none
none|none
none|none
tElock|
Armadillo|
none|none
none|none none
none
lines=126
embedded dns
lines=81
none
none none
none
trace
trace
none
none

T:01:37:00 Win2K-f 94.71.64.163 (OTENET.GR):
OTENET,
ATHENS, ATTIKI, GR. (DSL) 88.198.228.238:65520 DE:proxim.ircgalaxy.pl
CN:webspot1.co.cc
CN:q.kfgrtjer.cn
:colopin.cn
CN:config1130.iwillhavesexygirls.com
:wws.mobiec.net
CN:russia.2288.org
CN:www.petdoso.com
:commerceclick.co.uk
RU:ya.ru
CN:202.97.184.196:81
CN:218.10.18.119:44 445 pcap raw alerts
ruleset irc
http
http
http
http
32 lines Yeah : 1.3
profile none summary
tarball 19 of 41
15 of 41
6 of 41 33f11880be
NEW
4a534adb42
NEW
e5772d7d3f
NEW none[none]
none [none]
none [none] none:none
none:none
none:none
none|none
none|none
none|none none
none
none none
none
none

T:02:48:00 Win2K-f 180.69.184.124 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 88.198.228.238:65520 DE:proxima.ircgalaxy.pl
US:microsoft.com
:colopin.cn
CN:www.petdoso.com
CN:202.97.184.196:81 135 pcap raw alerts
ruleset irc
http
150 lines Yeah : 1.8
profile none summary
tarball 19 of 41
39 of 41
31 of 33
6 of 41 829f6c4b1a
NEW
ab9c4b5f21
NEW
d789c8d157
NEW
e5772d7d3f
NEW none[none]
none [none]
5f6572479f[0]
none [none] none:none
none:none
none:none
none:none
none|none
none|none
PolyEnE|
none|none none
none
none
none none
none
trace
none

T:02:59:00 Win2K-f 60.249.37.247 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 34 of 38
35 of 38 38ed850a0e
NEW
b9297745a1
NEW 46990f37cd [0]
4294884d84[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:03:34:00 Win2K-f 59.120.228.224 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a 135 pcap raw alerts
ruleset other
53 lines Yeah : 1.3
profile none summary
tarball 0 of 33 57ce4acac2
NEW none[0] none:none
Armadillo| lines=90 trace

04:08:00 Win2K-f 60.189.43.121 (163DATA.COM.CN):
CHINANET-ZJ TAIZHOU NODE NETWORK,
BEIJING, BEIJING, CN. (DSL) n/a US:www.maxmind.com
US:www.getmyip.org
EU:getmyip.co.uk
:checkip.dyndns.org
208.78.70.70:80
US:67.15.94.80:80
US:75.126.138.202:80
EU:78.40.35.134:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

T:07:07:00 Win2K-f 117.104.16.21 (T-COM.NE.JP):
TOKAI CORPORATION,
TOKYO, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 41
39 of 41 6b315f5dbc
NEW
7938865f8c
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:07:45:00 WinXP 60.56.59.10 (EONET.NE.JP):
K-OPTICOM CORPORATION,
KOBE, HYOGO, JP. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 40 of 41 2cb7fb5674
NEW 4bf8dcd347 [0] none:none
none|none none trace

T:08:04:00 Win2K-f 204.181.140.250 (SPRINTLINK.NET):
SPRINT,
BETHEL, CONNECTICUT, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
112 lines Yeah : 1.3
profile none summary
tarball 36 of 41
38 of 41 4d4b7efca2
NEW
539d61fc06
NEW ec83dac222 [0]
c3af874c93[0] none:none
none:none
Armadillo|
tElock| none
none trace
trace

T:08:19:00 Win2K-f 70.183.165.33 (COX.NET):
COX COMMUNICATIONS,
PROVIDENCE, RHODE ISLAND, US. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:09:24:00 WinXP 92.46.144.123 (METRO.ONLINE.KZ):
JSC KAZAKHTELECOM KARAGANDA AFFILIATE,
KARAGANDA, WEST KAZAKHSTAN, KZ. (DSL) n/a RU:citi-bank.ru
RU:213.219.245.212:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 39 of 41 90a56936ca
NEW none[none] none:none
none|none none none

T:10:08:00 Win2K-f 24.213.224.238 (RR.COM):
ROAD RUNNER HOLDCO LLC,
AMSTERDAM, NOORD-HOLLAND, NL. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:11:10:00 Win2K-f 174.39.182.193 (WINDSTREAM.NET):
ALLTEL MIP CUSTOMERS - OMAHA,
GLENROCK, WYOMING, US. (DSL) n/a 135 pcap raw alerts
ruleset other
1013 lines Yeah : 1.3
profile none summary
tarball 22 of 41 3c3407a915
NEW none[none] none:none
none|none none none

T:11:53:00 Win2K-f 173.22.161.160 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
SPRINGFIELD, MISSOURI, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 40 of 41
39 of 41 3bff218b8f
NEW
7eaf7b4470
NEW b570b734be [0]
8e0b194526[0] none:none
none:none
tElock|
Armadillo| none
none trace
trace

T:12:07:00 Win2K-f 211.124.142.61 (ZAQ.NE.JP):
J:COM WEST CO. LTD,
TOKYO, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 40 of 41
38 of 40 024410ad21
NEW
b0cedd71bb
NEW 96d0267b80 [0]
f6e156bdca[0] none:none
none:none
tElock|
Armadillo| none
none trace
trace

T:12:58:00 WinXP 4.143.226.102 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
BIG ROCK, ILLINOIS, US. (DSL) n/a 135 pcap raw alerts
ruleset other
3 lines Argh : 0.3
profile none summary
tarball none none none none none none none

T:14:35:00 WinXP 208.100.241.184 (1DIAL.COM):
AD-BASE SYSTEMS INC. (DBA GLOBALPOPS),
SALEM, OREGON, US. (DIAL) n/a RU:citi-bank.ru
RU:213.219.245.212:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 40 of 41 3b569cd1c6
NEW a81c9e968a [0] none:none
PolyEnE| none trace

15:30:00 Win2K-f 81.39.206.161 (RIMA-TDE.NET):
TELEFONICA DE ESPANA,
MADRID, MADRID, ES. (DSL) n/a :google.com
US:204.152.184.139:80 445 pcap raw alerts
ruleset http
23 lines Argh : 0.3
profile none summary
tarball none none none none none none none

16:04:00 Win2K-f 93.80.41.68 (CORBINA.RU):
BROADBAND CUSTOMERS IN MOSCOW,
MOSCOW, MOSCOW CITY, RU. (DSL) n/a :exidj.com
US:shmqbgf.org
US:bdlxbufsyrd.org
:kuziedb.biz
:sgfnz.com
NL:hfsekjbq.org
:acjjxhqf.net
US:qvqgzdwrnnr.info
:nurqwlbjk.biz
:bzemkqji.net
US:microsoft.com
:vethemxhp.net
US:zzgdxjpnjzh.org
US:klpamhvb.org
:rnzyrornrr.org
:jrjbjug.biz
:whepktov.com
US:bmzfhcsl.info
US:orkeumuv.info
:imhwnzat.net
:ooiiqheg.net
:fujdpyhd.com
:cavflxpdtff.com
:ynxuucccnpv.biz
:cgjffpmc.biz
:gpfhbl.biz
:ytchzophocb.biz
:dwxmgdrv.biz
NL:pguqh.info
:khjpodn.net
:yktwzugl.net
FI:194.215.38.3:80
US:204.152.184.139:80
US:74.208.64.145:80 445 pcap raw alerts
ruleset http
14 lines Argh : 0.3
profile none summary
tarball none none none none none none none

16:54:00 Win2K-f 201.91.12.254 (STERLINGSTUDENTS.NET):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) n/a US:www.maxmind.com
:checkip.dyndns.org
US:www.getmyip.org
EU:getmyip.co.uk
DE:131.220.6.26:80
208.78.70.70:80
US:75.126.138.202:80
EU:78.40.35.134:80 445 pcap raw alerts
ruleset http
4 lines Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

T:17:06:00 Win2K-f 110.9.247.15 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
113 lines Yeah : 1.3
profile none summary
tarball 40 of 41
5 of 41 14f47ffd1e
NEW
50437008d9
NEW 90bf4b99ff [0]
c1b09ac5d7[0] none:none
none:none
tElock|
Armadillo| none
none trace
trace

T:17:36:00 Win2K-f 4.227.108.224 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
CLEVELAND, TEXAS, US. (DIAL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

17:52:00 Win2K-f 190.27.162.157 (ETB.NET.CO):
ETB - COLOMBIA,
SANTAFé DE BOGOTá, DISTRITO ESPECIAL, CO. (DSL) n/a US:www.maxmind.com
EU:getmyip.co.uk
US:www.getmyip.org
:checkip.dyndns.org
DE:131.220.6.26:80
208.78.70.70:80
US:75.126.138.202:80
EU:78.40.35.134:80 445 pcap raw alerts
ruleset http
4 lines Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

T:17:55:00 Win2K-f 208.127.63.51 (DSLEXTREME.COM):
DSL EXTREME,
VISTA, CALIFORNIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:19:08:00 Win2K-f 203.114.106.147 (-):
BAMNETNARONGWITAYAKOMSCHOOL,
BANGKOK, KRUNG THEP, TH. (100Mbps) n/a 135 pcap raw alerts
ruleset other
19 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:19:41:00 Win2K-f 24.64.206.230 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
PENTICTON, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
115 lines Yeah : 1.3
profile none summary
tarball 36 of 41
38 of 41 9e6d2e9693
NEW
e8e0baaf38
NEW 89411d91e8 [0]
a5c2c22024[0] none:none
none:none
Armadillo|
tElock| none
none trace
trace

T:19:49:00 Win2K-f 125.4.248.144 (ZAQ.NE.JP):
J:COM WEST CO. LTD,
TOKYO, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 39 of 41
40 of 41 1b1db1c992
NEW
8a50345c2f
NEW a8036b5105 [0]
585123125f[0] none:none
none:none
Armadillo|
tElock| none
none trace
trace

T:20:48:00 Win2K-f 114.72.181.163 (OPTUSNET.COM.AU):
OPTUS INTERNET - RETAIL,
SYDNEY, NEW SOUTH WALES, AU. (DSL) n/a 135 pcap raw alerts
ruleset lanman
shell
shell
shell
1723 lines Yeah : 1.3
profile none summary
tarball 38 of 41 61e2de2884
NEW none[none] none:none
none|none none none

T:21:35:00 WinXP 87.173.106.59 (T-DIALIN.NET):
DEUTSCHE TELEKOM AG,
MAGDEBURG, SACHSEN-ANHALT, DE. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
NEW none[0] none:none
none|none lines=61 trace

T:22:04:00 Win2K-f 98.190.176.113 (COX.NET):
COX COMMUNICATIONS,
OMAHA, NEBRASKA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 41
40 of 41 3b3a6d7615
NEW
b7a694b220
NEW ed7beb96f5 [0]
9f0354af30[0] none:none
none:none
Armadillo|
tElock| none
none trace
trace

T:22:57:00 Win2K-f 98.141.162.11 (CAVTEL.NET):
CAVALIER TELEPHONE,
PHILADELPHIA, PENNSYLVANIA, US. (DSL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:23:19:00 WinXP 61.62.63.98 (SO-NET.NET.TW):
SONY NETWORK TAIWAN LIMITED,
TAIPEI, T'AI-PEI, TW. (DSL) n/a RU:citi-bank.ru
RU:213.219.245.212:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 39 of 41 d8040f84d4
NEW d683995e84 [none] none:none
PolyEnE| none trace