Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

22 December 2009
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:19:00 WinXP 70.232.89.83 (SBCGLOBAL.NET):
AT&T INTERNET SERVICES,
LITTLE ROCK, ARKANSAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:00:21:00 WinXP 81.219.157.99 (COM.PL):
NETIA,
WARSAW, WARSZAWA, PL. (DSL) 213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 39 of 41 ed96c03ca8
NEW c0028e9e98 [0] none:none
PolyEnE| none trace

T:01:45:00 WinXP 130.67.48.99 (ONLINE.NO):
NORTELE-H,
OSLO, OSLO, NO. (DIAL) 92.240.234.164:3305 :cx10man.weedns.com
AR:fx010413.whyI.org
92.240.234.164:3305 445 pcap raw alerts
ruleset shell
ftp
irc
23 lines Yeah : 1.8
profile none summary
tarball 22 of 41 75af48afe4
NEW 7a25f9e3cf [0] none:none
StarForce| none trace

T:02:21:00 WinXP 189.54.239.234 (VIVAX.COM.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
SãO PAULO, SAO PAULO, BR. (DSL) n/a RU:citi-bank.ru
RU:213.219.245.212:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 30 of 30 58b7ccbdb6
NEW none[none] none:none
none|none none none

T:02:21:00 Win2K-f 68.146.136.164 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) 212.54.2.171:3305 JP:cx10man.weedns.com
:fx010413.whyI.org
FI:gynoman.weedns.com
US:g.0x20.biz
FI:telephone.dd.blueline.be
92.240.234.164:3305 135 pcap raw alerts
ruleset irc
614 lines Yeah : 1.8
profile none summary
tarball 39 of 41 9ce56f9f19
NEW 261c9da48f [0] none:none
StarForce| none trace

02:22:00 Win2K-f 86.121.31.243 (RDSNET.RO):
RCS-RDS-FIBERLINK,
BUCHAREST, BUCURESTI, RO. (DSL) n/a US:yahoo.com
NL:www.ask.com
US:nrkwfustwvh.org
:hopediubvp.org
NL:taofiuf.org
:smxxa.biz
:zffisnlaek.net
US:gtqfbieryjr.org
US:lsqmbyxa.org
US:fnjsmdkwxvv.org
:cyhgdeu.org
:oggttqimokt.com
US:msn.com
:atvswjmz.com
:smjsyscc.com
:nvyuznyh.biz
US:yzojadmuzka.org
US:bnyaqqmym.info
:rvzxfioknp.com
:hhvwcxzk.com
US:rzfzqupbpx.info
:brjmajsul.org
NL:eclnbzni.org
US:204.152.184.139:80
GB:212.117.177.140:80
US:74.208.64.145:80
DE:88.198.228.238:65520 445 pcap raw alerts
ruleset http
15 lines Argh : 0.3
profile none summary
tarball none none none none none none none

T:02:45:00 WinXP 4.90.2.94 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
WILLS POINT, TEXAS, US. (DIAL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:02:53:00 WinXP 207.5.161.171 (SUSCOM-MAINE.NET):
GREAT WORKS INTERNET,
BRUNSWICK, MAINE, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

04:14:00 Win2K-f 218.251.37.69 (EONET.NE.JP):
K-OPTICOM CORPORATION,
KYOTO, KYOTO, JP. (DSL) 88.198.228.238:65520 US:msn.com
US:trafficconverter.biz
US:204.152.184.139:80
GB:212.117.177.140:80 445 pcap raw alerts
ruleset irc
25 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

04:36:00 Win2K-f 94.87.146.57 (-):
CASA DI CURE ORESTANO S R L,
IT. (100Mbps) n/a US:www.maxmind.com
EU:getmyip.co.uk
US:www.getmyip.org
:checkip.dyndns.org
208.78.70.70:80
US:67.15.94.80:80
US:75.126.138.202:80
EU:78.40.35.134:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

T:04:49:00 WinXP 4.253.115.20 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
KNOX, INDIANA, US. (DIAL) n/a RU:citi-bank.ru
RU:213.219.245.212:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 36 of 38 5865b09945
NEW 4d99f4784a [0] none:none
PolyEnE| none trace

T:06:04:00 Win2K-f 173.23.174.128 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
SUGAR GROVE, ILLINOIS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 38 of 40
38 of 40 474acf88e5
NEW
68f0c14692
NEW 1f53944b24 [0]
ccc1b24d53[0] none:none
none:none
tElock|
Armadillo| none
none trace
trace

07:19:00 Win2K-f 222.124.189.129 (TELKOM.NET.ID):
PT TELKOM INDONESIA'S CUSTOMER,
JAKARTA, JAKARTA RAYA, ID. (100Mbps) n/a US:www.maxmind.com
:checkip.dyndns.org
US:www.getmyip.org
EU:getmyip.co.uk
208.78.70.70:80
US:67.15.94.80:80
US:75.126.138.202:80
EU:78.40.35.134:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

T:07:27:00 Win2K-f 222.124.189.129 (TELKOM.NET.ID):
PT TELKOM INDONESIA'S CUSTOMER,
JAKARTA, JAKARTA RAYA, ID. (100Mbps) n/a US:www.maxmind.com
:checkip.dyndns.org
DE:131.220.6.26:80 445 pcap raw alerts
ruleset http
5 lines Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

T:07:43:00 Win2K-f 203.82.86.102 (-):
CELCOM INTERNET SERVICE PROVIDER,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
122 lines Yeah : 1.3
profile none summary
tarball 39 of 41
38 of 41 164196d773
NEW
c505f21e5b
NEW 293b07a5b3 [0]
6d77c1618c[0] none:none
none:none
tElock|
Armadillo| none
none trace
trace

08:32:00 Win2K-f 95.165.53.119 (SPDOP.RU):
OJS MOSCOW CITY TELEPHONE NETWORK,
MOSCOW, MOSCOW CITY, RU. (DIAL) n/a US:yahoo.com
:kerqhpz.com
:wxkzqfwe.net
:brszbjgc.com
NL:yyvnwam.org
US:gbubd.org
US:ayzyts.org
US:mavdcb.info
US:vxbzqx.info
:alcjle.biz
:jsaehvu.com
:edstmlst.com
:rzrpk.net
NL:gdcwhbmgy.info
US:frsctfsaawu.info
:iibit.net
US:yzfgcvztor.org
:quvesnto.net
US:krnrufjq.info
:khsslsmlcp.biz
NL:ujgfjoovdg.info
:csijxraurc.net
:jggtdah.com
:eacxznseo.net
:rxpgcadryh.com
:rzfzqupbpx.info
:fzkxmkamo.biz
US:tkhbh.info
:bcyjf.net
US:mnuvehhltzf.info
:yxkrkulcb.biz
US:204.152.184.139:80
GB:212.117.177.140:80
CN:220.181.6.175:80
US:74.208.64.145:80 445 pcap raw alerts
ruleset http
irc
19 lines Argh : 0.3
profile none summary
tarball none none none none none none none

08:53:00 Win2K-f 89.18.23.189 (-):
SC CRISTIANO CAFFE SRL,
BRASOV, BRASOV, RO. (DSL) n/a
FI:194.215.38.3:80
EE:195.50.195.10:443
EE:62.65.192.24:80 445 pcap raw alerts
ruleset irc
6 lines Argh : 0.3
profile none summary
tarball none none none none none none none

T:09:40:00 WinXP 93.102.35.158 (REV.OPTIMUS.PT):
OPTIMUS PORTUGAL,
COIMBRA, COIMBRA, PT. (DSL) n/a :www.google.com.au
US:www.yahoo.com
:jbeegvia.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 31 of 32 17028f1eda
NEW none[3] none:none
tElock| none trace

T:09:40:00 Win2K-f 125.4.1.128 (ZAQ.NE.JP):
J:COM WEST CO. LTD,
OSAKA, OSAKA, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 0 of 32
33 of 33 07fabc79ef
NEW
53bfe15e91
NEW none[0]
1473091351[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=81
lines=75
embedded dns trace
trace

T:11:27:00 Win2K-f 209.33.46.124 (CEBRIDGE.NET):
JASONVILLE IN CUSTOMERS,
JASONVILLE, INDIANA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
96 lines Yeah : 1.3
profile none summary
tarball 39 of 40
0 of 33 7d20fe8724
NEW
a08f3b74a4
NEW a879c90084 [none]
none [0] none:none
none:none
tElock|
Armadillo| none
lines=90 trace
trace

12:25:00 Win2K-f 189.79.102.82 (VELOXZONE.COM.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
RIBEIRãO PRETO, SAO PAULO, BR. (DSL) n/a :google.com
:edstmlst.com
:azujfazy.com
NL:cyhgdeu.org
:hacqmx.com
:blnpcux.net
US:ftqdacuw.org
US:seunj.info
:rzrpk.net
US:ruheclpq.org
:yiyywzqb.com
US:iqtunnrvqxt.info
:vqyzwesic.info
:uizwzy.biz
US:hijqpf.org
:vutstoj.com
:drihkcxi.com
:fzkxmkamo.biz
NL:hopediubvp.org
US:wpkyorsl.org
:yivsacjv.biz
:proxim.ircgalaxy.pl
:xfizjbehr.net
US:eclnbzni.org
US:uwrdtmg.info
:vraurvdcydo.biz
:arwmh.com
:ukmbmthwtvs.biz
:favnjlhz.net
:xhoemm.com
:qcipbe.com
:bswywhtws.biz
US:204.152.184.139:80
GB:212.117.177.140:80
US:74.208.64.145:80 445 pcap raw alerts
ruleset http
14 lines Argh : 0.3
profile none summary
tarball none none none none none none none

T:12:52:00 WinXP 173.170.98.211 (RR.COM):
ROAD RUNNER HOLDCO LLC,
TAMPA, FLORIDA, US. (DSL) n/a 135 pcap raw alerts
ruleset other
1002 lines Yeah : 1.3
profile none summary
tarball 35 of 41 8f5c91b573
NEW none[none] none:none
none|none none none

13:15:00 Win2K-f 91.67.44.149 (SUPERKABEL.DE):
KABEL-DEUTSCHLAND-CUSTOMER-SERVICES,
BERLIN, BERLIN, DE. (DSL) n/a :google.com
DE:131.220.6.26:80
GB:212.117.177.140:80
69.197.161.10:80 445 pcap raw alerts
ruleset http
http
20 lines Argh : 0.3
profile none summary
tarball none none none none none none none

T:14:10:00 Win2K-f 211.124.142.3 (ZAQ.NE.JP):
J:COM WEST CO. LTD,
TOKYO, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 40 of 41
38 of 40 024410ad21
NEW
b0cedd71bb
NEW 96d0267b80 [0]
f6e156bdca[0] none:none
none:none
tElock|
Armadillo| none
none trace
trace

T:14:28:00 WinXP 70.169.190.228 (COX.NET):
COX COMMUNICATIONS,
SANTA BARBARA, CALIFORNIA, US. (DSL) n/a US:gg.arrancar.org
US:72.20.40.25:555 135 pcap raw alerts
ruleset other
356 lines Yeah : 1.3
profile none summary
tarball 39 of 41 74ca348885
NEW 8b0bf5ec45 [0] none:none
none|none none trace

T:14:47:00 WinXP 81.198.145.8 (-):
ADDRESS POOL FOR LTC-HOME CUSTOMERS,
RIGA, RIGA, LV. (DSL) n/a RU:citi-bank.ru
RU:213.219.245.212:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 40 of 41 aab1b56620
NEW 3b2e1c5b9d [0] none:none
PolyEnE| none trace

15:00:00 Win2K-f 219.85.170.57 (SO-NET.NET.TW):
SONY NETWORK TAIWAN LIMITED,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:www.maxmind.com
:checkip.dyndns.org
EU:getmyip.co.uk
US:www.getmyip.org
DE:131.220.6.26:80
208.78.70.70:80
US:75.126.138.202:80
EU:78.40.35.134:80 445 pcap raw alerts
ruleset http
4 lines Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

15:01:00 WinXP 75.187.196.135 (RR.COM):
ROAD RUNNER HOLDCO LLC,
LOS ANGELES, CALIFORNIA, US. (DSL) 213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:15:09:00 Win2K-f 219.85.170.57 (SO-NET.NET.TW):
SONY NETWORK TAIWAN LIMITED,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:www.maxmind.com
EU:getmyip.co.uk
GB:www.vouchercodez.com
:checkip.dyndns.org
US:www.getmyip.org
DE:131.220.6.26:80
208.78.70.70:80
US:67.15.94.80:80
US:75.126.138.202:80
GB:80.82.119.191:80 445 pcap raw alerts
ruleset http
3 lines Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

T:15:20:00 Win2K-f 63.246.122.215 (ALTUSCGI.NET):
PRIVATE CABLE ISP SUBSCRIBER (GEORGETOWN SC MARKET),
GEORGETOWN, SOUTH CAROLINA, US. (DSL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:15:54:00 Win2K-f 118.232.46.247 (KBRONET.COM.TW):
TUNG HO MULTIMEDIA CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
61 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33 53bfe15e91
NEW
b7082104e4
NEW 1473091351 [0]
c5b49e7b82[0] ASM:Graph
ASM:Graph
tElock|
tElock| lines=75
embedded dns
lines=41 trace
trace

16:58:00 WinXP 74.70.239.135 (RR.COM):
ROAD RUNNER HOLDCO LLC,
QUEENSBURY, NEW YORK, US. (DSL) 213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:17:07:00 WinXP 115.165.0.206 (CATV02.ITSCOM.JP):
ITS COMMUNICATIONS INC,
TOKYO, TOKYO, JP. (DSL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:17:44:00 Win2K-f 4.184.218.11 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SILVER SPRING, MARYLAND, US. (DSL) n/a 135 pcap raw alerts
ruleset other
5 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

18:02:00 WinXP 99.53.146.148 (SBCGLOBAL.NET):
AT&T INTERNET SERVICES,
HOUSTON, TEXAS, US. (DSL) n/a RU:citi-bank.ru
RU:213.219.245.212:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 8ae2cc2e80
NEW none[0] ASM:Graph
PolyEnE| lines=68 trace

T:18:53:00 Win2K-f 174.5.168.174 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CA. (DSL) n/a 135 pcap raw alerts
ruleset other
1033 lines Yeah : 1.3
profile none summary
tarball 33 of 40 dceb821a63
NEW none[none] none:none
none|none none none

T:20:13:00 Win2K-f 60.249.37.247 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 34 of 38
35 of 38 38ed850a0e
NEW
b9297745a1
NEW 46990f37cd [0]
4294884d84[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:20:48:00 Win2K-f 63.25.12.170 (UU.NET):
UUNET TECHNOLOGIES INC,
NEW ROADS, LOUISIANA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:21:27:00 WinXP 69.49.221.214 (SRCACCESS.NET):
SANTA ROSA TELEPHONE COOPERATIVE INC,
VERNON, TEXAS, US. (DSL) n/a RU:citi-bank.ru
RU:213.219.245.212:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:22:05:00 WinXP 189.119.83.145 (TIMBRASIL.COM.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) 213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 39 of 40 74b3d149e8
NEW cef0fa2981 [0] none:none
PolyEnE| none trace

T:22:15:00 Win2K-f 216.152.2.100 (-):
CITY OF WILSON,
PEA RIDGE, ARKANSAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:22:28:00 Win2K-f 70.168.11.83 (COX.NET):
COX COMMUNICATIONS,
PROVIDENCE, RHODE ISLAND, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:22:52:00 Win2K-f 66.50.0.39 (PRTC.NET):
PRTC RAS,
SAN JUAN, PUERTO RICO, PR. (DSL) n/a 135 pcap raw alerts
ruleset other
88 lines Yeah : 1.3
profile none summary
tarball 0 of 33 a08f3b74a4
NEW none[0] none:none
Armadillo| lines=90 trace