|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:00:27:00 | Win2K-f | 8.15.172.99 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, BURTONSVILLE, MARYLAND, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 41 38 of 41 |
479439f411 NEW f8ecc34b1c NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:01:37:00 | Win2K-f | 75.37.173.251 (SBCGLOBAL.NET): JASON LEE, PLANO, TEXAS, US. (100Mbps) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:02:53:00 | WinXP | 173.29.252.229 (MCHSI.COM): MEDIACOM COMMUNICATIONS CORP, CHANHASSEN, MINNESOTA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
36 of 41 38 of 40 |
067917e07b NEW d764c1dcb2 NEW |
dae35b319c [0] 3d2bc60c5d[0] |
none:none none:none |
Armadillo| tElock| |
none none |
trace trace |
| T:02:57:00 | WinXP | 60.249.94.30 (HINET.NET): CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP, TAIPEI, T'AI-PEI, TW. (DSL) |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 | d8040f84d4 NEW |
d683995e84 [none] | none:none |
PolyEnE| | none | trace |
| T:06:22:00 | WinXP | 120.138.153.2 (STARCAT.NE.JP): KMN CORPORATION, TOKYO, TOKYO, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 39 of 41 |
5f0937afe0 NEW ad82830bfa NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:07:17:00 | WinXP | 79.162.152.212 (CENTERTEL.PL): PTK CENTERTEL BROADBAND SERVICES, WARSAW, WARSZAWA, PL. (DSL) |
n/a | DE:proxim.ircgalaxy.pl RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
34 of 36 | 9bb68450cd NEW |
c2d5ac2315 [0] | ASM:Graph |
PolyEnE| | lines=73 embedded dns |
trace |
| T:09:58:00 | Win2K-f | 110.32.103.102 (OPTUSNET.COM.AU): OPTUS INTERNET - RETAIL, AU. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 39 of 41 |
e394ef10a4 NEW ee8162dc54 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:10:26:00 | Win2K-f | 98.141.9.96 (CAVTEL.NET): CAVALIER TELEPHONE, VIRGINIA BEACH, VIRGINIA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 18 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:11:19:00 | WinXP | 186.9.27.251 (IMOVIL.ENTELPCS.CL): ENTEL PCS TELECOMUNICACIONES S.A, SANTIAGO, REGION METROPOLITANA, CL. (DSL) |
n/a | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
28 of 40 | 2565e415fe NEW |
none[none] | none:none |
none|none | none | none |
| T:12:12:00 | Win2K-f | 71.136.17.68 (-): MILANO DESIGN, PLANO, TEXAS, US. (100Mbps) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 85 lines |
Yeah : 1.3 profile |
none | summary tarball |
3 of 33 33 of 33 |
73ce2b74da NEW 79c01ec060 NEW |
none[0] 1bfd34056c[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=81 lines=64 embedded dns |
trace trace |
| T:13:01:00 | Win2K-f | 96.8.145.191 (GVTC.COM): GUADALUPE VALLEY TELEPHONE COOPERATIVE INC, NEW BRAUNFELS, TEXAS, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 39 of 41 |
77656a2953 NEW a77e51636f NEW |
13296a6198 [0] c5e16ba6b7[0] |
none:none none:none |
tElock| Armadillo| |
none none |
trace trace |
| T:13:39:00 | Win2K-f | 98.141.30.67 (CAVTEL.NET): CAVALIER TELEPHONE, NORFOLK, VIRGINIA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 18 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:13:42:00 | WinXP | 173.23.173.38 (MCHSI.COM): MEDIACOM COMMUNICATIONS CORP, SUGAR GROVE, ILLINOIS, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 115 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 39 of 41 |
5e3a9c2d9d NEW 630308d06b NEW |
dbc48b815a [0] 847d302e37[0] |
none:none none:none |
tElock| Armadillo| |
none none |
trace trace |
| T:13:45:00 | Win2K-f | 4.240.12.96 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, PHOENIX, ARIZONA, US. (DIAL) |
n/a | 135 | pcap | raw alerts ruleset |
other 10 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:14:46:00 | WinXP | 61.218.193.250 (HINET.NET): CHUNGHWA TELECOM CO. LTD. DATA COMMUNICATION BUSINESS GROUP, TAIPEI, T'AI-PEI, TW. (100Mbps) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 78 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW 57ce4acac2 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:15:57:00 | Win2K-f | 202.157.43.159 (WAKUWAKU-LAND.COM): KUMAMOTO CABLE NETWORK CORPORATION, KUMAMOTO, KUMAMOTO, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:17:08:00 | WinXP | 114.51.128.42 (E-MOBILE.NE.JP): EMOBILE LTD, TOKYO, TOKYO, JP. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 14 lines |
Yeah : 1.3 profile |
none | summary tarball |
37 of 40 | 5285741560 NEW |
60590b8b67 [0] | ASM:Graph |
none|none | lines=59 | trace | |
| T:17:12:00 | Win2K-f | 64.201.180.74 (-): SCENIC SOLUTIONS / GATEWEST, CALGARY, ALBERTA, CA. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 250 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 35 31 of 35 |
039e3fa376 NEW 76f2c59ef8 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
|
| T:17:19:00 | Win2K-f | 64.203.162.93 (NTELOS.NET): NTELOS - LAKEWOOD ADSL RANGE, WAYNESBORO, VIRGINIA, US. (100Mbps) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 35 31 of 35 |
039e3fa376 NEW 76f2c59ef8 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:17:25:00 | WinXP | 99.158.40.21 (PACBELL.NET): AT&T INTERNET SERVICES, HOUSTON, TEXAS, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 59 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 8 of 33 |
53bfe15e91 NEW b7082104e4 NEW |
1473091351 [0] c5b49e7b82[0] |
ASM:Graph ASM:Graph |
tElock| tElock| |
lines=75 embedded dns lines=41 |
trace trace |
| T:17:35:00 | WinXP | 173.19.211.231 (MCHSI.COM): MEDIACOM COMMUNICATIONS CORP, IOWA CITY, IOWA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 111 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 41 39 of 41 |
10759405e0 NEW d08e00dfaf NEW |
292d343248 [0] 854c49d8c4[0] |
none:none none:none |
Armadillo| tElock| |
none none |
trace trace |
| T:18:45:00 | Win2K-f | 110.11.32.58 (-): HANARO TELECOM, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 113 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 5 of 41 |
14f47ffd1e NEW 50437008d9 NEW |
90bf4b99ff [0] c1b09ac5d7[0] |
none:none none:none |
tElock| Armadillo| |
none none |
trace trace |
| T:18:58:00 | Win2K-f | 75.49.16.90 (SBCGLOBAL.NET): AT&T INTERNET SERVICES, COLUMBUS, OHIO, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| 19:05:00 | Win2K-f | 190.231.219.78 (NET.AR): TELECOM ARGENTINA S.A, AR. (DSL) |
n/a | EE:www.starman.ee FI:www.if.ee US:trafficconverter.biz FI:194.215.38.3:80 US:204.152.184.139:80 EE:62.65.192.24:80 |
445 | pcap | raw alerts ruleset |
other 0 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| 20:01:00 | Win2K-f | 189.25.33.29 (VELOXZONE.COM.BR): COMITE GESTOR DA INTERNET NO BRASIL, RIO DE JANEIRO, RIO DE JANEIRO, BR. (DSL) |
n/a | EE:www.starman.ee :google.com US:msn.com DE:proxim.ircgalaxy.pl US:microsoft.com FI:194.215.38.3:80 EE:195.50.195.10:443 |
445 | pcap | raw alerts ruleset |
http 8 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| 20:21:00 | Win2K-f | 213.27.146.236 (COLT.NET): COLT TELECOM GMBH, MADRID, MADRID, ES. (100Mbps) |
n/a | US:yahoo.com EE:www.starman.ee US:microsoft.com DE:proxim.ircgalaxy.pl :google.com FI:194.215.38.3:80 EE:195.50.195.10:443 |
445 | pcap | raw alerts ruleset |
http 20 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:20:30:00 | WinXP | 218.211.83.237 (SPARQNET.NET): NEW CENTRY INFOCOM TECH. CO. LTD, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| 20:31:00 | Win2K-f | 59.96.103.70 (10/24.BSNL.IN): NIB (NATIONAL INTERNET BACKBONE), HYDERABAD, ANDHRA PRADESH, IN. (DSL) |
n/a | US:msn.com DE:proxim.ircgalaxy.pl EE:www.starman.ee US:microsoft.com US:cnn.com FI:194.215.38.3:80 EE:195.50.195.10:443 |
445 | pcap | raw alerts ruleset |
http 14 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:20:39:00 | Win2K-f | 114.203.132.56 (-): HANARO TELECOM, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
193.104.94.11:65520 | CN:proxima.ircgalaxy.pl US:microsoft.com CN:down1130.iwillhavesexygirls.com CN:1130.kfgrtjer.cn :bfkq.com :jsactivity.com US:search.toptravellingtips.com US:208.43.250.167:80 |
135 | pcap | raw alerts ruleset |
irc http 214 lines |
Yeah : 1.8 profile |
none | summary tarball |
31 of 33 11 of 41 31 of 33 15 of 41 0 of 41 6 of 41 14 of 41 |
168aab35a3 NEW 2102e402d1 NEW 667f0c59f3 NEW 992ba5790f NEW b446326616 NEW d61a351c60 NEW e5fd00eddc NEW |
60b730b97e [0] none [none] 8fe2be2095[0] none [none] none [none] none [none] none [none] |
ASM:Graph none:none ASM:Graph none:none none:none none:none none:none |
tElock| none|none Armadillo| none|none none|none none|none none|none |
lines=120 embedded dns none lines=91 none none none none |
trace none trace none none none none |
| T:20:50:00 | Win2K-f | 166.225.112.165 (MYVZW.COM): SERVICE PROVIDER CORPORATION, CHICAGO, ILLINOIS, US. (DSL) |
n/a | :search.trendd.co.uk :search.creativeblackandwhitephotography.com EU:www.creativeblackandwhitephotography.com :search.traveleuropesecrets.com EU:www.traveleuropesecrets.com US:166.225.112.165:707 174.36.138.67:80 EU:77.68.59.22:80 |
135 | pcap | raw alerts ruleset |
irc http 150 lines |
Argh : 0.3 profile |
none | summary tarball |
11 of 41 | 7151650ccd NEW |
none[none] | none:none |
none|none | none | none |
| 20:51:00 | Win2K-f | 83.96.34.215 (-): AL-NAHYAWISH-AND-AL-SULTI-GENERAL-TRADING, KUWAIT, AL KUWAYT, KW. (100Mbps) |
88.198.228.238:65520 | :google.com US:search.toptravellingtips.com CN:down1130.iwillhavesexygirls.com CN:1130.kfgrtjer.cn :wws.mobiec.net :jsactivity.com US:yahoo.com :xz.ub9.net :supercondition.com :fantasyfootballline.com US:search.articleswave.co.uk US:nearplace.com :sendfan.com FI:194.215.38.3:80 US:204.152.184.139:80 EE:62.65.192.24:80 |
445 | pcap | raw alerts ruleset |
http irc 118 lines |
Yeah : 1.3 profile |
none | summary tarball |
11 of 41 0 of 41 15 of 41 6 of 41 26 of 41 14 of 41 |
2102e402d1 NEW 23eea951f1 NEW 992ba5790f NEW d61a351c60 NEW dd96e88e03 NEW e5fd00eddc NEW |
none[none] none [none] none [none] none [none] 6f87541765[0] none [none] |
none:none none:none none:none none:none none:none none:none |
none|none none|none none|none none|none StarForce| none|none |
none none none none none none |
none none none none trace none |
| 21:01:00 | Win2K-f | 174.0.249.183 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, CALGARY, ALBERTA, CA. (DSL) |
n/a | US:cnn.com EE:www.starman.ee :search.traveleuropesecrets.com US:residentialfireproofsafes.com US:microsoft.com US:domaingrasp.com US:weddingshoweractivities.com US:fullsizehorses.com :search.mynextkitchen.com :doebleclick.com US:www.hophealth.com :publicsservices.com |
445 | pcap | raw alerts ruleset |
irc 15 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:21:13:00 | Win2K-f | 90.188.92.151 (TOMSKNET.RU): OJSC SIBIRTELECOM, MOSCOW, MOSCOW CITY, RU. (DSL) |
88.198.228.238:65520 | CN:proxima.ircgalaxy.pl CN:down1130.iwillhavesexygirls.com CN:1130.kfgrtjer.cn 174.36.138.72:80 DE:88.198.228.238:65520 |
445 | pcap | raw alerts ruleset |
irc http 12 lines |
Yeah : 1.3 profile |
none | summary tarball |
15 of 41 14 of 41 |
992ba5790f NEW e5fd00eddc NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:22:12:00 | Win2K-f | 110.12.207.138 (-): HANARO TELECOM, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
88.198.228.238:65520 | US:microsoft.com DE:proxim.ircgalaxy.pl CN:down1130.iwillhavesexygirls.com CN:1130.kfgrtjer.cn :bfkq.com :jsactivity.com US:search.toptravellingtips.com US:208.43.250.167:80 |
135 | pcap | raw alerts ruleset |
irc http 230 lines |
Yeah : 1.8 profile |
none | summary tarball |
11 of 41 0 of 41 29 of 32 28 of 32 15 of 41 6 of 41 14 of 41 |
2102e402d1 NEW 6fe24296e9 NEW 8a75955033 NEW 9276c8b36b NEW 992ba5790f NEW d61a351c60 NEW e5fd00eddc NEW |
none[none] none [none] 2bf3e548b9[0] none [0] none [none] none [none] none [none] |
none:none none:none ASM:Graph ASM:Graph none:none none:none none:none |
none|none none|none tElock| Armadillo| none|none none|none none|none |
none none lines=126 embedded dns lines=81 none none none |
none none trace trace none none none |
| T:22:24:00 | Win2K-f | 93.80.238.54 (CORBINA.RU): BROADBAND CUSTOMERS IN MOSCOW, MOSCOW, MOSCOW CITY, RU. (DSL) |
88.198.228.238:65520 | :searchchocolates.com US:autonlines.com DE:proxim.ircgalaxy.pl CN:down1130.iwillhavesexygirls.com CN:1130.kfgrtjer.cn US:microsoft.com |
445 | pcap | raw alerts ruleset |
http irc 41 lines |
Yeah : 1.3 profile |
none | summary tarball |
11 of 41 15 of 41 14 of 41 |
7151650ccd NEW 992ba5790f NEW e5fd00eddc NEW |
none[none] none [none] none [none] |
none:none none:none none:none |
none|none none|none none|none |
none none none |
none none none |
| T:22:46:00 | Win2K-f | 98.141.160.56 (CAVTEL.NET): CAVALIER TELEPHONE, PHILADELPHIA, PENNSYLVANIA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 18 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| 22:51:00 | Win2K-f | 125.86.38.157 (163DATA.COM.CN): CHINANET CHONGQING PROVINCE NETWORK, CHONGQING, CHONGQING, CN. (DSL) |
n/a | US:yahoo.com :www.backblogs.com :in1.7cy.net US:moldingalternatives.com US:images01.tzimg.com US:domdex.com :b.collective-media.net :a.collective-media.net :ad.yieldmanager.com US:ad.adtegrity.net US:microsoft.com :www.focusdrink.com :maximumdanger.com US:msn.com FI:194.215.38.3:80 US:204.152.184.139:80 GB:212.117.177.140:80 EE:62.65.192.24:80 |
445 | pcap | raw alerts ruleset |
http irc 41 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:23:51:00 | Win2K-f | 211.209.166.16 (HANANET.NET): HANARO TELECOM INC, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
88.198.228.238:65520 | US:microsoft.com CN:proxima.ircgalaxy.pl CN:www.liagand.cn CN:av.lometr.pl CN:down1130.iwillhavesexygirls.com CN:1130.kfgrtjer.cn :bfkq.com :jsactivity.com US:search.toptravellingtips.com :www.toptravellingtips.com 173.45.105.218:8392 DE:88.198.228.238:65520 |
135 | pcap | raw alerts ruleset |
irc http 206 lines |
Yeah : 1.8 profile |
none | summary tarball |
31 of 33 23 of 41 31 of 33 0 of 41 15 of 41 5 of 41 14 of 41 2 of 41 |
168aab35a3 NEW 357486dae7 NEW 667f0c59f3 NEW 98a9cbb16d NEW 992ba5790f NEW d697b76f39 NEW e5fd00eddc NEW ef725f64f4 NEW |
60b730b97e [0] none [none] 8fe2be2095[0] none [none] none [none] none [none] none [none] none [none] |
ASM:Graph none:none ASM:Graph none:none none:none none:none none:none none:none |
tElock| none|none Armadillo| none|none none|none none|none none|none none|none |
lines=120 embedded dns none lines=91 none none none none none |
trace none trace none none none none none |