Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

10 January 2010
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:07:00 Win2K-f 113.252.30.134 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HK. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
99 lines Yeah : 1.3
profile none summary
tarball 40 of 41
38 of 41 a5ceb6c29d
NEW
adadfc0e1c
NEW d64cd9d18b [0]
0f57439d82[0] none:none
ASM:Graph
tElock|
tElock| none
lines=64
embedded dns trace
trace

T:01:43:00 WinXP 79.162.177.197 (CENTERTEL.PL):
PTK CENTERTEL BROADBAND SERVICES,
WARSAW, WARSZAWA, PL. (DSL) n/a DE:proxim.ircgalaxy.pl
RU:citi-bank.ru
FR:193.104.94.11:65520 445 pcap raw alerts
ruleset http
irc
3 lines Yeah : 0.8
profile none summary
tarball 34 of 36 9bb68450cd
NEW c2d5ac2315 [0] ASM:Graph
PolyEnE| lines=73
embedded dns trace

T:01:50:00 Win2K-f 70.184.208.123 (COX.NET):
COX COMMUNICATIONS,
COUNCIL BLUFFS, IOWA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
112 lines Yeah : 1.3
profile none summary
tarball 39 of 41
40 of 41 3b3a6d7615
NEW
b7a694b220
NEW ed7beb96f5 [0]
9f0354af30[0] none:none
none:none
Armadillo|
tElock| none
none trace
trace

T:02:18:00 Win2K-f 75.49.23.241 (SBCGLOBAL.NET):
AT&T INTERNET SERVICES,
COLUMBUS, OHIO, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:02:19:00 WinXP 64.201.180.138 (-):
SCENIC SOLUTIONS / GATEWEST,
CALGARY, ALBERTA, CA. (DSL) n/a 135 pcap raw alerts
ruleset other
4 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

02:36:00 Win2K-f 124.10.134.22 (TFN.NET.TW):
TAIWAN FIXED NETWORK CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:www.maxmind.com
US:www.getmyip.org
:checkip.dyndns.org
EU:getmyip.co.uk
208.78.70.70:80
US:67.15.94.80:80
EU:78.40.35.134:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

T:02:45:00 Win2K-f 124.10.134.22 (TFN.NET.TW):
TAIWAN FIXED NETWORK CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:www.maxmind.com
EU:getmyip.co.uk
US:www.getmyip.org
:checkip.dyndns.org
DE:131.220.6.26:80
208.78.70.70:80
US:75.126.138.202:80
EU:78.40.35.134:80 445 pcap raw alerts
ruleset http
3 lines Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

T:02:58:00 Win2K-f 173.29.206.132 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
CHANHASSEN, MINNESOTA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
116 lines Yeah : 1.3
profile none summary
tarball 38 of 41
39 of 41 10759405e0
NEW
d08e00dfaf
NEW 292d343248 [0]
854c49d8c4[0] none:none
none:none
Armadillo|
tElock| none
none trace
trace

T:04:22:00 WinXP 113.255.89.223 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) n/a US:gg.arrancar.org
US:72.20.40.25:555 135 pcap raw alerts
ruleset other
182 lines Yeah : 1.3
profile none summary
tarball 37 of 41 7c7d5bd68d
NEW 25c505d17c [0] none:none
StarForce| none trace

T:04:43:00 Win2K-f 123.215.250.153 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 88.198.228.238:65520 US:microsoft.com
DE:proxim.ircgalaxy.pl
EU:pozeml.com
:pozemle.cn
CN:down1130.iwillhavesexygirls.com
CN:210.51.36.215:88 135 pcap raw alerts
ruleset irc
http
111 lines Yeah : 1.8
profile none summary
tarball 30 of 33
11 of 41
2 of 35
30 of 41 6ec2a8994b
NEW
a2ce42b73d
NEW
bcf66a38c8
NEW
dcfa61d8b9
NEW 398aab9636 [0]
none [none]
570133b348[0]
none [none] none:none
none:none
none:none
none:none
tElock|
none|none
Armadillo|
none|none none
none
none
none trace
none
trace
none

T:04:57:00 Win2K-f 187.15.70.228 (VELOXZONE.COM.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) 193.104.94.11:65520 88.198.228.238:65520 DE:proxim.ircgalaxy.pl
CN:down1130.iwillhavesexygirls.com
CN:210.51.36.215:88 445 pcap raw alerts
ruleset irc
15 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:06:05:00 Win2K-f 110.10.49.252 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 88.198.228.238:65520 DE:proxima.ircgalaxy.pl
US:microsoft.com
CN:www.liagand.cn
CN:down1130.iwillhavesexygirls.com
CN:210.51.36.215:88
DE:88.198.228.238:65520 135 pcap raw alerts
ruleset irc
http
104 lines Yeah : 1.8
profile none summary
tarball 34 of 36
29 of 32 99b248336f
NEW
9d677c3f70
NEW c64bd1a776 [0]
77e75ff10f[0] none:none
none:none
Armadillo|
tElock| none
none trace
trace

T:06:30:00 Win2K-f 71.113.241.28 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
COLLEGE STATION, TEXAS, US. (DSL) 88.198.228.238:65520 CN:av.lometr.pl
US:microsoft.com
CN:210.51.36.215:88 445 pcap raw alerts
ruleset irc
http
5 lines Yeah : 0.8
profile none summary
tarball 23 of 41 357486dae7
NEW none[none] none:none
StarForce| none trace

T:07:37:00 WinXP 93.156.59.191 (CM-93-156-59-10.TELECABLE.ES):
TELECABLE,
OVIEDO, ASTURIAS, ES. (DSL) n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
NEW none[0] none:none
PolyEnE| lines=93
embedded dns trace

T:09:08:00 WinXP 89.246.220.243 (VERSANET.DE):
VERSATEL DEUTSCHLAND,
DRESDEN, SACHSEN, DE. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
NEW none[0] none:none
none|none lines=61 trace

T:09:36:00 Win2K-f 4.184.93.222 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
WESTFIELD, NEW JERSEY, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:09:56:00 WinXP 87.57.135.56 (DSL.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
ÅRHUS, ARHUS, DK. (DSL) 213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 38 of 40 624d43be60
NEW 3caff61b75 [0] ASM:Graph
PolyEnE| lines=68 trace

T:10:02:00 Win2K-f 96.10.159.139 (RR.COM):
ROAD RUNNER HOLDCO LLC,
CHARLOTTE, NORTH CAROLINA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 40 of 41
39 of 41 77656a2953
NEW
a77e51636f
NEW 13296a6198 [0]
c5e16ba6b7[0] ASM:Graph
none:none
tElock|
Armadillo| lines=64
embedded dns
none trace
trace

T:10:33:00 WinXP 67.55.129.163 (NETINS.NET):
CENTRAL SCOTT TELEPHONE,
BLAIR, NEBRASKA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
113 lines Yeah : 1.3
profile none summary
tarball 39 of 41
39 of 41 80c29763f9
NEW
da5bc651fe
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:10:51:00 Win2K-f 72.64.30.16 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
CHARLESTON, WEST VIRGINIA, US. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:11:25:00 Win2K-f 98.135.70.252 (WINDSTREAM.NET):
ALLTEL SIP CUSTOMERS - ATLANTA,
GLENWOOD, GEORGIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 41
39 of 41 53aa804019
NEW
95ddd4a823
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:12:32:00 WinXP 84.74.106.81 (HISPEED.CH):
CABLECOMMAIN-NET,
ZURICH, ZURICH, CH. (DSL) 213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 32 of 32 8b1ad60e08
NEW 0a6966b7f1 [0] ASM:Graph
PolyEnE| lines=68 trace

T:12:53:00 Win2K-f 60.249.37.247 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
112 lines Yeah : 1.3
profile none summary
tarball 34 of 38
35 of 38 38ed850a0e
NEW
b9297745a1
NEW 46990f37cd [0]
4294884d84[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:14:06:00 WinXP 174.0.153.126 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
117 lines Yeah : 1.3
profile none summary
tarball 39 of 41
39 of 41 67621eedc5
NEW
749cc9507f
NEW 034f915ad9 [none]
1bf5a5bcd5[none] none:none
none:none
tElock|
Armadillo| none
none trace
trace

T:14:37:00 Win2K-f 98.141.30.67 (CAVTEL.NET):
CAVALIER TELEPHONE,
NORFOLK, VIRGINIA, US. (DSL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:15:33:00 WinXP 208.126.137.156 (NETINS.NET):
MINBURN TELECOMMUNICATIONS,
CLEAR LAKE, IOWA, US. (DSL) n/a US:gg.arrancar.org
US:72.20.40.25:555 135 pcap raw alerts
ruleset other
189 lines Yeah : 1.3
profile none summary
tarball 40 of 41 23801a9149
NEW none[none] none:none
none|none none none

T:17:12:00 WinXP 98.148.245.242 (RR.COM):
ROAD RUNNER HOLDCO LLC,
LANCASTER, CALIFORNIA, US. (DSL) n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
NEW none[0] none:none
PolyEnE| lines=93
embedded dns trace

T:18:22:00 Win2K-f 67.150.54.190 (MDSG-PACWEST.COM):
PAC-WEST MANAGED MODEM NAS POOL,
SANTA CLARA, CALIFORNIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
192 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

19:44:00 Win2K-f 201.213.242.104 (NET.AR):
PRIMA S.A,
BUENOS AIRES, BUENOS AIRES, AR. (DSL) n/a US:www.maxmind.com
EU:getmyip.co.uk
US:www.getmyip.org
:checkip.dyndns.org
US:67.15.94.80:80
EU:78.40.35.134:80 445 pcap raw alerts
ruleset http
3 lines Yeah : 0.8
profile none summary
tarball 3 of 37 dc331fb791
NEW none[3] none:none
UPX| none trace

T:20:22:00 WinXP 67.150.173.244 (MDSG-PACWEST.COM):
PAC-WEST MANAGED MODEM NAS POOL,
LOS ANGELES, CALIFORNIA, US. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
16 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
NEW none[0] none:none
none|none lines=61 trace

T:21:15:00 Win2K-f 174.3.207.80 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
226 lines Yeah : 1.3
profile none summary
tarball 37 of 41
38 of 41 4180c19d91
NEW
b6e91e001c
NEW 9f3f2de385 [0]
d2275a6cf5[0] none:none
none:none
Armadillo|
PolyEnE| none
none trace
trace

T:21:28:00 Win2K-f 4.242.174.244 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
PORTLAND, OREGON, US. (DIAL) n/a 135 pcap raw alerts
ruleset other
136 lines Yeah : 1.3
profile none summary
tarball 0 of 32 73f1082158
NEW none[0] none:none
Armadillo| lines=90 trace

T:21:43:00 Win2K-f 70.184.248.143 (COX.NET):
COX COMMUNICATIONS,
TULSA, OKLAHOMA, US. (DSL) 88.198.228.238:65520 US:microsoft.com
FR:proxim.ircgalaxy.pl
CN:av.lometr.pl
CN:down1130.iwillhavesexygirls.com
CN:210.51.36.215:88 135 pcap raw alerts
ruleset irc
http
135 lines Yeah : 1.8
profile none summary
tarball 23 of 41
32 of 33
29 of 33 357486dae7
NEW
87e1117f2a
NEW
b4fe4581c3
NEW none[none]
3ff643aae6[0]
599b835896[0] none:none
none:none
none:none
StarForce|
tElock|
Armadillo| none
none
none trace
trace
trace

T:22:18:00 Win2K-f 66.53.120.61 (MDSG-PACWEST.COM):
PAC-WEST MANAGED MODEM NAS POOL,
SACRAMENTO, CALIFORNIA, US. (DSL) n/a 135 pcap raw alerts
ruleset other
44 lines Yeah : 1.3
profile none summary
tarball 5 of 41 f76669a1f0
NEW none[none] none:none
none|none none none

T:23:13:00 Win2K-f 72.64.108.128 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
CARROLLTON, TEXAS, US. (DSL) 92.240.234.164:3305 :cx10man.weedns.com
FI:fx010413.whyI.org
92.240.234.164:3305 135 pcap raw alerts
ruleset irc
698 lines Yeah : 1.8
profile none summary
tarball 34 of 41 deffdf68e8
NEW 2b011e15ba [0] none:none
StarForce| none trace

T:23:23:00 Win2K-f 65.34.30.26 (RR.COM):
ROAD RUNNER HOLDCO LLC,
CLERMONT, FLORIDA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace