Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

01 February 2010
<prev>   <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.


Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]
Time
 		Victim
OS
 		Infection
Source
 		C&C
Server
 		DNS Lookups &
Failed Connects 		Infection
Port
 		Packet
Trace
 		Detection
Signatures
 		Infection
Chatter
 		BotHunter
Analysis
 		Behavioral
Cluster
 		Forensic
Logs
 		Antivirus
Labels
 		Packed Malware_Binary Unpacked egg.exe
 		Unpacked egg.asm
 		Packer PEID
 		Data Strings
 		Syscall Trace
T:00:17:00 Win2K-f 110.12.83.230 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		40 of 41
5 of 41		 14f47ffd1e
NEW
50437008d9
NEW 		90bf4b99ff [0]
c1b09ac5d7[0] 		none:none
none:none
 tElock|
Armadillo| 		none
none 		trace
trace
T:00:48:00 WinXP 59.104.150.29 (SEED.NET.TW):
SEEDNET-KAOHSIUNGDP-S,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a RU:citi-bank.ru
RU:213.219.245.212:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 ff1c4cc0ba
NEW 		none[none] none:none
 none|none none none
T:01:31:00 Win2K-f 219.251.103.60 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 		88.198.228.238:65520 US:microsoft.com
CN:proxima.ircgalaxy.pl
CN:stashonline.info
CN:down1130.iwillhavesexygirls.com
EU:pozeml.com
CN:config1130.iwillhavesexygirls.com
US:bfkq.com
:pozemle.cn
US:mjjia.cn
:braverhotels.com
CN:hotelseas.com
:jsactivity.com
:img.ub8.net
:xz.ub9.net
US:search.toptravellingtips.com
204.27.57.154:8392
US:208.43.250.167:80 		135 pcap raw alerts
ruleset 		irc
http
181 lines 		Yeah : 1.8
profile 		none summary
tarball 		4 of 41
31 of 33
15 of 40
13 of 41
13 of 40
9 of 39
4 of 41
0 of 33
11 of 41
5 of 41
26 of 41
0 of 41		 08cd162574
NEW
1509c8d024
NEW
1c134cba22
NEW
3e6e748549
NEW
74221701ed
NEW
7a49ac43a9
NEW
8e7cffa818
NEW
a08f3b74a4
NEW
a2ce42b73d
NEW
b6cd57d0d4
NEW
dd96e88e03
NEW
ea27c44760
NEW 		none[none]
3445f2ac2c[4]
none [none]
none [none]
none [none]
none [none]
none [none]
none [0]
none [none]
none [none]
6f87541765[0]
none [none] 		none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
 none|none
tElock|
none|none
none|none
none|none
none|none
none|none
Armadillo|
none|none
none|none
StarForce|
none|none 		none
none
none
none
none
none
none
lines=90
none
none
none
none 		none
trace
none
none
none
none
none
trace
none
none
trace
none
T:01:39:00 Win2K-f 95.28.154.94 (CORBINA.RU):
INVESTELEKTROSVIAZ LTD,
MOSCOW, MOSCOW CITY, RU. (100Mbps) 		218.93.201.51:65520 :in1.7cy.net
US:search.musicforher.com
:braverhotels.com
CN:hotelseas.com
:xz.ub9.net
CN:proxima.ircgalaxy.pl
:in.7cy.net
CN:down1130.iwillhavesexygirls.com
CN:config1130.iwillhavesexygirls.com
EU:pozeml.com
US:mjjia.cn
:pozemle.cn
:img.ub8.net
174.133.57.140:80
CN:218.93.201.51:65520
74.86.72.226:80
98.126.46.210:80 		445 pcap raw alerts
ruleset 		http
irc
25 lines 		Yeah : 1.3
profile 		none summary
tarball 		4 of 41
15 of 40
13 of 41
13 of 40
4 of 41
11 of 41
26 of 41		 08cd162574
NEW
1c134cba22
NEW
3e6e748549
NEW
74221701ed
NEW
8e7cffa818
NEW
a2ce42b73d
NEW
dd96e88e03
NEW 		none[none]
none [none]
none [none]
none [none]
none [none]
none [none]
6f87541765[0] 		none:none
none:none
none:none
none:none
none:none
none:none
none:none
 none|none
none|none
none|none
none|none
none|none
none|none
StarForce| 		none
none
none
none
none
none
none 		none
none
none
none
none
none
trace
T:02:38:00 WinXP 202.78.146.124 (TELSTRACLEAR.NET):
TELSTRACLEAR WELLINGTON CABLE CUSTOMERS,
WELLINGTON, WELLINGTON, NZ. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:02:44:00 Win2K-f 208.110.56.90 (-):
PRIVATE CABLE ISP SUBSCRIBER (SCHAUMBURG IL MARKET),
JONESBORO, GEORGIA, US. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
71 lines 		Yeah : 1.3
profile 		none summary
tarball 		3 of 33 73ce2b74da
NEW 		none[0] ASM:Graph
 Armadillo| lines=81 trace
T:02:51:00 Win2K-f 24.213.224.238 (RR.COM):
ROAD RUNNER HOLDCO LLC,
AMSTERDAM, NOORD-HOLLAND, NL. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:03:02:00 WinXP 94.153.199.219 (KYIVSTAR.NET):
UA-KYIVSTAR,
UA. (DSL) 		213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 1fcc146d70
NEW 		none[0] none:none
 PolyEnE| lines=68 trace
T:03:21:00 WinXP 83.27.162.157 (TPNET.PL):
NEOSTRADA PLUS,
POZNAN, WIELKOPOLSKIE, PL. (DSL) 		n/a DE:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
GB:welcome3.smile.co.uk
:wpad
RU:www.bbin.ru
RU:195.200.213.54:80
GB:195.92.84.198:80
US:204.13.161.51:80
EU:78.47.200.154:80 		445 pcap raw alerts
ruleset 		http
http
http
http
18 lines 		Yeah : 0.8
profile 		none summary
tarball 		28 of 29
0 of 40
0 of 40
0 of 40		 330eaa2da2
NEW
68da5583ff
NEW
9e413ceed6
NEW
f006583c87
NEW 		none[3]
none [none]
none [none]
none [none] 		none:none
none:none
none:none
none:none
 ASPack|
none|none
none|none
none|none 		none
none
none
none 		trace
none
none
none
T:03:47:00 Win2K-f 122.49.244.141 (CCNET-AI.NE.JP):
COMMUNITY NETWORK CENTER INC,
TOYOKAWA, AICHI, JP. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 32
33 of 33		 07fabc79ef
NEW
53bfe15e91
NEW 		none[0]
1473091351[0] 		ASM:Graph
ASM:Graph
 Armadillo|
tElock| 		lines=81
lines=75
embedded dns 		trace
trace
T:05:42:00 Win2K-f 173.31.107.94 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
MIDDLETOWN, NEW YORK, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		38 of 40
38 of 40		 474acf88e5
NEW
68f0c14692
NEW 		1f53944b24 [0]
ccc1b24d53[0] 		none:none
none:none
 tElock|
Armadillo| 		none
none 		trace
trace
T:08:04:00 Win2K-f 208.54.186.95 (CENTENNIALPR.NET):
CENTENNIAL DE PUERTO RICO,
SAN JUAN, PUERTO RICO, PR. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
1011 lines 		Yeah : 1.3
profile 		none summary
tarball 		8 of 41 5b102561f4
NEW 		none[none] none:none
 none|none none none
T:13:13:00 Win2K-f 24.178.114.74 (CHARTER.COM):
CHARTER COMMUNICATIONS,
COLUMBUS, GEORGIA, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:14:37:00 Win2K-f 63.28.82.38 (UU.NET):
UUNET TECHNOLOGIES INC,
UPPER MARLBORO, MARYLAND, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:15:18:00 WinXP 65.30.32.222 (RR.COM):
ROAD RUNNER HOLDCO LLC,
OVERLAND PARK, KANSAS, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
80 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:15:24:00 Win2K-f 75.37.173.251 (SBCGLOBAL.NET):
JASON LEE,
PLANO, TEXAS, US. (100Mbps) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:16:14:00 WinXP 189.54.229.134 (VIVAX.COM.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
SãO PAULO, SAO PAULO, BR. (DSL) 		n/a RU:citi-bank.ru
RU:213.219.245.212:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		30 of 30 58b7ccbdb6
NEW 		53937b69cf [none] none:none
 PolyEnE| none trace
T:16:44:00 Win2K-f 4.179.44.117 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SEATTLE, WASHINGTON, US. (DIAL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
89 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
16:45:00 Win2K-f 173.45.80.139 (XLHOST.COM):
XLHOST.COM INC,
COLUMBUS, OHIO, US. (100Mbps) 		n/a US:www.maxmind.com
:checkip.dyndns.org
EU:getmyip.co.uk
US:www.getmyip.org
208.78.70.70:80
US:67.15.94.80:80
EU:78.40.35.134:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 dc331fb791
NEW 		none[3] none:none
 UPX| none trace
17:09:00 Win2K-f 85.95.147.44 (ROSMORPORT.RU):
PORTTELEKOM LLC 9 STRELNIKOVA ST. AREA SUBSCRIBERS,
MOSCOW, MOSCOW CITY, RU. (100Mbps) 		n/a US:www.maxmind.com
US:www.getmyip.org
EU:getmyip.co.uk
GB:www.vouchercodez.com
:checkip.dyndns.org
208.78.70.70:80
US:67.15.94.80:80 		445 pcap raw alerts
ruleset 		http
4 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:17:12:00 Win2K-f 24.86.104.142 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
BURNABY, BRITISH COLUMBIA, CA. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
146 lines 		Yeah : 1.3
profile 		none summary
tarball 		38 of 40
37 of 40		 00327cc937
NEW
633aacde3b
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:17:17:00 Win2K-f 85.95.147.44 (ROSMORPORT.RU):
PORTTELEKOM LLC 9 STRELNIKOVA ST. AREA SUBSCRIBERS,
MOSCOW, MOSCOW CITY, RU. (100Mbps) 		n/a US:www.maxmind.com
:checkip.dyndns.org
US:www.getmyip.org
EU:getmyip.co.uk
208.78.70.70:80
US:67.15.94.80:80
US:75.126.138.202:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:18:32:00 WinXP 4.153.81.73 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
EASTMAN, GEORGIA, US. (DIAL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
82 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
19:32:00 WinXP 122.132.42.237 (MESH.AD.JP):
NEC BIGLOBE LTD,
YOKOHAMA, KANAGAWA, JP. (DSL) 		n/a RU:citi-bank.ru
RU:213.219.245.212:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
NEW 		none[0] none:none
 PolyEnE| lines=68 trace
T:20:55:00 WinXP 186.9.23.100 (IMOVIL.ENTELPCS.CL):
ENTEL PCS TELECOMUNICACIONES S.A,
SANTIAGO, REGION METROPOLITANA, CL. (DSL) 		n/a RU:citi-bank.ru
RU:213.219.245.212:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		39 of 39 96924b5583
NEW 		none[none] none:none
 none|none none none
T:21:03:00 Win2K-f 4.174.254.90 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
PHILADELPHIA, PENNSYLVANIA, US. (DIAL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
78 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:21:51:00 WinXP 4.177.18.110 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SAN DIEGO, CALIFORNIA, US. (DIAL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
112 lines 		Yeah : 1.3
profile 		none summary
tarball 		37 of 41
36 of 40		 47d3548e36
NEW
d8722af110
NEW 		ab13346633 [0]
ab30a55931[0] 		none:none
none:none
 Armadillo|
tElock| 		none
none 		trace
trace
22:03:00 Win2K-f 117.34.79.93 (163DATA.COM.CN):
CHINANET SHANXI(SN) PROVINCE NETWORK,
BEIJING, BEIJING, CN. (DSL) 		n/a US:www.maxmind.com
EU:getmyip.co.uk
GB:www.vouchercodez.com
:checkip.dyndns.org
US:www.getmyip.org
208.78.70.70:80
US:67.15.94.80:80
US:75.126.138.202:80
GB:80.82.121.239:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace