|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:00:32:00 | Win2K-f | 98.141.163.84 (CAVTEL.NET): CAVALIER TELEPHONE, PHILADELPHIA, PENNSYLVANIA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 18 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:01:01:00 | WinXP | 114.72.177.6 (OPTUSNET.COM.AU): OPTUS INTERNET - RETAIL, SYDNEY, NEW SOUTH WALES, AU. (DSL) |
n/a | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
40 of 41 | 36b32ce575 NEW |
f8ed53f9d5 [0] | none:none |
PolyEnE| | none | trace |
| T:01:20:00 | Win2K-f | 125.4.248.242 (ZAQ.NE.JP): J:COM WEST CO. LTD, TOKYO, TOKYO, JP. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 1015 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 15 of 39 |
15953b80a1 NEW 80f77d1ac8 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
|
| T:01:25:00 | Win2K-f | 208.125.168.68 (RR.COM): ROAD RUNNER HOLDCO LLC, CLIFTON PARK, NEW YORK, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:04:43:00 | WinXP | 211.23.226.98 (-): LIOU-TZUNG-YI-TC, TAIPEI, T'AI-PEI, TW. (100Mbps) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 37 of 40 |
5d445c59d8 NEW 8a54950abb NEW |
892e12db7b [0] f6b9e43917[0] |
none:none none:none |
tElock| Armadillo| |
none none |
trace trace |
| T:04:56:00 | WinXP | 92.114.253.164 (HOST-STATIC-92-115-28-10.MOLDTELECOM.MD): JSC MOLDTELECOM SA, CHISINAU, CHISINAU, MD. (DSL) |
n/a | :moscow-advokat.ru :washington.dc.us.undernet.org AT:graz.at.eu.undernet.org NL:london.uk.eu.undernet.org :brussels.be.eu.undernet.org SE:qis.md.us.dal.net SE:broadway.ny.us.dal.net SE:viking.dal.net NL:diemen.nl.eu.undernet.org SE:ozbytes.dal.net SE:coins.dal.net :gaspode.zanet.org.za |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 1.3 profile |
none | summary tarball |
39 of 40 | 18866568b5 NEW |
none[none] | none:none |
none|none | none | none |
| T:05:44:00 | Win2K-f | 211.74.204.88 (SEED.NET.TW): SEEDNET-KAOHSIUNGDP-S, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW 57ce4acac2 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:06:19:00 | Win2K-f | 70.181.111.146 (COX.NET): COX COMMUNICATIONS, RANCHO SANTA MARGARITA, CALIFORNIA, US. (DSL) |
88.198.228.238:65520 | DE:proxim.ircgalaxy.pl US:microsoft.com CN:av.lometr.pl CN:down1130.iwillhavesexygirls.com EU:pozeml.com CN:config1130.iwillhavesexygirls.com :pozemle.cn US:bfkq.com :jsactivity.com US:mjjia.cn :braverhotels.com CN:hotelseas.com US:search.toptravellingtips.com CN:210.51.36.215:88 US:64.191.44.5:8392 |
135 | pcap | raw alerts ruleset |
irc http 197 lines |
Yeah : 1.8 profile |
none | summary tarball |
12 of 38 13 of 41 39 of 41 0 of 40 17 of 39 11 of 41 16 of 40 28 of 41 11 of 40 38 of 41 |
1cb8ccc934 NEW 3e6e748549 NEW 55067eaeb2 NEW 825a28ede2 NEW 98431013e4 NEW a2ce42b73d NEW bbf91e2be4 NEW c125dd19c3 NEW c965fdb9cc NEW d441b3f319 NEW |
none[none] none [none] b625785b95[0] none [none] none [none] none [none] none [none] none [none] none [none] e33b328c50[0] |
none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none |
none|none none|none PolyEnE| none|none none|none none|none none|none none|none none|none Armadillo| |
none none none none none none none none none none |
none none trace none none none none none none trace |
| T:06:51:00 | Win2K-f | 95.28.253.194 (CORBINA.RU): INVESTELEKTROSVIAZ LTD, MOSCOW, MOSCOW CITY, RU. (100Mbps) |
88.198.228.238:65520 | :braverhotels.com CN:hotelseas.com DE:proxim.ircgalaxy.pl CN:av.lometr.pl CN:down1130.iwillhavesexygirls.com EU:pozeml.com :pozemle.cn CN:210.51.36.215:88 CN:222.186.12.42:80 74.86.72.226:80 93.174.92.220:80 |
445 | pcap | raw alerts ruleset |
irc http 22 lines |
Yeah : 0.8 profile |
none | summary tarball |
11 of 41 28 of 41 |
a2ce42b73d NEW c125dd19c3 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:07:07:00 | Win2K-f | 4.152.102.196 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, GAFFNEY, SOUTH CAROLINA, US. (DIAL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 140 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:07:38:00 | Win2K-f | 125.4.252.108 (ZAQ.NE.JP): J:COM WEST CO. LTD, TOKYO, TOKYO, JP. (DSL) |
92.240.234.164:3305 | US:cx10man.weedns.com | 135 | pcap | raw alerts ruleset |
irc 696 lines |
Yeah : 1.8 profile |
none | summary tarball |
34 of 41 | deffdf68e8 NEW |
2b011e15ba [0] | none:none |
StarForce| | none | trace |
| T:07:40:00 | WinXP | 172.130.167.238 (AOL.COM): AMERICA ONLINE, RESTON, VIRGINIA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:08:17:00 | Win2K-f | 173.168.86.18 (RR.COM): ROAD RUNNER HOLDCO LLC, LUTZ, FLORIDA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:08:27:00 | WinXP | 200.80.242.209 (TECHTELNET.NET): TECHTEL LMDS COMUNICACIONES INTERACTIVAS S.A, BUENOS AIRES, BUENOS AIRES, AR. (DSL) |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 | 01c4a6b3eb NEW |
dd524b0259 [0] | none:none |
PolyEnE| | none | trace |
| 08:48:00 | WinXP | 200.80.242.209 (TECHTELNET.NET): TECHTEL LMDS COMUNICACIONES INTERACTIVAS S.A, BUENOS AIRES, BUENOS AIRES, AR. (DSL) |
n/a | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
40 of 41 | 01c4a6b3eb NEW |
dd524b0259 [0] | none:none |
PolyEnE| | none | trace |
| T:09:14:00 | Win2K-f | 203.118.238.245 (-): GRAND TAINAN TECHNOLOGY CO.LTD, TAINAN, T'AI-WAN, TW. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:09:40:00 | Win2K-f | 99.147.76.91 (SBCGLOBAL.NET): AT&T INTERNET SERVICES, HOUSTON, TEXAS, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 59 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 8 of 33 |
53bfe15e91 NEW b7082104e4 NEW |
1473091351 [0] c5b49e7b82[0] |
ASM:Graph ASM:Graph |
tElock| tElock| |
lines=75 embedded dns lines=41 |
trace trace |
| T:09:48:00 | WinXP | 173.29.206.132 (MCHSI.COM): MEDIACOM COMMUNICATIONS CORP, CHANHASSEN, MINNESOTA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 111 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 41 39 of 41 |
10759405e0 NEW d08e00dfaf NEW |
292d343248 [0] 854c49d8c4[0] |
none:none none:none |
Armadillo| tElock| |
none none |
trace trace |
| T:10:08:00 | Win2K-f | 70.184.102.222 (COX.NET): COX COMMUNICATIONS, PHOENIX, ARIZONA, US. (100Mbps) |
88.198.228.238:65520 | US:microsoft.com DE:proxim.ircgalaxy.pl EU:dhkgpylwrl.com CN:down1130.iwillhavesexygirls.com EU:pozeml.com CN:config1130.iwillhavesexygirls.com US:bfkq.com :pozemle.cn :jsactivity.com US:mjjia.cn :braverhotels.com CN:hotelseas.com :img.ub8.net US:64.191.44.5:8392 US:66.96.221.101:80 DE:88.198.228.238:65520 |
135 | pcap | raw alerts ruleset |
irc http 192 lines |
Yeah : 1.8 profile |
none | summary tarball |
9 of 40 12 of 38 13 of 41 19 of 39 0 of 40 17 of 39 11 of 41 16 of 40 32 of 36 26 of 41 35 of 36 |
08ac7c2dbf NEW 1cb8ccc934 NEW 3e6e748549 NEW 4a079792f4 NEW 800b614279 NEW 98431013e4 NEW a2ce42b73d NEW bbf91e2be4 NEW bea8cb1865 NEW dd96e88e03 NEW fac78fde16 NEW |
none[none] none [none] none [none] none [none] none [none] none [none] none [none] none [none] 154de51a66[0] 6f87541765[0] 882896ab05[0] |
none:none none:none none:none none:none none:none none:none none:none none:none ASM:Graph none:none none:none |
none|none none|none none|none none|none none|none none|none none|none none|none Armadillo| StarForce| tElock| |
none none none none none none none none lines=91 none none |
none none none none none none none none trace trace trace |
| T:10:11:00 | Win2K-f | 202.183.52.54 (-): TOWNKANZAKI, KANZAKI, SAGA, JP. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 18 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:10:45:00 | Win2K-f | 79.25.32.162 (RETAIL.TELECOMITALIA.IT): TELECOM ITALIA NET, COSENZA, CALABRIA, IT. (DSL) |
88.198.228.238:65520 | :search.easyaupair.com :braverhotels.com CN:hotelseas.com :xz.ub9.net DE:proxim.ircgalaxy.pl CN:av.lometr.pl :in.7cy.net :in1.7cy.net CN:down1130.iwillhavesexygirls.com CN:config1130.iwillhavesexygirls.com EU:pozeml.com US:mjjia.cn :pozemle.cn :img.ub8.net 174.133.57.140:80 174.36.138.68:80 |
445 | pcap | raw alerts ruleset |
irc http 19 lines |
Yeah : 1.3 profile |
none | summary tarball |
9 of 40 12 of 38 13 of 41 17 of 39 11 of 41 16 of 40 28 of 41 26 of 41 |
08ac7c2dbf NEW 1cb8ccc934 NEW 3e6e748549 NEW 98431013e4 NEW a2ce42b73d NEW bbf91e2be4 NEW c125dd19c3 NEW dd96e88e03 NEW |
none[none] none [none] none [none] none [none] none [none] none [none] none [none] 6f87541765[0] |
none:none none:none none:none none:none none:none none:none none:none none:none |
none|none none|none none|none none|none none|none none|none none|none StarForce| |
none none none none none none none none |
none none none none none none none trace |
| T:11:06:00 | WinXP | 84.108.254.171 (BEZEQINT.NET): CABLES-CUSTOMERS-CONNECTION, TEL AVIV, TEL AVIV, IL. (DSL) |
n/a | :moscow-advokat.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
25 of 25 | 7f60162c2c NEW |
none[0] | none:none |
PolyEnE| | lines=93 embedded dns |
trace |
| T:11:10:00 | Win2K-f | 66.81.251.69 (O1.COM): O1 DIALUP SERVICES, LOS ANGELES, CALIFORNIA, US. (DIAL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 98 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:12:53:00 | Win2K-f | 123.213.61.17 (-): HANARO TELECOM, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 39 39 of 40 |
66832810f4 NEW f815b92bd4 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:14:25:00 | Win2K-f | 65.78.214.206 (WVFIBERNET.NET): FIBERNET, GRANTSVILLE, WEST VIRGINIA, US. (DIAL) |
n/a | 135 | pcap | raw alerts ruleset |
other 18 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:15:00:00 | WinXP | 81.92.50.235 (MYQ.GR): Q TELECOMMUNICATIONS S.A, ATHENS, ATTIKI, GR. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
ftp 12 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | 1a2c0e6130 NEW |
none[0] | none:none |
none|none | lines=60 | trace | |
| T:15:22:00 | WinXP | 216.158.74.29 (DRAGONBBS.COM): DRAGON MEDIA, GREENFIELD, OHIO, US. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:15:56:00 | Win2K-f | 24.78.179.0 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, WINNIPEG, MANITOBA, CA. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 123 lines |
Yeah : 1.3 profile |
none | summary tarball |
36 of 41 38 of 41 |
34cbe7a593 NEW 3e83a2d4d7 NEW |
d38cb78003 [0] b97fd63d29[0] |
none:none none:none |
Armadillo| tElock| |
none none |
trace trace |
| T:16:00:00 | WinXP | 186.9.47.15 (IMOVIL.ENTELPCS.CL): ENTEL PCS TELECOMUNICACIONES S.A, SANTIAGO, REGION METROPOLITANA, CL. (DSL) |
n/a | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:17:52:00 | Win2K-f | 4.240.24.151 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, PHOENIX, ARIZONA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 10 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| 19:51:00 | Win2K-f | 173.45.80.138 (XLHOST.COM): XLHOST.COM INC, COLUMBUS, OHIO, US. (100Mbps) |
n/a | US:www.maxmind.com US:www.getmyip.org EU:getmyip.co.uk GB:www.vouchercodez.com :checkip.dyndns.org DE:131.220.6.26:80 208.78.70.70:80 US:75.126.138.202:80 GB:80.82.121.239:80 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | dc331fb791 NEW |
none[3] | none:none |
UPX| | none | trace |
| 19:53:00 | Win2K-f | 200.32.110.34 (NET.AR): INSTITUTO NACIONAL DE TECNOLOGIA INDUSTRIAL, NEUQUEN, NEUQUEN, AR. (100Mbps) |
n/a | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
26 of 39 | 875b6ed17e NEW |
none[none] | none:none |
none|none | none | none | |
| T:19:58:00 | Win2K-f | 173.45.80.138 (XLHOST.COM): XLHOST.COM INC, COLUMBUS, OHIO, US. (100Mbps) |
n/a | US:www.maxmind.com EU:getmyip.co.uk US:www.getmyip.org :checkip.dyndns.org 208.78.70.70:80 US:67.15.94.80:80 US:75.126.138.202:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | dc331fb791 NEW |
none[3] | none:none |
UPX| | none | trace |
| T:21:46:00 | WinXP | 75.44.56.202 (SBCGLOBAL.NET): RBACK6B.MILWWI.20060913, MILWAUKEE, WISCONSIN, US. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
ftp 12 lines |
Yeah : 0.8 profile |
none | summary tarball |
32 of 32 | 03f912899b NEW |
none[0] | none:none |
none|none | lines=64 | trace | |
| T:22:38:00 | Win2K-f | 61.215.150.186 (CABLENET.NE.JP): CABLENET SAITAMA CO. LTD, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 41 38 of 41 |
10eebdc28e NEW 761a66b891 NEW |
e2ca2da35d [none] b469dac5dc[none] |
none:none none:none |
Armadillo| tElock| |
none none |
trace trace |
| T:23:01:00 | Win2K-f | 4.162.156.135 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, MEMPHIS, TENNESSEE, US. (DIAL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:23:19:00 | WinXP | 61.46.134.164 (ZAQ.NE.JP): J:COM WEST CO. LTD, OSAKA, OSAKA, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 33 of 33 |
07fabc79ef NEW 53bfe15e91 NEW |
none[0] 1473091351[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=81 lines=75 embedded dns |
trace trace |
| T:23:35:00 | WinXP | 69.193.74.22 (RR.COM): ROAD RUNNER HOLDCO LLC, HERNDON, VIRGINIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |