|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:04:57:00 | WinXP | 211.15.23.103 (GCTV.NE.JP): COMMUNITY NETWORK CENTER INC, OSAKA, OSAKA, JP. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 15 lines |
Yeah : 1.3 profile |
none | summary tarball |
29 of 29 | 831f4ee0a7 NEW |
none[0] | ASM:Graph |
none|none | lines=61 | trace | |
| T:05:27:00 | Win2K-f | 75.37.173.251 (SBCGLOBAL.NET): JASON LEE, PLANO, TEXAS, US. (100Mbps) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:06:04:00 | WinXP | 208.103.155.228 (CORETEL.NET): CORETEL AMERICA INC, MYERSTOWN, PENNSYLVANIA, US. (DIAL) |
n/a | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
41 of 41 | 72134e4b44 NEW |
28c60e99a7 [0] | none:none |
PolyEnE| | none | trace |
| T:06:21:00 | Win2K-f | 4.142.45.183 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, CHICAGO, ILLINOIS, US. (DIAL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 81 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:07:37:00 | WinXP | 4.226.114.77 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, ENNIS, TEXAS, US. (DIAL) |
n/a | DE:siliconfireware.ru US:searchportal.information.com US:spi.domainsponsor.com RU:ebookfinaltrash.ru :wpad |
445 | pcap | raw alerts ruleset |
http http http http 29 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a12cab51ef NEW |
none[0] | none:none |
ASPack| | lines=281 embedded dns |
trace |
| 07:39:00 | Win2K-f | 222.65.131.65 (163DATA.COM.CN): CHINANET-SH-BBAD, SHANGHAI, SHANGHAI, CN. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org EU:getmyip.co.uk GB:www.vouchercodez.com US:www.getmyip.org 208.78.70.70:80 US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 4 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| 08:46:00 | WinXP | 208.103.155.228 (CORETEL.NET): CORETEL AMERICA INC, MYERSTOWN, PENNSYLVANIA, US. (DIAL) |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 40 | 6362c8686d NEW |
none[none] | none:none |
none|none | none | none |
| T:10:24:00 | Win2K-f | 70.62.129.88 (RR.COM): ROAD RUNNER HOLDCO LLC, MARYSVILLE, OHIO, US. (DSL) |
n/a | CN:proxim.ircgalaxy.pl US:microsoft.com CN:stashonline.info CN:av.lometr.pl CN:down0129.iwillhavesexygirls.com CN:file0129.iwillhavesexygirls.com EU:pozeml.com US:bfkq.com :jsactivity.com :pozemle.cn US:mjjia.cn :braverhotels.com CN:hotelseas.com :img.ub8.net :xz.ub9.net :in.7cy.net 98.126.46.210:80 |
135 | pcap | raw alerts ruleset |
irc http 1074 lines |
Yeah : 1.3 profile |
none | summary tarball |
18 of 40 12 of 38 12 of 39 9 of 40 34 of 36 15 of 39 33 of 36 11 of 41 12 of 39 5 of 41 28 of 41 26 of 41 |
081b51ed7e NEW 1cb8ccc934 NEW 3fdd4f3c45 NEW 50fedbbad0 NEW 644b2a1105 NEW 64e7cb22ad NEW 9c9ab20965 NEW a2ce42b73d NEW b5be173b0a NEW b6cd57d0d4 NEW c125dd19c3 NEW dd96e88e03 NEW |
none[none] none [none] none [none] none [none] none [none] none [none] none [none] none [none] none [none] none [none] none [none] 6f87541765[0] |
none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none |
none|none none|none none|none none|none none|none none|none none|none none|none none|none none|none none|none StarForce| |
none none none none none none none none none none none none |
none none none none none none none none none none none trace |
| T:10:32:00 | Win2K-f | 193.250.12.99 (ABO.WANADOO.FR): WANADOO, RENNES, BRETAGNE, FR. (DSL) |
n/a | US:assian.net US:searchportal.information.com US:spi.domainsponsor.com US:ads1.revenue.net :panther1.cpxinteractive.com :adserving.cpxinteractive.com US:content.yieldmanager.com US:cookex.amp.yahoo.com US:activex.microsoft.com US:codecs.microsoft.com US:sc-artcenter.com US:209.85.51.151:80 US:66.94.245.1:80 |
445 | pcap | raw alerts ruleset |
http 42 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:10:37:00 | Win2K-f | 98.175.158.194 (COX.NET): COX COMMUNICATIONS, PROVIDENCE, RHODE ISLAND, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:10:51:00 | Win2K-f | 88.209.109.191 (DSL.MONACO.MC): 21IMCN, FR. (DSL) |
n/a | :search.youblogged.com :braverhotels.com CN:hotelseas.com :xz.ub9.net CN:proxim.ircgalaxy.pl :in.7cy.net CN:down0129.iwillhavesexygirls.com CN:file0129.iwillhavesexygirls.com US:mjjia.cn EU:pozeml.com :pozemle.cn :img.ub8.net US:microsoft.com 174.133.57.140:80 US:63.134.244.77:80 74.86.72.226:80 DE:88.198.228.238:80 93.174.92.220:80 |
445 | pcap | raw alerts ruleset |
http irc 151 lines |
Yeah : 0.8 profile |
none | summary tarball |
18 of 40 12 of 39 15 of 39 11 of 41 12 of 39 8 of 40 |
081b51ed7e NEW 3fdd4f3c45 NEW 64e7cb22ad NEW a2ce42b73d NEW b5be173b0a NEW d01109c070 NEW |
none[none] none [none] none [none] none [none] none [none] none [none] |
none:none none:none none:none none:none none:none none:none |
none|none none|none none|none none|none none|none none|none |
none none none none none none |
none none none none none none |
| T:10:51:00 | Win2K-f | 65.184.52.253 (RR.COM): ROAD RUNNER HOLDCO LLC, WILMINGTON, NORTH CAROLINA, US. (100Mbps) |
n/a | 135 | pcap | raw alerts ruleset |
other 18 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:11:10:00 | Win2K-f | 64.181.117.210 (-): JHW CHARITABLE ANNUITY TRUST, CHARLESTON, WEST VIRGINIA, US. (100Mbps) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 40 38 of 40 |
67f1a33096 NEW 724cf0dc37 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:11:12:00 | WinXP | 79.163.152.25 (CENTERTEL.PL): PTK CENTERTEL BROADBAND SERVICES, WARSAW, WARSZAWA, PL. (DSL) |
n/a | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | f502585714 NEW |
none[0] | none:none |
PolyEnE| | lines=63 | trace |
| T:11:43:00 | Win2K-f | 89.179.10.32 (CORBINA.RU): BROADBAND CUSTOMERS IN TULA, MOSCOW, MOSCOW CITY, RU. (DSL) |
n/a | :braverhotels.com CN:hotelseas.com CN:proxim.ircgalaxy.pl CN:down0129.iwillhavesexygirls.com EU:pozeml.com CN:file0129.iwillhavesexygirls.com US:mjjia.cn :pozemle.cn :img.ub8.net US:www.autonavigate.us US:ypn-js.overture.com :download.macromedia.com US:fpdownload2.macromedia.com US:204.2.133.17:80 74.86.72.226:80 98.126.9.219:80 |
445 | pcap | raw alerts ruleset |
irc http 1232 lines |
Yeah : 0.8 profile |
none | summary tarball |
18 of 40 12 of 38 12 of 39 15 of 39 11 of 41 12 of 39 |
081b51ed7e NEW 1cb8ccc934 NEW 3fdd4f3c45 NEW 64e7cb22ad NEW a2ce42b73d NEW b5be173b0a NEW |
none[none] none [none] none [none] none [none] none [none] none [none] |
none:none none:none none:none none:none none:none none:none |
none|none none|none none|none none|none none|none none|none |
none none none none none none |
none none none none none none |
| T:11:51:00 | Win2K-f | 4.154.1.56 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, DULUTH, GEORGIA, US. (DIAL) |
n/a | 135 | pcap | raw alerts ruleset |
other 6 lines |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:11:59:00 | Win2K-f | 68.144.38.15 (HUB.SYSTEM.IO): SHAW COMMUNICATIONS INC, CALGARY, ALBERTA, CA. (DSL) |
92.240.234.164:3305 | US:cx10man.weedns.com AR:fx010413.whyI.org 92.240.234.164:3305 |
135 | pcap | raw alerts ruleset |
irc 608 lines |
Yeah : 1.8 profile |
none | summary tarball |
39 of 41 | 7e809b1bc9 NEW |
14a46167a5 [0] | none:none |
StarForce| | none | trace |
| T:13:23:00 | WinXP | 76.89.180.83 (RR.COM): ROAD RUNNER HOLDCO LLC, UPLAND, CALIFORNIA, US. (DSL) |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
29 of 29 | 3ae357d17b NEW |
none[0] | ASM:Graph |
PolyEnE| | lines=73 | trace |
| T:13:50:00 | Win2K-f | 60.249.37.106 (HINET.NET): CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
34 of 38 35 of 38 |
38ed850a0e NEW b9297745a1 NEW |
46990f37cd [0] 4294884d84[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=91 lines=64 embedded dns |
trace trace |
| T:14:40:00 | WinXP | 69.183.65.158 (SNET.NET): AT&T INTERNET SERVICES, CHESHIRE, CONNECTICUT, US. (DSL) |
n/a | US:www.yahoo.com :jbeegvia.ru |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
32 of 32 | bb7681eca8 NEW |
none[3] | none:none |
tElock| | none | trace |
| T:14:44:00 | Win2K-f | 4.238.14.95 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, ORLANDO, FLORIDA, US. (DIAL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 62 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 8 of 33 |
53bfe15e91 NEW b7082104e4 NEW |
1473091351 [0] c5b49e7b82[0] |
ASM:Graph ASM:Graph |
tElock| tElock| |
lines=75 embedded dns lines=41 |
trace trace |
| T:14:51:00 | Win2K-f | 202.157.42.171 (WAKUWAKU-LAND.COM): KUMAMOTO CABLE NETWORK CORPORATION, KUMAMOTO, KUMAMOTO, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:15:16:00 | WinXP | 96.8.248.87 (GVTC.COM): GUADALUPE VALLEY TELEPHONE COOPERATIVE INC, NEW BRAUNFELS, TEXAS, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 39 of 40 |
9bdd2c95b1 NEW cd456ac095 NEW |
d1bbd693ba [0] d75caee680[0] |
none:none none:none |
Armadillo| tElock| |
none none |
trace trace |
| T:15:26:00 | WinXP | 84.184.98.24 (T-DIALIN.NET): DEUTSCHE TELEKOM AG, ERFURT, THURINGEN, DE. (DIAL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 14 lines |
Yeah : 0.8 profile |
none | summary tarball |
31 of 32 | 741e3b03b3 NEW |
none[0] | none:none |
none|none | lines=61 | trace | |
| T:17:07:00 | Win2K-f | 99.164.23.178 (SBCGLOBAL.NET): RANI PAL LLC, PLANO, TEXAS, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 402 lines |
Yeah : 1.3 profile |
none | summary tarball |
11 of 36 | c4c5a56ffe NEW |
8bef2f9170 [0] | none:none |
StarForce| | none | trace | |
| T:17:49:00 | Win2K-f | 180.67.127.2 (-): HANARO TELECOM, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
88.198.228.238:65520 | US:microsoft.com CN:proxim.ircgalaxy.pl CN:down0129.iwillhavesexygirls.com EU:pozeml.com CN:file0129.iwillhavesexygirls.com US:bfkq.com :jsactivity.com :pozemle.cn US:mjjia.cn :img.ub8.net 173.45.105.218:8392 US:63.134.244.77:80 US:64.120.176.66:8392 US:64.191.44.8:8392 DE:88.198.228.238:65520 98.126.9.219:80 |
135 | pcap | raw alerts ruleset |
irc http 186 lines |
Yeah : 1.8 profile |
none | summary tarball |
18 of 40 12 of 38 0 of 39 30 of 33 28 of 33 15 of 39 11 of 41 12 of 39 |
081b51ed7e NEW 1cb8ccc934 NEW 361303f76d NEW 533d15b5ce NEW 58c343a8d8 NEW 64e7cb22ad NEW a2ce42b73d NEW b5be173b0a NEW |
none[none] none [none] none [none] c67adf46e2[0] none [0] none [none] none [none] none [none] |
none:none none:none none:none ASM:Graph none:none none:none none:none none:none |
none|none none|none none|none tElock| Armadillo| none|none none|none none|none |
none none none lines=126 embedded dns lines=91 none none none |
none none none trace trace none none none |
| T:18:45:00 | Win2K-f | 200.35.40.8 (EDATEL.NET.CO): EDATEL S.A. E.S.P, SANTAFé DE BOGOTá, DISTRITO ESPECIAL, CO. (DIAL) |
88.198.228.238:65520 | :braverhotels.com CN:hotelseas.com CN:proxim.ircgalaxy.pl CN:av.lometr.pl CN:down0129.iwillhavesexygirls.com EU:pozeml.com CN:file0129.iwillhavesexygirls.com :pozemle.cn US:mjjia.cn :img.ub8.net US:63.134.244.77:80 98.126.9.219:80 |
445 | pcap | raw alerts ruleset |
irc http 22 lines |
Yeah : 1.3 profile |
none | summary tarball |
18 of 40 12 of 39 9 of 40 15 of 39 11 of 41 12 of 39 |
081b51ed7e NEW 3fdd4f3c45 NEW 50fedbbad0 NEW 64e7cb22ad NEW a2ce42b73d NEW b5be173b0a NEW |
none[none] none [none] none [none] none [none] none [none] none [none] |
none:none none:none none:none none:none none:none none:none |
none|none none|none none|none none|none none|none none|none |
none none none none none none |
none none none none none none |
| T:19:06:00 | Win2K-f | 98.175.167.93 (COX.NET): COX COMMUNICATIONS, FREDERICKSBURG, VIRGINIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:19:38:00 | WinXP | 110.12.207.204 (-): HANARO TELECOM, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
88.198.228.238:65520 | CN:proxim.ircgalaxy.pl US:microsoft.com CN:stashonline.info CN:down0129.iwillhavesexygirls.com CN:file0129.iwillhavesexygirls.com US:bfkq.com EU:pozeml.com :jsactivity.com :pozemle.cn US:mjjia.cn :braverhotels.com CN:hotelseas.com US:search.toptravellingtips.com CN:122.224.6.48:88 |
135 | pcap | raw alerts ruleset |
irc http 209 lines |
Yeah : 1.8 profile |
none | summary tarball |
3 of 40 18 of 40 12 of 38 0 of 40 12 of 39 3 of 39 15 of 39 29 of 32 28 of 32 11 of 41 5 of 41 |
07d7bf66b9 NEW 081b51ed7e NEW 1cb8ccc934 NEW 2989ab7e6f NEW 3fdd4f3c45 NEW 57ae5c89b7 NEW 64e7cb22ad NEW 8a75955033 NEW 9276c8b36b NEW a2ce42b73d NEW b6cd57d0d4 NEW |
none[none] none [none] none [none] none [none] none [none] none [none] none [none] 2bf3e548b9[0] none [0] none [none] none [none] |
none:none none:none none:none none:none none:none none:none none:none ASM:Graph ASM:Graph none:none none:none |
none|none none|none none|none none|none none|none none|none none|none tElock| Armadillo| none|none none|none |
none none none none none none none lines=126 embedded dns lines=81 none none |
none none none none none none none trace trace none none |
| 20:09:00 | Win2K-f | 200.226.17.116 (STERLINGSTUDENTS.NET): COMITE GESTOR DA INTERNET NO BRASIL, BR. (DSL) |
n/a | US:www.maxmind.com EU:getmyip.co.uk US:www.getmyip.org :checkip.dyndns.org DE:131.220.6.26:80 208.78.70.70:80 US:75.126.138.202:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 4 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| 20:36:00 | WinXP | 78.231.224.160 (PROXAD.NET): PROXAD / FREE SAS, PARIS, ILE-DE-FRANCE, FR. (DSL) |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 40 | 523479717b NEW |
none[none] | none:none |
none|none | none | none |
| T:22:01:00 | Win2K-f | 67.150.216.187 (MDSG-PACWEST.COM): PAC-WEST MANAGED MODEM NAS POOL, GLENDALE, ARIZONA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 134 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:22:56:00 | WinXP | 124.195.32.214 (-): PT INDOSAT TBK, JAKARTA, JAKARTA RAYA, ID. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 33 of 33 |
73f1082158 NEW 97fef473b9 NEW |
none[0] ff4e7d6992[0] |
none:none none:none |
Armadillo| tElock| |
lines=90 none |
trace trace |