Score: 1.8 (>= 0.8) Infected Target: 130.107.167.236 Infector List: 114.206.21.56 Egg Source List: 114.206.21.56 C & C List: 60.190.222.139 Peer Coord. List: Resource List: Observed Start: 02/20/2010 00:49:16.998 PST Gen. Time: 02/20/2010 00:55:04.675 PST INBOUND SCAN EXPLOIT 114.206.21.56 (00:49:16.998 PST) event=1:299913 {tcp} E2[rb] SHELLCODE x86 0x90 unicode NOOP 135<-4159 (00:49:16.998 PST) EXPLOIT (slade) EGG DOWNLOAD 114.206.21.56 (6) (00:49:19.571 PST) event=1:1444 (2) {udp} E3[rb] TFTP GET from external source 1028->69 (00:49:19.571 PST) 1029->69 (00:49:30.841 PST) ------------------------- event=1:2008120 (2) {udp} E3[rb] ET POLICY Outbound TFTP Read Request 1028->69 (00:49:19.571 PST) 1029->69 (00:49:30.841 PST) ------------------------- event=1:3001441 (2) {udp} E3[rb] TFTP GET .exe from external source 1028->69 (00:49:19.571 PST) 1029->69 (00:49:30.841 PST) C and C TRAFFIC 60.190.222.139 (00:55:04.675 PST) event=1:2003603 {tcp} E4[rb] ET TROJAN W32.Virut.A joining an IRC Channel 1039->65520 (00:55:04.675 PST) PEER COORDINATION OUTBOUND SCAN 114.206.21.56 (00:49:17.321 PST) event=1:52123 {tcp} E5[rb] REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner 1027->707 (00:49:17.321 PST) ATTACK PREP DECLARE BOT tcpslice 1266655756.998 1266655756.999 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 130.107.167.236' ============================== SEPARATOR ================================