|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| 02:57:00 | Win2K-f | 81.32.253.109 (RIMA-TDE.NET): TELEFONICA DE ESPANA SAU, MADRID, MADRID, ES. (DSL) |
n/a | US:dl01.bashchelik.com US:srv01.bashchelik.com US:207.210.93.242:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
37 of 41 | e4fdf42fc0 NEW |
none[none] | none:none |
none|none | none | none |
| T:07:29:00 | Win2K-f | 75.181.163.105 (RR.COM): ROAD RUNNER HOLDCO LLC, CHARLOTTE, NORTH CAROLINA, US. (100Mbps) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:07:45:00 | Win2K-f | 58.120.0.93 (HANANET.NET): HANARO TELECOM INC, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
60.190.222.139:65520 | DE:proxim.ircgalaxy.pl US:microsoft.com :pozemle.cn EU:updatemania.info CN:file0129.iwillhavesexygirls.com EU:pozeml.com CN:122.224.6.48:88 EU:91.212.198.133:80 93.174.92.220:80 |
135 | pcap | raw alerts ruleset |
irc 121 lines |
Yeah : 1.8 profile |
none | summary tarball |
29 of 32 6 of 41 |
8a75955033 NEW eeb4e59070 NEW |
2bf3e548b9 [0] none [none] |
ASM:Graph none:none |
tElock| none|none |
lines=126 embedded dns none |
trace none |
| T:08:16:00 | Win2K-f | 113.254.173.153 (HUTCHCITY.COM): HUTCHISON GLOBAL COMMUNICATIONS, HONG KONG, HONG KONG (SAR), HK. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
32 of 40 33 of 33 |
27b17a2724 NEW 53bfe15e91 NEW |
a1d5ac965b [0] 1473091351[0] |
none:none ASM:Graph |
tElock| tElock| |
none lines=75 embedded dns |
trace trace |
| T:09:07:00 | Win2K-f | 121.124.54.215 (HANANET.NET): HANARO TELECOM INC, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
83.133.119.206:65520 | CN:proxima.ircgalaxy.pl US:microsoft.com CN:file0129.iwillhavesexygirls.com EU:pozeml.com CN:122.224.6.48:88 EU:91.206.201.39:80 |
135 | pcap | raw alerts ruleset |
irc 100 lines |
Yeah : 1.8 profile |
none | summary tarball |
34 of 36 29 of 32 |
99b248336f NEW 9d677c3f70 NEW |
c64bd1a776 [0] 77e75ff10f[0] |
none:none none:none |
Armadillo| tElock| |
none none |
trace trace |
| T:10:29:00 | Win2K-f | 71.115.82.156 (VERIZON.NET): VERIZON INTERNET SERVICES INC, ELKHART, INDIANA, US. (DSL) |
92.240.234.164:3305 | US:cx10man.weedns.com | 135 | pcap | raw alerts ruleset |
irc 608 lines |
Yeah : 1.8 profile |
none | summary tarball |
38 of 40 | 3d004f8b75 NEW |
none[none] | none:none |
none|none | none | none |
| T:20:29:00 | Win2K-f | 72.64.30.16 (VERIZON.NET): VERIZON INTERNET SERVICES INC, CHARLESTON, WEST VIRGINIA, US. (100Mbps) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| 20:38:00 | WinXP | 70.92.241.40 (RR.COM): ROAD RUNNER HOLDCO LLC, MILWAUKEE, WISCONSIN, US. (100Mbps) |
n/a | :moscow-advokat.ru | 445 | pcap | raw alerts ruleset |
other 0 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | 042774a2b7 NEW |
none[0] | none:none |
PolyEnE| | lines=69 embedded dns |
trace |
| T:20:50:00 | Win2K-f | 61.221.237.252 (-): HUNG REN SHIN IE CO. LTD. PINGTUNG BRANCH COMPANY, TAIPEI, T'AI-PEI, TW. (100Mbps) |
n/a | 135 | pcap | raw alerts ruleset |
other 1002 lines |
Yeah : 1.3 profile |
none | summary tarball |
17 of 41 | e1693609f9 NEW |
none[3] | none:none |
none|none | none | trace | |
| T:22:02:00 | Win2K-f | 67.240.110.116 (RR.COM): ROAD RUNNER HOLDCO LLC, GLOVERSVILLE, NEW YORK, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:22:43:00 | Win2K-f | 99.23.126.54 (PACBELL.NET): AT&T INTERNET SERVICES, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |