|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:05:41:00 | Win2K-f | 113.254.194.211 (HUTCHCITY.COM): HUTCHISON GLOBAL COMMUNICATIONS, HONG KONG, HONG KONG (SAR), HK. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 185 lines |
Yeah : 1.3 profile |
none | summary tarball |
35 of 38 | 92e29a98bd NEW |
57d7791117 [none] | none:none |
none|none | none | none | |
| T:06:05:00 | Win2K-f | 122.146.225.29 (SPARQNET.NET): NEW CENTRY INFOCOM TECH. CO. LTD, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW 57ce4acac2 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:06:25:00 | WinXP | 186.9.21.133 (IMOVIL.ENTELPCS.CL): ENTEL PCS TELECOMUNICACIONES S.A, SANTIAGO, REGION METROPOLITANA, CL. (DSL) |
n/a | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
40 of 41 | eda3b7766c NEW |
7556343561 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:08:37:00 | WinXP | 69.205.144.162 (RR.COM): ROAD RUNNER HOLDCO LLC, FULTON, NEW YORK, US. (DSL) |
n/a | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a0139d7ad8 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:08:52:00 | Win2K-f | 218.220.143.40 (ZAQ.NE.JP): J:COM WEST CO. LTD, TOKYO, TOKYO, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 111 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 38 of 40 |
024410ad21 NEW b0cedd71bb NEW |
96d0267b80 [0] f6e156bdca[0] |
ASM:Graph ASM:Graph |
tElock| Armadillo| |
lines=64 embedded dns lines=91 |
trace trace |
| T:10:10:00 | Win2K-f | 194.19.234.252 (-): BTG, RIGA, RIGA, LV. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:11:04:00 | Win2K-f | 61.221.237.252 (-): HUNG REN SHIN IE CO. LTD. PINGTUNG BRANCH COMPANY, TAIPEI, T'AI-PEI, TW. (100Mbps) |
n/a | 135 | pcap | raw alerts ruleset |
other 1003 lines |
Yeah : 1.3 profile |
none | summary tarball |
17 of 41 | e1693609f9 NEW |
none[3] | none:none |
none|none | none | trace | |
| T:11:43:00 | Win2K-f | 63.25.123.205 (UU.NET): UUNET TECHNOLOGIES INC, PILOT POINT, TEXAS, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:13:32:00 | Win2K-f | 152.48.222.12 (UNC.EDU): NORTH CAROLINA RESEARCH AND EDUCATION NETWORK, DURHAM, NORTH CAROLINA, US. (100Mbps) |
60.190.222.139:65520 | US:microsoft.com DE:proxima.ircgalaxy.pl CN:file0129.iwillhavesexygirls.com :pozeml.com US:bfkq.com :jsactivity.com CN:60.190.222.139:65520 69.64.147.217:8392 DE:83.133.119.206:65520 |
135 | pcap | raw alerts ruleset |
irc http 123 lines |
Yeah : 1.8 profile |
none | summary tarball |
21 of 42 41 of 42 12 of 42 31 of 33 |
96ff9f6a65 NEW 9794cd2c1c NEW 99ea97a88e NEW d789c8d157 NEW |
none[none] none [none] none [none] 5f6572479f[0] |
none:none none:none none:none ASM:Graph |
none|none none|none none|none PolyEnE| |
none none none lines=113 embedded dns |
none none none trace |
| T:13:40:00 | WinXP | 24.88.109.106 (RR.COM): ROAD RUNNER HOLDCO LLC, MANNING, SOUTH CAROLINA, US. (DSL) |
n/a | DE:siliconfireware.ru US:searchportal.information.com US:spi.domainsponsor.com GB:welcome3.smile.co.uk :wpad RU:ebookfinaltrash.ru GB:195.92.84.198:80 US:204.13.161.51:80 DE:217.11.54.126:80 |
445 | pcap | raw alerts ruleset |
http http http 7 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a12cab51ef NEW |
none[0] | none:none |
ASPack| | lines=281 embedded dns |
trace |
| T:16:27:00 | WinXP | 173.29.253.168 (MCHSI.COM): MEDIACOM COMMUNICATIONS CORP, CHANHASSEN, MINNESOTA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 111 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 41 39 of 41 |
10759405e0 NEW d08e00dfaf NEW |
292d343248 [0] 854c49d8c4[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=91 lines=64 embedded dns |
trace trace |
| T:17:08:00 | Win2K-f | 211.20.222.150 (HINET.NET): XUN HANG TECHNOLOGY CO. LTD, TAIPEI, T'AI-PEI, TW. (100Mbps) |
210.166.223.51:3305 | JP:cx10man.weedns.com JP:fx010413.whyI.org PL:gynoman.weedns.com FI:g.0x20.biz PL:telephone.dd.blueline.be :phonewire.dd.blueline.be :phonelogin.dd.blueline.be JP:ufospace.etowns.net FR:62.193.249.122:3305 67.228.26.154:3305 PL:83.2.139.1:3305 92.240.234.164:3305 |
135 | pcap | raw alerts ruleset |
irc 696 lines |
Yeah : 1.8 profile |
none | summary tarball |
28 of 41 | b8076e37ae NEW |
52953fed05 [0] | none:none |
StarForce| | none | trace |
| 18:58:00 | Win2K-f | 85.95.147.44 (ROSMORPORT.RU): PORTTELEKOM LLC 9 STRELNIKOVA ST. AREA SUBSCRIBERS, MOSCOW, MOSCOW CITY, RU. (100Mbps) |
n/a | US:www.maxmind.com :checkip.dyndns.org US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:19:07:00 | Win2K-f | 85.95.147.44 (ROSMORPORT.RU): PORTTELEKOM LLC 9 STRELNIKOVA ST. AREA SUBSCRIBERS, MOSCOW, MOSCOW CITY, RU. (100Mbps) |
n/a | US:www.maxmind.com US:www.getmyip.org EU:getmyip.co.uk :checkip.dyndns.org 208.78.70.70:80 US:67.15.94.80:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:19:29:00 | WinXP | 76.177.34.44 (RR.COM): ROAD RUNNER HOLDCO LLC, GEORGETOWN, KENTUCKY, US. (100Mbps) |
n/a | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | d42c1cc7c0 NEW |
none[0] | none:none |
PolyEnE| | lines=54 | trace |
| T:23:39:00 | Win2K-f | 202.4.111.229 (DHAKACOM.COM): DHAKACOM LIMITED, DHAKA, DHAKA, BD. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 82 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |