|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:01:51:00 | WinXP | 209.204.66.251 (SNIPARPA.NET): SNIP, WAYNE, PENNSYLVANIA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 11 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:03:27:00 | WinXP | 81.198.145.8 (-): ADDRESS POOL FOR LTC-HOME CUSTOMERS, RIGA, RIGA, LV. (DSL) |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 | aab1b56620 NEW |
3b2e1c5b9d [0] | ASM:Graph |
PolyEnE| | lines=63 | trace |
| T:03:45:00 | Win2K-f | 61.216.4.152 (HINET.NET): CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:04:28:00 | WinXP | 69.85.126.23 (ELLIJAY.COM): ELLIJAY COMMUNITY TELEVISION, ELLIJAY, GEORGIA, US. (DSL) |
n/a | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
35 of 35 | 9716d7995a NEW |
c3a5354b6f [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:08:57:00 | WinXP | 68.203.226.215 (RR.COM): ROAD RUNNER HOLDCO LLC, ORANGE, TEXAS, US. (100Mbps) |
n/a | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
32 of 32 | b502f83a7c NEW |
28f5be93b0 [0] | ASM:Graph |
PolyEnE| | lines=73 | trace |
| T:10:04:00 | Win2K-f | 202.78.146.124 (TELSTRACLEAR.NET): TELSTRACLEAR WELLINGTON CABLE CUSTOMERS, WELLINGTON, WELLINGTON, NZ. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:10:11:00 | Win2K-f | 72.128.22.28 (RR.COM): ROAD RUNNER HOLDCO LLC, KANSAS CITY, KANSAS, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 59 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 8 of 33 |
53bfe15e91 NEW b7082104e4 NEW |
1473091351 [0] c5b49e7b82[0] |
ASM:Graph ASM:Graph |
tElock| tElock| |
lines=75 embedded dns lines=41 |
trace trace |
| T:10:14:00 | Win2K-f | 208.126.119.218 (NETINS.NET): SENECA TELEPHONE COMPANY, SPENCER, IOWA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 186 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 | 23801a9149 NEW |
adfea61d48 [0] | ASM:Graph |
none|none | lines=546 | trace | |
| T:13:38:00 | WinXP | 24.105.216.232 (MHCABLE.COM): MID-HUDSON CABLEVISION INC. (CATSKILL), COEYMANS HOLLOW, NEW YORK, US. (DSL) |
60.190.222.139:65520 | CN:proxim.ircgalaxy.pl :pozemle.cn CN:file0129.iwillhavesexygirls.com :pozeml.com :dred3.cn RU:ya.ru CN:122.224.6.48:88 CN:60.190.222.139:65520 |
445 | pcap | raw alerts ruleset |
http irc http http http http http 13 lines |
Yeah : 1.3 profile |
none | summary tarball |
35 of 36 32 of 41 |
04ed4d2967 NEW 0c27ab8679 NEW |
e8aa304d1c [0] none [none] |
ASM:Graph none:none |
PolyEnE| none|none |
lines=131 none |
trace none |
| T:16:06:00 | Win2K-f | 4.224.141.242 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, INDIANAPOLIS, INDIANA, US. (DIAL) |
n/a | 135 | pcap | raw alerts ruleset |
other 18 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:16:14:00 | Win2K-f | 113.254.90.242 (HUTCHCITY.COM): HUTCHISON GLOBAL COMMUNICATIONS, HONG KONG, HONG KONG (SAR), HK. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 1002 lines |
Yeah : 1.3 profile |
none | summary tarball |
35 of 41 | 559acaa271 NEW |
none[3] | none:none |
none|none | none | trace | |
| 18:46:00 | Win2K-f | 194.209.31.16 (-): PALEXPO-1-NET, GENEVA, GENEVE, CH. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
2 of 37 | 71afca1665 NEW |
none[3] | none:none |
StarForce| | none | trace |
| T:18:56:00 | Win2K-f | 194.209.31.16 (-): PALEXPO-1-NET, GENEVA, GENEVE, CH. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org US:www.getmyip.org EU:getmyip.co.uk 208.78.70.70:80 US:67.15.94.80:80 US:75.126.138.202:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
2 of 37 | 71afca1665 NEW |
none[3] | none:none |
StarForce| | none | trace |
| T:20:40:00 | Win2K-f | 173.168.247.41 (RR.COM): ROAD RUNNER HOLDCO LLC, BRADENTON, FLORIDA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 41 of 42 |
2ee433d1ff NEW ded6d201af NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:22:51:00 | Win2K-f | 71.109.170.116 (VERIZON.NET): VERIZON INTERNET SERVICES INC, OXNARD, CALIFORNIA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 186 lines |
Yeah : 1.3 profile |
none | summary tarball |
41 of 42 | 84625a8fe0 NEW |
none[none] | none:none |
none|none | none | none |