|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:01:24:00 | Win2K-f | 125.4.6.90 (ZAQ.NE.JP): J:COM WEST CO. LTD, OSAKA, OSAKA, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 33 of 33 |
07fabc79ef NEW 53bfe15e91 NEW |
none[0] 1473091351[0] |
none:none ASM:Graph |
Armadillo| tElock| |
lines=90 lines=75 embedded dns |
trace trace |
| T:07:36:00 | WinXP | 204.210.203.131 (STARKMRDD.ORG): ROAD RUNNER HOLDCO LLC, ERIE, PENNSYLVANIA, US. (DSL) |
n/a | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| 08:27:00 | Win2K-f | 190.55.246.124 (200.IN-ADDR.ARPA): TELECENTRO S.A. - CLIENTES RESIDENCIALES, BUENOS AIRES, BUENOS AIRES, AR. (DSL) |
n/a | US:www.maxmind.com US:www.getmyip.org EU:getmyip.co.uk :checkip.dyndns.org DE:131.220.6.26:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 6 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:08:37:00 | Win2K-f | 190.55.246.124 (200.IN-ADDR.ARPA): TELECENTRO S.A. - CLIENTES RESIDENCIALES, BUENOS AIRES, BUENOS AIRES, AR. (DSL) |
n/a | US:www.maxmind.com US:www.getmyip.org :checkip.dyndns.org DE:131.220.6.26:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| 13:35:00 | Win2K-f | 190.220.70.124 (TECHTELNET.NET): TECHTEL LMDS COMUNICACIONES INTERACTIVAS S.A, BAHIA BLANCA, BUENOS AIRES, AR. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | dc331fb791 NEW |
none[3] | none:none |
UPX| | none | trace |
| T:13:44:00 | Win2K-f | 190.220.70.124 (TECHTELNET.NET): TECHTEL LMDS COMUNICACIONES INTERACTIVAS S.A, BAHIA BLANCA, BUENOS AIRES, AR. (DSL) |
n/a | US:www.maxmind.com US:www.getmyip.org EU:getmyip.co.uk GB:www.vouchercodez.com :checkip.dyndns.org US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | dc331fb791 NEW |
none[3] | none:none |
UPX| | none | trace |
| T:17:41:00 | Win2K-f | 69.193.78.147 (RR.COM): ROAD RUNNER HOLDCO LLC, HERNDON, VIRGINIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| 20:23:00 | WinXP | 66.19.77.205 (MCLEODUSA.NET): PAETEC COMMUNICATIONS INC, TAMPA, FLORIDA, US. (DSL) |
60.190.222.139:65520 | CN:proxim.ircgalaxy.pl :pozemle.cn CN:file0129.iwillhavesexygirls.com US:sendinvest.com :findhobbits.com :pozeml.com EU:img.ub8.net US:search.toptravellingtips.com CN:0305.installstorm.com :www.toptravellingtips.com :xz.ub9.net :www.backblogs.com :in.7cy.net :sovle.com 174.120.120.170:80 |
445 | pcap | raw alerts ruleset |
http irc 234 lines |
Yeah : 1.3 profile |
none | summary tarball |
32 of 41 11 of 42 29 of 39 42 of 42 25 of 41 21 of 42 0 of 42 24 of 42 |
0c27ab8679 NEW 3e046c439b NEW 4691ac4856 NEW 51059a12a6 NEW 685a14868c NEW bb24b53d70 NEW dad6302dee NEW f87fecd9b4 NEW |
366466a774 [none] 5a6d7e33c9[none] 281da14e28[0] f2d7df1f28[none] e6af401b49[none] e9cd87c112[none] none [none] 60aa71d327[none] |
none:none none:none ASM:Graph none:none none:none none:none none:none none:none |
none|none StarForce| StarForce| PolyEnE| StarForce| Armadillo| none|none tElock| |
none none lines=24 none none none none none |
none none trace none none none none none |
| T:22:37:00 | WinXP | 122.196.4.87 (ZAQ.NE.JP): J:COM WEST CO. LTD, OSAKA, OSAKA, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 111 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 40 of 41 |
71e6f60517 NEW ab4e3226c4 NEW |
1ef1781501 [0] c2d0313e73[0] |
ASM:Graph none:none |
Armadillo| tElock| |
lines=91 none |
trace trace |