|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:01:15:00 | Win2K-f | 67.150.8.57 (MDSG-PACWEST.COM): PAC-WEST MANAGED MODEM NAS POOL, LA PUENTE, CALIFORNIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 122 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:01:23:00 | WinXP | 114.48.34.101 (E-MOBILE.NE.JP): EMOBILE LTD, TOKYO, TOKYO, JP. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 16 lines |
Yeah : 1.3 profile |
none | summary tarball |
37 of 40 | 5285741560 NEW |
60590b8b67 [0] | ASM:Graph |
none|none | lines=59 | trace | |
| T:04:56:00 | WinXP | 75.37.173.251 (SBCGLOBAL.NET): JASON LEE, PLANO, TEXAS, US. (100Mbps) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:05:18:00 | Win2K-f | 203.90.81.38 (AKAMAITECHNOLOGIES.COM): HCL INFINET LIMITED, NEW DELHI, DELHI, IN. (100Mbps) |
n/a | 135 | pcap | raw alerts ruleset |
other 18 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| 08:01:00 | Win2K-f | 194.8.75.147 (-): DRAGONARA ALLIANCE LTD, UK. (DSL) |
n/a | US:www.maxmind.com US:www.getmyip.org :checkip.dyndns.org US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 3 lines |
Yeah : 0.8 profile |
none | summary tarball |
2 of 37 | d60e538e72 NEW |
none[3] | none:none |
UPX| | none | trace |
| T:11:45:00 | Win2K-f | 125.4.3.110 (ZAQ.NE.JP): J:COM WEST CO. LTD, OSAKA, OSAKA, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 33 of 33 |
07fabc79ef NEW 53bfe15e91 NEW |
none[0] 1473091351[0] |
none:none ASM:Graph |
Armadillo| tElock| |
lines=90 lines=75 embedded dns |
trace trace |
| T:11:48:00 | Win2K-f | 70.184.248.143 (COX.NET): COX COMMUNICATIONS, TULSA, OKLAHOMA, US. (DSL) |
60.190.222.139:65520 | DE:proxim.ircgalaxy.pl US:microsoft.com US:sendinvest.com EU:pozeml.com :pozemle.cn :findhobbits.com CN:ku.installstorm.com EU:budulay.net EU:img.ub8.net 173.45.105.218:8392 US:64.120.176.66:8392 US:64.191.44.8:8392 DE:83.133.119.206:65520 EU:91.214.44.12:80 |
135 | pcap | raw alerts ruleset |
irc http 210 lines |
Yeah : 1.8 profile |
none | summary tarball |
12 of 42 32 of 33 13 of 42 0 of 42 29 of 33 15 of 42 7 of 41 5 of 42 |
596822c922 NEW 87e1117f2a NEW 96a3e2e2e3 NEW 9900f9086a NEW b4fe4581c3 NEW c47ffbba48 NEW dd3a45a19c NEW e06bce4c4c NEW |
none[none] 3ff643aae6[0] none [none] none [none] 599b835896[0] none [none] 54274a2a4e[0] none [none] |
none:none ASM:Graph none:none none:none ASM:Graph none:none ASM:Graph none:none |
none|none tElock| none|none none|none Armadillo| none|none StarForce| none|none |
none lines=125 embedded dns none none lines=91 none lines=19 none |
none trace none none trace none trace none |
| T:12:14:00 | Win2K-f | 98.189.18.35 (COX.NET): COX COMMUNICATIONS, ATLANTA, GEORGIA, US. (DSL) |
n/a | :www.search3721.com US:search.booyahnetworks.com US:5459.70232.discover-facts.com :www.fiftpose.com US:7465.169.discover-facts.com US:search.thepremiumdirectory.co.uk EU:www.thepremiumdirectory.co.uk EU:77.68.59.22:80 |
135 | pcap | raw alerts ruleset |
http irc 45 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:13:23:00 | Win2K-f | 69.193.74.22 (RR.COM): ROAD RUNNER HOLDCO LLC, HERNDON, VIRGINIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:15:20:00 | Win2K-f | 24.213.224.238 (RR.COM): ROAD RUNNER HOLDCO LLC, AMSTERDAM, NOORD-HOLLAND, NL. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| 16:00:00 | Win2K-f | 219.149.16.175 (163DATA.COM.CN): CHINANET LIAONING PROVINCE NETWORK, SHENYANG, LIAONING, CN. (DSL) |
n/a | US:www.maxmind.com EU:getmyip.co.uk GB:www.vouchercodez.com US:www.getmyip.org :checkip.dyndns.org US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:19:32:00 | Win2K-f | 67.125.140.230 (PACBELL.NET): AT&T INTERNET SERVICES, FRESNO, CALIFORNIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| 19:54:00 | Win2K-f | 195.68.5.52 (-): FR-GLOBAL-REFUND, PARIS, ILE-DE-FRANCE, FR. (100Mbps) |
n/a | US:www.maxmind.com :checkip.dyndns.org US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:20:06:00 | Win2K-f | 202.98.49.129 (163DATA.COM.CN): CHINANET CHONGQING PROVINCE NETWORK, CHONGQING, CHONGQING, CN. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 213 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 42 | 10ede0a299 NEW |
none[none] | none:none |
none|none | none | none | |
| 20:15:00 | Win2K-f | 190.175.73.217 (COM.AR): TELEFONICA DE ARGENTINA, AR. (DSL) |
n/a | US:www.maxmind.com US:www.getmyip.org :checkip.dyndns.org EU:getmyip.co.uk GB:www.vouchercodez.com 208.78.70.70:80 US:67.15.94.80:80 US:75.126.138.202:80 GB:80.82.121.239:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
2 of 37 | d60e538e72 NEW |
none[3] | none:none |
UPX| | none | trace |
| T:20:26:00 | WinXP | 222.144.118.197 (OCN.NE.JP): OPEN COMPUTER NETWORK, NIIGATA, NIIGATA, JP. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 14 lines |
Yeah : 1.3 profile |
none | summary tarball |
31 of 32 | 741e3b03b3 NEW |
none[0] | none:none |
none|none | lines=61 | trace | |
| T:23:19:00 | WinXP | 70.240.100.7 (SBCGLOBAL.NET): AT&T INTERNET SERVICES, HOUSTON, TEXAS, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |