|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:02:34:00 | WinXP | 61.205.153.202 (ZAQ.NE.JP): J:COM WEST CO. LTD, OSAKA, OSAKA, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 111 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 40 of 41 |
71e6f60517 NEW ab4e3226c4 NEW |
1ef1781501 [0] c2d0313e73[0] |
ASM:Graph none:none |
Armadillo| tElock| |
lines=91 none |
trace trace |
| 03:45:00 | Win2K-f | 70.38.87.126 (PRIVATEDNS.COM): MANU, MONTREAL, QUEBEC, CA. (100Mbps) |
n/a | US:www.maxmind.com US:www.getmyip.org EU:getmyip.co.uk :checkip.dyndns.org US:67.15.94.80:80 US:75.126.138.202:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:03:54:00 | Win2K-f | 70.38.87.126 (PRIVATEDNS.COM): MANU, MONTREAL, QUEBEC, CA. (100Mbps) |
n/a | US:www.maxmind.com US:www.getmyip.org :checkip.dyndns.org US:67.15.94.80:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:05:15:00 | WinXP | 203.198.218.17 (NETVIGATOR.COM): CCC046 INTERNET ACCESS IBS, HONG KONG, HONG KONG (SAR), HK. (100Mbps) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 111 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 41 39 of 41 |
2b47f2f06e NEW d02ed5d41f NEW |
59b80dc1ac [0] 9e3f05fdb0[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=91 lines=64 embedded dns |
trace trace |
| 05:52:00 | Win2K-f | 218.72.76.71 (163DATA.COM.CN): CHINANET-ZJ HANGZHOU NODE NETWORK, HANGZHOU, ZHEJIANG, CN. (DSL) |
n/a | US:www.maxmind.com US:www.getmyip.org :checkip.dyndns.org EU:getmyip.co.uk 208.78.70.70:80 US:67.15.94.80:80 US:75.126.138.202:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:06:18:00 | WinXP | 59.104.201.45 (SEED.NET.TW): SEEDNET-KAOHSIUNGDP-S, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 115 lines |
Yeah : 1.3 profile |
none | summary tarball |
41 of 42 40 of 42 |
3d80e053d7 NEW efbe674ffe NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:08:07:00 | WinXP | 4.231.214.122 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, MIAMI, FLORIDA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 531 lines |
Yeah : 1.3 profile |
none | summary tarball |
41 of 42 | d35edc70a6 NEW |
none[none] | none:none |
none|none | none | none | |
| T:10:21:00 | WinXP | 122.146.252.192 (SPARQNET.NET): NEW CENTRY INFOCOM TECH. CO. LTD, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:12:23:00 | Win2K-f | 64.181.117.213 (-): JHW CHARITABLE ANNUITY TRUST, CHARLESTON, WEST VIRGINIA, US. (100Mbps) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 112 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 40 38 of 40 |
67f1a33096 NEW 724cf0dc37 NEW |
148e04eaab [0] 901dd267d4[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=91 lines=64 embedded dns |
trace trace |
| 12:47:00 | Win2K-f | 190.68.113.3 (TELEFONICA.NET.CO): COLOMBIA TELECOMUNICACIONES S.A. ESP, ARMENIA, QUINDIO, CO. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:13:24:00 | WinXP | 61.99.41.142 (SONICANT.CO.KR): THRUNET CO. LTD, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
60.190.222.139:65520 | CN:proxima.ircgalaxy.pl US:microsoft.com :frensomo.com EU:pozeml.com CN:ku.installstorm.com EU:img.ub8.net CN:0305.installstorm.com US:208.43.146.98:80 CN:60.190.222.139:65520 75.125.220.178:80 EU:91.212.41.97:80 EU:91.214.44.12:80 |
135 | pcap | raw alerts ruleset |
irc http 181 lines |
Yeah : 1.8 profile |
none | summary tarball |
12 of 42 31 of 33 39 of 41 15 of 42 |
596822c922 NEW 6e2eaa0359 NEW 71ece09646 NEW c47ffbba48 NEW |
none[none] none [4] 5e74a7c1aa[0] none [none] |
none:none none:none ASM:Graph none:none |
none|none PolyEnE| Armadillo| none|none |
none none lines=91 none |
none trace trace none |
| T:21:53:00 | WinXP | 174.3.13.143 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, CA. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 1008 lines |
Yeah : 1.3 profile |
none | summary tarball |
31 of 41 | 682a384fe9 NEW |
none[3] | none:none |
none|none | none | trace |