|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:01:00:00 | WinXP | 91.64.74.144 (SUPERKABEL.DE): KABEL-DEUTSCHLAND-CUSTOMER-SERVICES, BERLIN, BERLIN, DE. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 15 lines |
Yeah : 1.3 profile |
none | summary tarball |
42 of 42 | c46f4552da NEW |
none[none] | none:none |
none|none | none | none | |
| T:01:46:00 | WinXP | 114.48.218.148 (E-MOBILE.NE.JP): EMOBILE LTD, TOKYO, TOKYO, JP. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 15 lines |
Yeah : 1.3 profile |
none | summary tarball |
37 of 40 | 5285741560 NEW |
60590b8b67 [0] | ASM:Graph |
none|none | lines=59 | trace | |
| T:02:31:00 | Win2K-f | 75.184.34.161 (RR.COM): ROAD RUNNER HOLDCO LLC, WATSONVILLE, CALIFORNIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 33 33 of 33 |
4c3df24b32 NEW 53bfe15e91 NEW |
none[0] 1473091351[0] |
none:none ASM:Graph |
Armadillo| tElock| |
lines=90 lines=75 embedded dns |
trace trace |
| T:03:02:00 | Win2K-f | 180.70.64.147 (-): HANARO TELECOM, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
83.133.119.206:65520 | CN:proxim.ircgalaxy.pl US:microsoft.com US:sendinvest.com EU:pozeml.com :findhobbits.com :pozemle.cn CN:ku.installstorm.com 173.45.105.218:8392 CN:222.170.127.203:80 US:64.120.176.66:8392 US:64.191.44.8:8392 DE:83.133.119.206:65520 |
135 | pcap | raw alerts ruleset |
irc http 131 lines |
Yeah : 1.8 profile |
none | summary tarball |
30 of 33 28 of 33 16 of 42 17 of 42 27 of 42 |
533d15b5ce NEW 58c343a8d8 NEW 596a06ec31 NEW 79dc4c4778 NEW 7df21769c5 NEW |
c67adf46e2 [0] none [0] none [none] none [none] none [none] |
ASM:Graph none:none none:none none:none none:none |
tElock| Armadillo| none|none none|none none|none |
lines=126 embedded dns lines=91 none none none |
trace trace none none none |
| T:03:30:00 | WinXP | 213.16.145.83 (FORTHNET.GR): FORTHNET-NOC-ATH, ATHENS, ATTIKI, GR. (DIAL) |
n/a | 445 | pcap | raw alerts ruleset |
ftp 13 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | 831f4ee0a7 NEW |
none[0] | none:none |
none|none | lines=60 | trace | |
| T:05:32:00 | WinXP | 69.205.144.162 (RR.COM): ROAD RUNNER HOLDCO LLC, FULTON, NEW YORK, US. (DSL) |
n/a | RU:citi-bank.ru RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a0139d7ad8 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:08:21:00 | WinXP | 59.120.228.224 (HINET.NET): CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 53 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 33 | 57ce4acac2 NEW |
none[0] | none:none |
Armadillo| | lines=90 | trace | |
| 10:08:00 | WinXP | 186.97.197.47 (-): . |
n/a | :moscow-advokat.ru :los-angeles.ca.us.undernet.org SE:ozbytes.dal.net :caen.fr.eu.undernet.org SE:vancouver.dal.net AT:graz.at.eu.undernet.org :brussels.be.eu.undernet.org NL:diemen.nl.eu.undernet.org NL:london.uk.eu.undernet.org :flanders.be.eu.undernet.org :lulea.se.eu.undernet.org :gaspode.zanet.org.za |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 1.3 profile |
none | summary tarball |
38 of 42 | dcf68cf1b4 NEW |
none[none] | none:none |
none|none | none | none |
| T:11:32:00 | WinXP | 173.24.240.39 (MCHSI.COM): MEDIACOM COMMUNICATIONS CORP, HUNTSVILLE, ALABAMA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 10 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:13:41:00 | Win2K-f | 24.76.2.134 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, SELKIRK, MANITOBA, CA. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 42 39 of 42 |
a1fac31325 NEW c018e17b5b NEW |
0fd057b5e2 [none] 8caee80d88[none] |
none:none none:none |
Armadillo| StarForce| |
none none |
none none |
| 13:57:00 | Win2K-f | 72.34.46.4 (ELINUXSERVERS.COM): IH NETWORKS, ENCINO, CALIFORNIA, US. (DSL) |
n/a | US:www.maxmind.com US:www.getmyip.org :checkip.dyndns.org EU:getmyip.co.uk GB:www.vouchercodez.com 208.78.70.70:80 US:67.15.94.80:80 US:75.126.138.202:80 GB:80.82.121.239:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| 15:06:00 | Win2K-f | 190.68.113.3 (TELEFONICA.NET.CO): COLOMBIA TELECOMUNICACIONES S.A. ESP, ARMENIA, QUINDIO, CO. (DSL) |
n/a | US:www.maxmind.com US:www.getmyip.org EU:getmyip.co.uk GB:www.vouchercodez.com :checkip.dyndns.org 190.68.113.3:6109 208.78.70.70:80 US:67.15.94.80:80 US:75.126.138.202:80 GB:80.82.121.239:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:20:36:00 | Win2K-f | 4.153.64.33 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, FAIRVIEW, TENNESSEE, US. (DIAL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 99 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:20:57:00 | WinXP | 220.138.144.101 (HINET.NET): CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 88 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW 57ce4acac2 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:22:47:00 | WinXP | 211.109.96.61 (SONICANT.CO.KR): THRUNET CO. LTD, KUNSAN, CHOLLA-BUKTO, KR. (DSL) |
60.190.222.139:65520 | DE:proxima.ircgalaxy.pl US:microsoft.com US:sendinvest.com :findhobbits.com EU:pozeml.com :pozemle.cn CN:ku.installstorm.com US:64.120.232.147:80 US:66.96.221.102:80 DE:83.133.119.206:65520 |
135 | pcap | raw alerts ruleset |
irc http 197 lines |
Yeah : 1.8 profile |
none | summary tarball |
16 of 42 27 of 42 34 of 36 29 of 32 19 of 42 9 of 42 0 of 42 |
596a06ec31 NEW 7df21769c5 NEW 99b248336f NEW 9d677c3f70 NEW a6e81f92e5 NEW c7d712367b NEW d57a85557c NEW |
none[none] none [none] c64bd1a776[0] 77e75ff10f[0] none [none] none [none] none [none] |
none:none none:none ASM:Graph ASM:Graph none:none none:none none:none |
none|none none|none Armadillo| tElock| none|none none|none none|none |
none none lines=91 lines=120 embedded dns none none none |
none none trace trace none none none |