|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:05:23:00 | WinXP | 98.154.55.187 (RR.COM): ROAD RUNNER HOLDCO LLC, FULLERTON, CALIFORNIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:08:20:00 | WinXP | 121.120.90.168 (MAXIS.NET.MY): MAXIS BROADBAND SDN BHD, KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
other 0 lines |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:08:32:00 | Win2K-f | 92.96.154.218 (NET.AE): EMIRATES TELECOMMUNICATIONS CORPORATION, DUBAI, DUBAI, AE. (DSL) |
n/a | US:www.maxmind.com US:www.getmyip.org EU:getmyip.co.uk :checkip.dyndns.org DE:131.220.6.26:80 US:204.152.184.139:80 US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:10:26:00 | Win2K-f | 70.182.0.145 (COX.NET): COX COMMUNICATIONS, ANNANDALE, VIRGINIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:12:29:00 | Win2K-f | 173.29.253.168 (MCHSI.COM): MEDIACOM COMMUNICATIONS CORP, CHANHASSEN, MINNESOTA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 41 39 of 41 |
10759405e0 NEW d08e00dfaf NEW |
292d343248 [0] 854c49d8c4[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=91 lines=64 embedded dns |
trace trace |
| T:15:24:00 | Win2K-f | 96.8.189.107 (GVTC.COM): GUADALUPE VALLEY TELEPHONE COOPERATIVE INC, CANYON LAKE, TEXAS, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 79 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:16:02:00 | Win2K-f | 79.53.96.213 (RETAIL.TELECOMITALIA.IT): TELECOM ITALIA NET, ENNA, SICILIA, IT. (DSL) |
n/a | US:www.maxmind.com DE:131.220.6.26:80 US:204.152.184.139:80 US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:16:28:00 | WinXP | 4.155.102.253 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, MARS, PENNSYLVANIA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 168 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
|
| T:17:32:00 | WinXP | 112.78.80.52 (-): VIBO TELECOM INC, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | EU:citi-bank.ru EU:91.207.7.82:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
40 of 41 | cf346981b5 NEW |
2eb6c94f0a [0] | ASM:Graph |
PolyEnE| | lines=73 | trace |
| T:17:39:00 | Win2K-f | 70.128.25.15 (PARAGOULD.NET): PARAGOULD CITY LIGHT & WATER, PARAGOULD, ARKANSAS, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 125 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 42 41 of 42 |
4d91db06f4 NEW 80ad2a0006 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:19:15:00 | Win2K-f | 201.22.96.243 (STERLINGSTUDENTS.NET): COMITE GESTOR DA INTERNET NO BRASIL, BR. (DSL) |
n/a | US:www.maxmind.com US:204.152.184.139:80 US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
other 0 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| 22:31:00 | Win2K-f | 118.233.101.188 (KBRONET.COM.TW): TUNG HO MULTIMEDIA CO. LTD, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org DE:131.220.6.26:80 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:22:53:00 | Win2K-f | 74.233.135.231 (BELLSOUTH.NET): BELLSOUTH.NET INC, WEST PALM BEACH, FLORIDA, US. (DSL) |
n/a | CN:www.baidu.com :wmvjagcb.com :xkbhgwg.com :aicagzkouh.net US:orwienpfy.biz US:rydovz.biz US:hvcwmltwy.org US:hsxwcogs.biz US:ydhia.org :brulh.com :tabjtz.net :uvnqyi.net :nrcky.net US:sppmfy.org US:qsevcgc.org :epvgxingm.net :mygoyczv.net US:selgsmru.biz US:tuqeszsnx.org US:gwfvi.org US:kvxmnkkd.org US:204.152.184.139:80 US:74.208.64.145:80 |
135 | pcap | raw alerts ruleset |
http 4 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:23:34:00 | WinXP | 70.184.248.143 (COX.NET): COX COMMUNICATIONS, TULSA, OKLAHOMA, US. (DSL) |
60.190.222.139:65520 | CN:proxim.ircgalaxy.pl US:microsoft.com CN:av.lometr.pl :pozemle.cn :frensomo.com CN:ku.installstorm.com EU:pozeml.com CN:222.170.127.203:88 CN:60.190.222.131:81 75.125.220.178:80 EU:91.206.201.40:80 93.174.92.220:80 |
135 | pcap | raw alerts ruleset |
irc 137 lines |
Yeah : 1.8 profile |
none | summary tarball |
32 of 33 29 of 33 |
87e1117f2a NEW b4fe4581c3 NEW |
3ff643aae6 [0] 599b835896[0] |
ASM:Graph ASM:Graph |
tElock| Armadillo| |
lines=125 embedded dns lines=91 |
trace trace |