|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| 02:05:00 | Win2K-f | 173.45.87.35 (XLHOST.COM): XLHOST.COM INC, COLUMBUS, OHIO, US. (100Mbps) |
n/a | US:www.maxmind.com US:www.getmyip.org EU:getmyip.co.uk :checkip.dyndns.org 208.78.70.70:80 US:67.15.94.80:80 US:75.126.138.202:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | dc331fb791 NEW |
none[3] | none:none |
UPX| | none | trace |
| 03:25:00 | Win2K-f | 173.45.68.171 (XLHOST.COM): ENET INC, COLUMBUS, OHIO, US. (100Mbps) |
n/a | US:www.maxmind.com :checkip.dyndns.org US:www.getmyip.org EU:getmyip.co.uk 208.78.70.70:80 US:67.15.94.80:80 US:75.126.138.202:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:03:34:00 | Win2K-f | 173.45.68.171 (XLHOST.COM): ENET INC, COLUMBUS, OHIO, US. (100Mbps) |
n/a | US:www.maxmind.com :checkip.dyndns.org US:www.getmyip.org EU:getmyip.co.uk 208.78.70.70:80 US:67.15.94.80:80 US:75.126.138.202:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:04:32:00 | Win2K-f | 110.9.137.4 (-): HANARO TELECOM, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
60.190.222.139:65520 | US:microsoft.com CN:proxim.ircgalaxy.pl CN:ku.installstorm.com US:sendinvest.com US:download.xwche.com :findhobbits.com :img.ub8.net US:search.toptravellingtips.com 173.45.105.218:8392 US:208.43.29.234:80 US:64.191.44.8:8392 US:66.79.164.149:80 |
135 | pcap | raw alerts ruleset |
irc http 332 lines |
Yeah : 1.8 profile |
none | summary tarball |
13 of 42 29 of 32 28 of 32 25 of 42 17 of 42 17 of 42 0 of 36 |
0a613f65c6 NEW 8a75955033 NEW 9276c8b36b NEW a9a36ef0e8 NEW d3551f0f62 NEW dfe535d3c3 NEW eda2d9e91e NEW |
none[none] 2bf3e548b9[0] none [0] none [none] none [none] none [none] none [none] |
none:none ASM:Graph none:none none:none none:none none:none none:none |
none|none tElock| Armadillo| none|none none|none none|none none|none |
none lines=126 embedded dns lines=90 none none none none |
none trace trace none none none none |
| T:13:15:00 | Win2K-f | 93.80.195.126 (CORBINA.RU): BROADBAND CUSTOMERS IN MOSCOW, MOSCOW, MOSCOW CITY, RU. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org DE:131.220.6.26:80 US:204.152.184.139:80 208.78.70.70:80 US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:17:17:00 | Win2K-f | 4.176.246.230 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, TUCSON, ARIZONA, US. (DIAL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 215 lines |
Yeah : 1.3 profile |
none | summary tarball |
37 of 41 36 of 40 |
47d3548e36 NEW d8722af110 NEW |
ab13346633 [0] ab30a55931[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=91 lines=64 embedded dns |
trace trace |
| T:17:56:00 | Win2K-f | 61.250.125.120 (KRLINE.NET): KRNIC, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 89 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 40 of 41 |
53bfe15e91 NEW e9ba0ecde5 NEW |
1473091351 [0] c03f9e1524[0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns none |
trace trace |
| 23:55:00 | Win2K-f | 173.45.114.78 (XLHOST.COM): ENET INC, COLUMBUS, OHIO, US. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |