|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:01:40:00 | Win2K-f | 61.216.1.77 (HINET.NET): CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com FI:194.215.38.3:80 US:204.152.184.139:80 EE:62.65.192.24:80 |
135 | pcap | raw alerts ruleset |
http 6 lines |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| 01:44:00 | Win2K-f | 173.45.87.53 (XLHOST.COM): XLHOST.COM INC, COLUMBUS, OHIO, US. (100Mbps) |
n/a | US:www.maxmind.com :checkip.dyndns.org US:www.getmyip.org EU:getmyip.co.uk GB:www.vouchercodez.com 208.78.70.70:80 US:67.15.94.80:80 US:75.126.138.202:80 GB:80.82.121.239:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | dc331fb791 NEW |
none[3] | none:none |
UPX| | none | trace |
| T:02:14:00 | Win2K-f | 12.150.224.244 (WATVC.COM): WEST ALABAMA TV CABLE CO, WINFIELD, ALABAMA, US. (DSL) |
n/a | EE:www.starman.ee FI:194.215.38.3:80 EE:62.65.192.24:80 |
445 | pcap | raw alerts ruleset |
other 0 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:02:46:00 | Win2K-f | 70.184.102.222 (COX.NET): COX COMMUNICATIONS, PHOENIX, ARIZONA, US. (100Mbps) |
83.133.119.206:65520 | CN:proxim.ircgalaxy.pl US:microsoft.com CN:av.lometr.pl CN:updatemania.info CN:ku.installstorm.com US:sendinvest.com :findhobbits.com GR:img.ub8.net US:search.toptravellingtips.com |
135 | pcap | raw alerts ruleset |
irc http 350 lines |
Yeah : 1.8 profile |
none | summary tarball |
23 of 39 4 of 42 0 of 38 11 of 38 32 of 36 28 of 39 20 of 38 9 of 38 35 of 36 |
51f8865a5d NEW 5fc40655c2 NEW 73fe5f678d NEW 984007bafd NEW bea8cb1865 NEW cc438043d1 NEW e3aec40870 NEW f342fe7900 NEW fac78fde16 NEW |
none[none] none [3] none [none] none [none] 154de51a66[0] none [none] none [none] none [none] 882896ab05[0] |
none:none none:none none:none none:none ASM:Graph none:none none:none none:none ASM:Graph |
none|none none|none none|none none|none Armadillo| none|none none|none none|none tElock| |
none none none none lines=91 none none none lines=126 embedded dns |
none trace none none trace none none none trace |
| T:03:14:00 | Win2K-f | 145.253.136.92 (KRAEMER-MAFO.DE): KRAEMER MARKTFORSCHUNG, LUGANO, TICINO, CH. (100Mbps) |
n/a | EU:smarturl.co.uk :search.homecinemasoftware.com :parkingbill.com US:microsoft.com US:gardenadvance.com 173.45.105.218:8392 |
445 | pcap | raw alerts ruleset |
http irc 75 lines |
Argh : 0.3 profile |
none | summary tarball |
0 of 39 | 4185ffa131 NEW |
none[none] | none:none |
none|none | none | none |
| 05:21:00 | Win2K-f | 89.46.120.53 (-): SC CABLE NC IMPEX SRL, RO. (DSL) |
n/a | US:www.maxmind.com EU:getmyip.co.uk US:www.getmyip.org :checkip.dyndns.org 208.78.70.70:80 US:67.15.94.80:80 US:75.126.138.202:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
2 of 37 | fcb4920986 NEW |
none[3] | none:none |
UPX| | none | trace |
| T:07:56:00 | Win2K-f | 201.79.180.47 (STERLINGSTUDENTS.NET): COMITE GESTOR DA INTERNET NO BRASIL, BR. (DSL) |
n/a | EE:www.starman.ee US:www.maxmind.com FI:194.215.38.3:80 EE:62.65.192.24:80 |
445 | pcap | raw alerts ruleset |
other 0 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:09:23:00 | WinXP | 113.255.145.202 (HUTCHCITY.COM): HUTCHISON GLOBAL COMMUNICATIONS, HK. (DSL) |
n/a | US:microsoft.com EE:www.starman.ee EE:www.online.if.ee FI:www.if.ee FI:194.215.38.3:80 EE:195.50.195.10:443 EE:62.65.192.24:80 |
135 | pcap | raw alerts ruleset |
other 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
32 of 40 33 of 33 |
27b17a2724 NEW 53bfe15e91 NEW |
a1d5ac965b [0] 1473091351[0] |
ASM:Graph ASM:Graph |
tElock| tElock| |
lines=42 lines=75 embedded dns |
trace trace |
| T:09:56:00 | Win2K-f | 67.127.244.194 (PACBELL.NET): APW KNOX SEEMAN, PLANO, TEXAS, US. (100Mbps) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:10:32:00 | WinXP | 98.101.106.156 (RR.COM): ROAD RUNNER HOLDCO LLC, HERNDON, VIRGINIA, US. (DSL) |
n/a | EU:citi-bank.ru EU:91.207.7.82:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:11:21:00 | Win2K-f | 173.28.213.5 (MCHSI.COM): MEDIACOM COMMUNICATIONS CORP, CHANHASSEN, MINNESOTA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
36 of 41 38 of 40 |
067917e07b NEW d764c1dcb2 NEW |
dae35b319c [0] 3d2bc60c5d[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=91 lines=64 embedded dns |
trace trace |
| T:11:45:00 | WinXP | 207.5.200.227 (SUSCOM-MAINE.NET): GREAT WORKS INTERNET, BRUNSWICK, MAINE, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:15:50:00 | Win2K-f | 88.74.179.167 (ARCOR-IP.NET): ARCOR-DSL-NET, LEIPZIG, SACHSEN, DE. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org EU:getmyip.co.uk US:www.getmyip.org DE:131.220.6.26:80 US:204.152.184.139:80 US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 3 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:16:40:00 | WinXP | 186.122.36.68 (-): . |
n/a | EU:citi-bank.ru EU:91.207.7.82:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:23:23:00 | Win2K-f | 75.51.249.146 (-): HASSAN MAHFOOD, PLANO, TEXAS, US. (100Mbps) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:23:59:00 | Win2K-f | 84.166.89.223 (T-DIALIN.NET): DEUTSCHE TELEKOM AG, TRIER, RHEINLAND-PFALZ, DE. (DIAL) |
n/a | US:www.maxmind.com :checkip.dyndns.org US:204.152.184.139:80 US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
other 0 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |