|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:00:16:00 | WinXP | 114.51.65.132 (E-MOBILE.NE.JP): EMOBILE LTD, TOKYO, TOKYO, JP. (DSL) |
n/a | EE:www.starman.ee EE:195.50.195.10:443 |
445 | pcap | raw alerts ruleset |
http 14 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:00:18:00 | Win2K-f | 125.4.245.140 (ZAQ.NE.JP): J:COM WEST CO. LTD, TOKYO, TOKYO, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 111 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 41 37 of 41 |
98d2778fd6 NEW f676f3bf5b NEW |
9feea491cb [0] 0fba495fc4[0] |
ASM:Graph ASM:Graph |
tElock| Armadillo| |
lines=64 embedded dns lines=91 |
trace trace |
| T:01:30:00 | WinXP | 60.249.37.106 (HINET.NET): CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | EE:www.starman.ee EE:www.online.if.ee FI:194.215.38.3:80 EE:195.50.195.10:443 EE:62.65.192.24:80 |
135 | pcap | raw alerts ruleset |
http 11 lines |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:03:23:00 | WinXP | 93.102.74.217 (REV.OPTIMUS.PT): OPTIMUS PORTUGAL, PORTO, PORTO, PT. (DSL) |
n/a | :www.yahoo.com US:www.altavista.com :jbeegvia.ru US:www.worldbank.org :crime-research.ru :yoiayoi.ru :wcqahzhzn.ru :iirpryry.ru :rihafvu.ru :wpad :ryryodokm.ru :uvjiis.ru :gwvwka.ru :jqsbnyzkp.ru :pvygdo.ru :fxkyagpnw.ru :knclvdz.ru :trsqeigw.ru :odokeqy.ru :kelmpsjp.ru :edjiesp.ru :vllcdvv.ru :nuksdln.ru :tmmeno.ru :zoxdgqx.ru :pwvbfz.ru :nuzbcp.ru :bqpuqt.ru :okskyyn.ru :pnlkria.ru :kargai.ru DE:kavkaz.co.uk :kfwfceki.ru :nhuwxyuw.ru RU:alfabank.ru :udluzuq.ru :fiazpvnne.ru RU:prodexteam.net :ppxuub.ru :lvwgdhwlj.ru GB:www.candidateverifier.com :raxeqajrf.ru :dhagunb.ru EU:crutop.nu |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 1.3 profile |
none | summary tarball |
31 of 32 | 17028f1eda NEW |
none[3] | none:none |
tElock| | none | trace |
| T:04:29:00 | Win2K-f | 70.183.3.169 (COX.NET): COX COMMUNICATIONS, SPRINGFIELD, VIRGINIA, US. (DSL) |
83.133.119.206:65520 | US:microsoft.com DE:proxim.ircgalaxy.pl FR:updatemania.info CN:ku1.installstorm.com US:sendinvest.com US:findhobbits.com GR:img.ub8.net US:search.toptravellingtips.com CN:test.installstorm.com US:search.articleswave.co.uk :www.searchour.com :nl.travelzip.co.uk :www.backblogs.com :www.focusdrink.com :www.sellbloom.com 184.82.12.164:80 184.82.12.36:80 US:8.5.1.45:8392 |
135 | pcap | raw alerts ruleset |
irc http 368 lines |
Yeah : 1.8 profile |
none | summary tarball |
16 of 40 0 of 40 21 of 40 25 of 40 32 of 33 29 of 33 20 of 40 24 of 40 |
2f3e006172 NEW 5b15b08b95 NEW 72f8f0b0bd NEW 7d56914e19 NEW 87e1117f2a NEW b4fe4581c3 NEW df71997bf9 NEW e4361de0c1 NEW |
none[none] none [none] none [none] none [none] 3ff643aae6[0] 599b835896[0] none [none] none [none] |
none:none none:none none:none none:none ASM:Graph ASM:Graph none:none none:none |
none|none none|none none|none none|none tElock| Armadillo| none|none none|none |
none none none none lines=125 embedded dns lines=91 none none |
none none none none trace trace none none |
| T:04:42:00 | Win2K-f | 24.58.224.244 (RR.COM): ROAD RUNNER HOLDCO LLC, MASSENA, NEW YORK, US. (DSL) |
n/a | :search.traveleuropesecrets.com EU:www.traveleuropesecrets.com :www.formmesh.com US:gselions.335.asklots.com US:www.advertise.com :www.usehonor.com :www.termsloan.com :programbilling.com :enjoyolathe.com :awningsandcanpees.com :beastab.com US:catsconsumer.com :es.travelzip.co.uk US:microsoft.com :judiciousbalance.info :cutsomeyeglasses.com :www.hophealth.com :amaniproperty.info US:8.5.1.45:8392 |
445 | pcap | raw alerts ruleset |
http irc 124 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:04:48:00 | WinXP | 173.168.58.239 (RR.COM): ROAD RUNNER HOLDCO LLC, HERNDON, VIRGINIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 111 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 40 39 of 40 |
985a714ee1 NEW c65cddd972 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:04:58:00 | Win2K-f | 125.231.93.168 (HINET.NET): CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP, TAIPEI, T'AI-PEI, TW. (DSL) |
60.190.222.139:65520 | :pictureper.com DE:proxim.ircgalaxy.pl CN:av.lometr.pl FR:updatemania.info CN:ku1.installstorm.com :img.ub8.net CN:test.installstorm.com :xz.ub9.net :in.7cy.net US:microsoft.com 184.82.12.164:80 184.82.12.36:80 US:8.5.1.45:8392 |
445 | pcap | raw alerts ruleset |
http irc 174 lines |
Yeah : 1.3 profile |
none | summary tarball |
34 of 40 21 of 40 33 of 40 20 of 40 24 of 40 |
72e3100fa7 NEW 72f8f0b0bd NEW a4d3ff3ac9 NEW df71997bf9 NEW e4361de0c1 NEW |
none[none] none [none] none [none] none [none] none [none] |
none:none none:none none:none none:none none:none |
none|none none|none none|none none|none none|none |
none none none none none |
none none none none none |
| T:05:08:00 | WinXP | 203.70.46.240 (SEED.NET.TW): SEEDNET-TAIPEIDP-S, TAIPEI, T'AI-PEI, TW. (100Mbps) |
n/a | 135 | pcap | raw alerts ruleset |
other 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:07:05:00 | Win2K-f | 70.69.191.200 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, ABBOTSFORD, BRITISH COLUMBIA, CA. (DSL) |
n/a | FI:194.215.38.3:80 EE:62.65.192.24:80 |
135 | pcap | raw alerts ruleset |
irc 3 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:08:59:00 | Win2K-f | 173.27.197.140 (MCHSI.COM): MEDIACOM COMMUNICATIONS CORP, DAVENPORT, IOWA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 41 39 of 41 |
10759405e0 NEW d08e00dfaf NEW |
292d343248 [0] 854c49d8c4[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=91 lines=64 embedded dns |
trace trace |
| T:12:37:00 | WinXP | 186.9.192.117 (IMOVIL.ENTELPCS.CL): ENTEL PCS TELECOMUNICACIONES S.A, SANTIAGO, REGION METROPOLITANA, CL. (DSL) |
n/a | :moscow-advokat.ru SE:viking.dal.net NL:diemen.nl.eu.undernet.org SE:coins.dal.net SE:ozbytes.dal.net :gaspode.zanet.org.za AT:graz.at.eu.undernet.org SE:qis.md.us.dal.net :caen.fr.eu.undernet.org NO:london.uk.eu.undernet.org SE:broadway.ny.us.dal.net |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 1.3 profile |
none | summary tarball |
25 of 25 | 7f60162c2c NEW |
none[0] | none:none |
PolyEnE| | lines=93 embedded dns |
trace |
| T:12:57:00 | Win2K-f | 175.113.138.87 (-): . |
60.190.222.139:65520 | US:microsoft.com DE:proxim.ircgalaxy.pl CN:60.190.222.139:65520 DE:83.133.119.206:65520 |
135 | pcap | raw alerts ruleset |
irc 123 lines |
Yeah : 1.8 profile |
none | summary tarball |
30 of 33 28 of 33 |
533d15b5ce NEW 58c343a8d8 NEW |
c67adf46e2 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=126 embedded dns lines=91 |
trace trace |
| T:13:24:00 | WinXP | 186.9.179.181 (IMOVIL.ENTELPCS.CL): ENTEL PCS TELECOMUNICACIONES S.A, SANTIAGO, REGION METROPOLITANA, CL. (DSL) |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
35 of 35 | 9716d7995a NEW |
c3a5354b6f [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:16:18:00 | WinXP | 91.148.99.170 (BEOTEL.NET): BEOTELNET ISP, CS. (DSL) |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 7 lines |
Yeah : 1.3 profile |
none | summary tarball |
32 of 32 | d1377a8b90 NEW |
ad56da3672 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| 20:12:00 | Win2K-f | 190.3.87.236 (TECHTELNET.NET): TECHTEL LMDS COMUNICACIONES INTERACTIVAS S.A, BUENOS AIRES, BUENOS AIRES, AR. (DSL) |
n/a | US:www.maxmind.com US:www.getmyip.org EU:getmyip.co.uk GB:www.vouchercodez.com :checkip.dyndns.org DE:131.220.6.26:80 208.78.70.70:80 GB:80.82.121.239:80 |
445 | pcap | raw alerts ruleset |
http 6 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | dc331fb791 NEW |
none[3] | none:none |
UPX| | none | trace |
| T:20:53:00 | Win2K-f | 24.213.224.238 (RR.COM): ROAD RUNNER HOLDCO LLC, AMSTERDAM, NOORD-HOLLAND, NL. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| 20:56:00 | WinXP | 58.239.153.184 (-): THRUNET-INFRA-BUSAN18, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
83.133.119.206:65520 | FR:updatemania.info CN:ku1.installstorm.com CN:sky.installstorm.com CN:test.installstorm.com :xz.ub9.net :in.7cy.net FR:193.105.174.106:80 US:64.120.232.147:80 |
139 | pcap | raw alerts ruleset |
irc http 35 lines |
Yeah : 1.3 profile |
none | summary tarball |
17 of 40 34 of 40 14 of 40 |
40fa21a42b NEW 72e3100fa7 NEW 981b2b06d5 NEW |
none[none] none [none] none [none] |
none:none none:none none:none |
none|none none|none none|none |
none none none |
none none none |
| T:20:59:00 | WinXP | 115.165.80.12 (CATV02.ITSCOM.JP): ITS COMMUNICATIONS INC, KAWASAKI, KANAGAWA, JP. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 14 lines |
Yeah : 1.3 profile |
none | summary tarball |
31 of 32 | 741e3b03b3 NEW |
none[0] | none:none |
none|none | lines=61 | trace | |
| T:21:33:00 | Win2K-f | 113.255.152.156 (HUTCHCITY.COM): HUTCHISON GLOBAL COMMUNICATIONS, HK. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 99 lines |
Yeah : 1.3 profile |
none | summary tarball |
37 of 41 37 of 41 |
568b9e866c NEW 5c20c3472e NEW |
6dfc90ff94 [0] 9ca7a71763[0] |
ASM:Graph ASM:Graph |
tElock| tElock| |
lines=42 lines=64 embedded dns |
trace trace |
| 22:06:00 | Win2K-f | 222.48.168.176 (-): KUNDE HTECH LTD CO, BEIJING, BEIJING, CN. (DSL) |
n/a | US:www.maxmind.com EU:getmyip.co.uk GB:www.vouchercodez.com US:www.getmyip.org :checkip.dyndns.org DE:131.220.6.26:80 208.78.70.70:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 6 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:22:20:00 | Win2K-f | 222.48.168.176 (-): KUNDE HTECH LTD CO, BEIJING, BEIJING, CN. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org DE:131.220.6.26:80 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:22:49:00 | Win2K-f | 222.48.168.176 (-): KUNDE HTECH LTD CO, BEIJING, BEIJING, CN. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org DE:131.220.6.26:80 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:23:25:00 | Win2K-f | 190.3.87.236 (TECHTELNET.NET): TECHTEL LMDS COMUNICACIONES INTERACTIVAS S.A, BUENOS AIRES, BUENOS AIRES, AR. (DSL) |
n/a | US:www.maxmind.com EU:getmyip.co.uk GB:www.vouchercodez.com US:www.getmyip.org :checkip.dyndns.org DE:131.220.6.26:80 |
445 | pcap | raw alerts ruleset |
http 8 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | dc331fb791 NEW |
none[3] | none:none |
UPX| | none | trace |
| T:23:27:00 | WinXP | 72.181.146.233 (RR.COM): ROAD RUNNER HOLDCO LLC, PLANO, TEXAS, US. (DSL) |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |