Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

15 May 2010
<prev>   <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.


Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]
Time
 		Victim
OS
 		Infection
Source
 		C&C
Server
 		DNS Lookups &
Failed Connects 		Infection
Port
 		Packet
Trace
 		Detection
Signatures
 		Infection
Chatter
 		BotHunter
Analysis
 		Behavioral
Cluster
 		Forensic
Logs
 		Antivirus
Labels
 		Packed Malware_Binary Unpacked egg.exe
 		Unpacked egg.asm
 		Packer PEID
 		Data Strings
 		Syscall Trace
T:00:05:00 Win2K-f 63.246.125.200 (ALTUSCGI.NET):
PRIVATE CABLE ISP SUBSCRIBER (GEORGETOWN SC MARKET),
GEORGETOWN, SOUTH CAROLINA, US. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:00:59:00 WinXP 113.255.19.188 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
1008 lines 		Yeah : 1.3
profile 		none summary
tarball 		22 of 41 74e2535692
NEW 		none[none] none:none
 none|none none none
03:13:00 Win2K-f 61.231.227.137 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a US:www.maxmind.com
US:www.getmyip.org
EU:getmyip.co.uk
:checkip.dyndns.org
DE:131.220.6.26:80
208.78.70.70:80
US:75.126.138.202:80
EU:78.40.35.134:80 		445 pcap raw alerts
ruleset 		http
4 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
03:29:00 Win2K-f 190.50.51.8 (COM.AR):
TELEFONICA DE ARGENTINA,
LA PLATA, BUENOS AIRES, AR. (DSL) 		n/a US:www.maxmind.com
US:www.getmyip.org
:checkip.dyndns.org
EU:getmyip.co.uk
208.78.70.70:80
US:67.15.94.80:80
US:75.126.138.202:80
EU:78.40.35.134:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:03:38:00 Win2K-f 190.50.51.8 (COM.AR):
TELEFONICA DE ARGENTINA,
LA PLATA, BUENOS AIRES, AR. (DSL) 		n/a US:www.maxmind.com
:checkip.dyndns.org
DE:131.220.6.26:80 		445 pcap raw alerts
ruleset 		http
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:03:42:00 Win2K-f 71.67.105.157 (RR.COM):
ROAD RUNNER HOLDCO LLC,
CINCINNATI, OHIO, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:03:43:00 WinXP 125.103.232.248 (UCOM.NE.JP):
G-TK0024N,
TOKYO, TOKYO, JP. (DSL) 		n/a EU:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
:wpad
US:new.egg.com 		445 pcap raw alerts
ruleset 		http
http
http
29 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 df17a625ee
NEW 		none[0] none:none
 ASPack| lines=298
embedded dns 		trace
T:04:37:00 Win2K-f 70.60.198.57 (RR.COM):
ROAD RUNNER HOLDCO LLC,
MONROE, NORTH CAROLINA, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:05:15:00 Win2K-f 220.138.146.112 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
57ce4acac2
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:05:34:00 WinXP 81.84.96.69 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
PORTO, PORTO, PT. (DSL) 		n/a DE:citi-bank.ru
DE:213.155.0.224:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		39 of 41 912a073945
NEW 		7874c7f21e [0] ASM:Graph
 PolyEnE| lines=68 trace
T:05:50:00 WinXP 110.93.97.13 (CABLENET.NE.JP):
CABLENET SAITAMA CO. LTD,
JP. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		39 of 41
39 of 41		 5bbb57c115
NEW
75ac189d9e
NEW 		03e5cb3c4a [0]
705dbaa801[0] 		ASM:Graph
ASM:Graph
 Armadillo|
tElock| 		lines=91
lines=64
embedded dns 		trace
trace
T:06:44:00 WinXP 60.248.250.217 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 38
35 of 38		 38ed850a0e
NEW
b9297745a1
NEW 		46990f37cd [0]
4294884d84[0] 		ASM:Graph
ASM:Graph
 Armadillo|
tElock| 		lines=91
lines=64
embedded dns 		trace
trace
T:06:59:00 WinXP 115.165.50.198 (CATV02.ITSCOM.JP):
ITS COMMUNICATIONS INC,
TOKYO, TOKYO, JP. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:07:30:00 WinXP 69.193.113.223 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. (DSL) 		n/a US:gg.arrancar.org
US:216.240.187.145:555 		135 pcap raw alerts
ruleset 		other
186 lines 		Yeah : 1.3
profile 		none summary
tarball 		40 of 41 0b095f0cef
NEW 		none[none] none:none
 none|none none none
T:07:40:00 Win2K-f 113.252.100.75 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
99 lines 		Yeah : 1.3
profile 		none summary
tarball 		39 of 40
40 of 41		 435b7fcc1e
NEW
a2904ec678
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:07:56:00 Win2K-f 69.193.68.239 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:08:22:00 Win2K-f 198.182.77.8 (ACES.NET):
LOGIN INC,
PORTLAND, OREGON, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:08:47:00 WinXP 212.144.195.102 (ARCOR-IP.NET):
ARCOR AG & CO KG,
HANNOVER, NIEDERSACHSEN, DE. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 32 03f912899b
NEW 		none[0] none:none
 none|none lines=64 trace
T:08:59:00 Win2K-f 70.182.0.19 (COX.NET):
COX COMMUNICATIONS,
ANNANDALE, VIRGINIA, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:10:11:00 WinXP 93.102.80.73 (REV.OPTIMUS.PT):
OPTIMUS PORTUGAL,
PORTO, PORTO, PT. (DSL) 		213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		26 of 28 7d99b0e910
NEW 		none[0] none:none
 PolyEnE| lines=68 trace
10:36:00 WinXP 125.230.110.184 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) 		213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		39 of 41 d8040f84d4
NEW 		d683995e84 [0] ASM:Graph
 PolyEnE| lines=73 trace
T:11:54:00 Win2K-f 64.183.245.31 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HOUSTON, TEXAS, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		38 of 40
38 of 40		 67f1a33096
NEW
724cf0dc37
NEW 		148e04eaab [0]
901dd267d4[0] 		ASM:Graph
ASM:Graph
 Armadillo|
tElock| 		lines=91
lines=64
embedded dns 		trace
trace
T:11:58:00 Win2K-f 125.58.94.139 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, TOKYO, JP. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
99 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 36
33 of 36		 3e21c32c49
NEW
f72c1db076
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:12:17:00 Win2K-f 203.118.238.245 (-):
GRAND TAINAN TECHNOLOGY CO.LTD,
TAINAN, T'AI-WAN, TW. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		40 of 41
40 of 41		 5fae5f1583
NEW
a3395c110a
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:12:23:00 WinXP 93.189.73.128 (-):
JSC CELLULAR COMMUNICATIONS OF BASHKORTOSTAN,
RU. (DSL) 		n/a   445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
T:12:36:00 Win2K-f 70.183.118.212 (COX.NET):
COX COMMUNICATIONS,
GRETNA, LOUISIANA, US. (DSL) 		83.133.119.206:65520 DE:proxim.ircgalaxy.pl
US:microsoft.com
CN:ku1.installstorm.com
CN:ad.lometr.pl
CN:down.installstorm.com
US:sendinvest.com
:findhobbits.com
CN:pic.iwillhavesexygirls.com
US:search.toptravellingtips.com
US:search.articleswave.co.uk
:www.searchour.com
:nl.travelzip.co.uk
US:cancerbuy.com
:ab83be13.linkbucks.com
US:adversefactors.com 		135 pcap raw alerts
ruleset 		irc
http
247 lines 		Yeah : 1.8
profile 		none summary
tarball 		0 of 41
37 of 41
2 of 41
18 of 41
38 of 40
5 of 40
14 of 41
19 of 40
10 of 41		 0d219a7a18
NEW
142ef1aa57
NEW
1af6440eef
NEW
1c556e65a1
NEW
639e2b0093
NEW
a628f15096
NEW
c515a91662
NEW
ceab1e960e
NEW
f5733fa42e
NEW 		none[none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none] 		none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
 none|none
none|none
none|none
none|none
none|none
none|none
none|none
none|none
none|none 		none
none
none
none
none
none
none
none
none 		none
none
none
none
none
none
none
none
none
T:12:42:00 WinXP 60.248.162.75 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
111 lines 		Yeah : 1.3
profile 		none summary
tarball 		38 of 39
35 of 38		 2205443cc8
NEW
b9297745a1
NEW 		04ce1ed773 [none]
4294884d84[0] 		none:none
ASM:Graph
 none|none
tElock| 		none
lines=64
embedded dns 		none
trace
T:13:04:00 Win2K-f 95.27.214.142 (CORBINA.NET):
INVESTELEKTROSVIAZ LTD,
RU. (DSL) 		83.133.119.206:65520 :www.fiftpose.com
US:goplanit.527.asklots.com
US:www.autogrids.com
CA:media.autogrids.com
US:counter.surfcounters.com
CA:media.oranges88.com
:in.7cy.net
:ebankvisa.com
US:searchportal.information.com
CN:down.installstorm.com
US:spi.domainsponsor.com
DE:proxim.ircgalaxy.pl
CN:ku1.installstorm.com
:aslads.ask.com
US:my.iaffiliate.com
:www.workathomepositionplacement.org
174.143.69.181:80 		445 pcap raw alerts
ruleset 		http
irc
http
63 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 41
10 of 41
0 of 41		 677a710521
NEW
f5733fa42e
NEW
f58f771891
NEW 		none[none]
none [none]
none [none] 		none:none
none:none
none:none
 none|none
none|none
none|none 		none
none
none 		none
none
none
13:39:00 Win2K-f 59.52.94.59 (163DATA.COM.CN):
CHINANET JIANGXI PROVINCE NETWORK,
BEIJING, BEIJING, CN. (DSL) 		n/a US:www.maxmind.com
EU:getmyip.co.uk
GB:www.vouchercodez.com
:checkip.dyndns.org
US:67.15.94.80:80
GB:80.82.121.239:80 		445 pcap raw alerts
ruleset 		http
3 lines 		Yeah : 0.8
profile 		none summary
tarball 		5 of 37 741c93f3c1
NEW 		none[3] none:none
 UPX| none trace
T:13:48:00 Win2K-f 59.52.94.59 (163DATA.COM.CN):
CHINANET JIANGXI PROVINCE NETWORK,
BEIJING, BEIJING, CN. (DSL) 		n/a US:www.maxmind.com
EU:getmyip.co.uk
GB:www.vouchercodez.com
US:www.getmyip.org
:checkip.dyndns.org
DE:131.220.6.26:80 		445 pcap raw alerts
ruleset 		http
8 lines 		Yeah : 0.8
profile 		none summary
tarball 		5 of 37 741c93f3c1
NEW 		none[3] none:none
 UPX| none trace
T:13:55:00 WinXP 115.80.60.127 (TAIWANMOBILE.NET):
TAIWAN MOBILE CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a DE:citi-bank.ru
DE:213.155.0.224:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
NEW 		none[0] none:none
 PolyEnE| lines=68 trace
T:16:15:00 Win2K-f 184.80.69.109 (-):
. 		n/a   135 pcap raw alerts
ruleset 		other
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:17:25:00 Win2K-f 4.177.18.171 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SAN DIEGO, CALIFORNIA, US. (DIAL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		37 of 41
36 of 40		 47d3548e36
NEW
d8722af110
NEW 		ab13346633 [0]
ab30a55931[0] 		ASM:Graph
ASM:Graph
 Armadillo|
tElock| 		lines=91
lines=64
embedded dns 		trace
trace
T:17:54:00 WinXP 69.39.87.79 (123.NET):
PARISH COMMUNICATIONS,
AUBURN, MICHIGAN, US. (100Mbps) 		n/a DE:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
RU:ebookfinaltrash.ru
:wpad 		445 pcap raw alerts
ruleset 		http
http
http
http
31 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 a12cab51ef
NEW 		none[0] none:none
 ASPack| lines=281
embedded dns 		trace
T:18:10:00 Win2K-f 24.77.179.202 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SASKATOON, SASKATCHEWAN, CA. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
187 lines 		Yeah : 1.3
profile 		none summary
tarball 		38 of 41 ec90ec15db
NEW 		7b0ab2b387 [0] ASM:Graph
 none|none lines=546 trace
T:19:33:00 WinXP 114.48.13.76 (E-MOBILE.NE.JP):
EMOBILE LTD,
YOKOHAMA, KANAGAWA, JP. (DSL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
13 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
20:08:00 Win2K-f 194.225.115.82 (-):
IRAN POLYMER INSTITUTE,
TEHRAN, ESFAHAN, IR. (DSL) 		n/a   445 pcap raw alerts
ruleset 		http
12 lines 		Argh : 0.3
profile 		none summary
tarball 		none none none none none none none
T:21:32:00 Win2K-f 69.193.123.28 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
22:18:00 Win2K-f 220.130.228.137 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. (100Mbps) 		n/a US:www.maxmind.com
EU:getmyip.co.uk
US:www.getmyip.org
:checkip.dyndns.org
208.78.70.70:80
US:67.15.94.80:80
EU:78.40.35.134:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		7 of 37 7587773eea
NEW 		none[3] none:none
 StarForce| none trace
T:22:20:00 WinXP 190.4.219.228 (E-CORPNET.ORG):
TELEFONICA MOVIL DE CHILE S.A,
SANTIAGO, REGION METROPOLITANA, CL. (DSL) 		213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		26 of 28 7d99b0e910
NEW 		none[0] none:none
 PolyEnE| lines=68 trace
T:22:26:00 Win2K-f 220.130.228.137 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. (100Mbps) 		n/a US:www.maxmind.com
EU:getmyip.co.uk
GB:www.vouchercodez.com
:checkip.dyndns.org
DE:131.220.6.26:80 		445 pcap raw alerts
ruleset 		http
7 lines 		Yeah : 0.8
profile 		none summary
tarball 		7 of 37 7587773eea
NEW 		none[3] none:none
 StarForce| none trace
T:22:58:00 WinXP 61.62.22.89 (SO-NET.NET.TW):
SONY NETWORK TAIWAN LIMITED,
TAIPEI, T'AI-PEI, TW. (DSL) 		213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		39 of 41 d8040f84d4
NEW 		d683995e84 [0] ASM:Graph
 PolyEnE| lines=73 trace