|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:00:24:00 | WinXP | 201.69.243.73 (STERLINGSTUDENTS.NET): COMITE GESTOR DA INTERNET NO BRASIL, BR. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
40 of 41 | 07cd99a10b NEW |
f8f0f72da6 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| 01:36:00 | WinXP | 61.215.252.161 (CATVNET.NE.JP): CATV NETWORK SERVICES(STNET INCROPORATE), OSAKA, OSAKA, JP. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:01:52:00 | WinXP | 79.163.177.176 (CENTERTEL.PL): PTK CENTERTEL BROADBAND SERVICES, KATOWICE, SLASKIE, PL. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
41 of 41 | 5c6df5141d NEW |
none[none] | none:none |
none|none | none | none |
| T:01:53:00 | WinXP | 79.132.209.227 (MORVA.NET): MORVA ISP, TEHRAN, ESFAHAN, IR. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
32 of 32 | b502f83a7c NEW |
28f5be93b0 [0] | ASM:Graph |
PolyEnE| | lines=73 | trace |
| T:01:55:00 | Win2K-f | 4.163.199.45 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, COLORADO SPRINGS, COLORADO, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 18 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:02:21:00 | WinXP | 4.154.128.21 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, HASTINGS, MICHIGAN, US. (DIAL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 186 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 41 38 of 41 |
c14b80e99f NEW ccd306ed2e NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:02:50:00 | WinXP | 173.171.140.19 (RR.COM): ROAD RUNNER HOLDCO LLC, TAMPA, FLORIDA, US. (DSL) |
n/a | US:gg.arrancar.org US:216.240.187.145:555 |
135 | pcap | raw alerts ruleset |
other 186 lines |
Yeah : 1.3 profile |
none | summary tarball |
41 of 41 | a4497aa84e NEW |
d1b46a6ff9 [0] | ASM:Graph |
none|none | lines=546 | trace |
| T:02:58:00 | WinXP | 78.84.144.246 (-): ADDRESS POOL FOR LTC-HOME CUSTOMERS, RIGA, RIGA, LV. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
41 of 41 | 7c9abadc61 NEW |
none[none] | none:none |
none|none | none | none |
| T:04:15:00 | WinXP | 117.104.5.241 (THN.NE.JP): TOKAI CORPORATION, SHIZUOKA, SHIZUOKA, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 111 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 39 of 41 |
6b315f5dbc NEW 7938865f8c NEW |
7604b94520 [0] a9b9e4904b[0] |
ASM:Graph ASM:Graph |
tElock| Armadillo| |
lines=64 embedded dns lines=91 |
trace trace |
| 04:32:00 | Win2K-f | 196.219.114.238 (TEDATA.NET): RAMSIS-ZONE-DSL, CAIRO, AL QAHIRAH, EG. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:06:28:00 | WinXP | 115.81.5.168 (TAIWANMOBILE.NET): TAIWAN MOBILE CO. LTD, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| 06:42:00 | WinXP | 178.92.165.15 (FINEBLANK.COM): EU-ZZ, UK. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
39 of 41 | 912a073945 NEW |
7874c7f21e [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:07:26:00 | WinXP | 173.27.197.140 (MCHSI.COM): MEDIACOM COMMUNICATIONS CORP, DAVENPORT, IOWA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 41 39 of 41 |
10759405e0 NEW d08e00dfaf NEW |
292d343248 [0] 854c49d8c4[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=91 lines=64 embedded dns |
trace trace |
| T:09:58:00 | WinXP | 69.193.74.22 (RR.COM): ROAD RUNNER HOLDCO LLC, HERNDON, VIRGINIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:10:02:00 | WinXP | 83.68.65.31 (TNP.PL): TELENETCENTRUM-NET, WARSAW, WARSZAWA, PL. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
32 of 32 | 5818023061 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:10:05:00 | WinXP | 62.162.178.163 (-): MOBI BITOLA IP SUBNET, SKOPJE, KARPOS, MK. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 | 1feaf8491d NEW |
none[none] | none:none |
none|none | none | none |
| T:10:25:00 | WinXP | 93.116.126.84 (HOST-STATIC-93-116-0-10.MOLDTELECOM.MD): JSC MOLDTELECOM SA, CHISINAU, CHISINAU, MD. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
35 of 35 | 9716d7995a NEW |
c3a5354b6f [0] | ASM:Graph |
PolyEnE| | lines=68 | trace | |
| 10:26:00 | Win2K-f | 115.171.159.96 (-): CHINANET CDMA NETWORK, BEIJING, BEIJING, CN. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org DE:131.220.6.26:80 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:10:36:00 | WinXP | 96.8.215.231 (GVTC.COM): GUADALUPE VALLEY TELEPHONE COOPERATIVE INC, NEW BRAUNFELS, TEXAS, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 39 of 40 |
9bdd2c95b1 NEW cd456ac095 NEW |
d1bbd693ba [0] d75caee680[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=91 lines=64 embedded dns |
trace trace |
| 10:43:00 | WinXP | 83.68.65.31 (TNP.PL): TELENETCENTRUM-NET, WARSAW, WARSZAWA, PL. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
32 of 32 | 5818023061 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:10:46:00 | WinXP | 121.120.33.228 (MAXIS.NET.MY): MAXIS BROADBAND SDN BHD, KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a12cab51ef NEW |
none[0] | none:none |
ASPack| | lines=281 embedded dns |
trace | |
| T:10:53:00 | WinXP | 87.173.57.171 (T-IPCONNECT.DE): DEUTSCHE TELEKOM AG, BERLIN, BERLIN, DE. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 14 lines |
Yeah : 1.3 profile |
none | summary tarball |
31 of 32 | 741e3b03b3 NEW |
none[0] | none:none |
none|none | lines=61 | trace | |
| T:10:57:00 | WinXP | 110.93.96.124 (CABLENET.NE.JP): CABLENET SAITAMA CO. LTD, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 39 of 41 |
5bbb57c115 NEW 75ac189d9e NEW |
03e5cb3c4a [0] 705dbaa801[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=91 lines=64 embedded dns |
trace trace |
| T:12:30:00 | Win2K-f | 114.204.15.121 (-): HANARO TELECOM, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
83.133.119.206:65520 | CN:proxim.ircgalaxy.pl US:microsoft.com CN:ad.lometr.pl US:forums.ubuntulinux.jp JP:www.marantz.jp EU:avdesk.net.ua UA:shop.pozitiv.ks.ua UA:bunker.org.ua PL:ssl.aukro.ua BR:loja.tray.com.br JP:ir.kagoshima-u.ac.jp JP:www.science-forum.co.jp JP:163.209.180.1:443 UA:195.214.214.53:443 JP:202.191.113.9:443 JP:202.218.111.122:443 JP:203.179.38.26:443 US:207.44.220.4:443 UA:212.111.198.59:443 UA:62.149.23.110:443 US:69.57.128.35:443 US:69.61.11.226:443 EU:79.171.122.236:443 |
135 | pcap | raw alerts ruleset |
irc http 139 lines |
Yeah : 1.8 profile |
none | summary tarball |
36 of 41 30 of 33 28 of 33 |
138360a64d NEW 533d15b5ce NEW 58c343a8d8 NEW |
none[none] c67adf46e2[0] none [0] |
none:none ASM:Graph none:none |
none|none tElock| Armadillo| |
none lines=126 embedded dns lines=91 |
none trace trace |
| T:12:38:00 | Win2K-f | 95.25.186.1 (CORBINA.NET): INVESTELEKTROSVIAZ LTD, MOSCOW, MOSCOW CITY, RU. (DSL) |
n/a | JP:g105.secure.ne.jp JP:newsletter.gov-online.go.jp 174.123.60.178:443 191.132.154.190:443 BR:201.20.45.207:443 JP:202.164.228.11:443 JP:202.214.40.79:443 JP:203.79.51.228:443 US:207.44.220.4:443 UA:62.149.23.110:443 US:64.131.68.169:443 |
445 | pcap | raw alerts ruleset |
other 25 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:12:49:00 | Win2K-f | 116.83.73.171 (INFOWEB.NE.JP): INFOWEB(FUJITSU LTD.), TOKYO, TOKYO, JP. (DSL) |
60.190.222.139:65520 | CN:ad.lometr.pl :www.imagemfolheados.com.br CA:weather.co.ua JP:www.kajima.co.jp DE:www.miltenyibiotec.co.jp JP:newsletter.gov-online.go.jp UA:www.epravda.com.ua UA:spooky.cartoons.org.ua EU:wow.merlin.org.ua US:mst.com.ua 115.125.150.227:443 174.123.60.178:443 UA:195.214.214.53:443 BR:201.20.45.207:443 JP:202.214.40.79:443 JP:202.218.170.179:443 US:207.44.220.4:443 UA:212.82.216.42:443 US:69.61.11.226:443 UA:77.120.104.50:443 EU:79.171.122.236:443 UA:82.193.122.190:443 EU:91.203.146.30:443 |
445 | pcap | raw alerts ruleset |
irc http 20 lines |
Yeah : 1.3 profile |
none | summary tarball |
36 of 41 | f0a4409bf8 NEW |
none[none] | none:none |
none|none | none | none |
| T:13:26:00 | Win2K-f | 110.15.240.111 (-): HANARO TELECOM, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
60.190.222.139:65520 | US:microsoft.com CN:proxim.ircgalaxy.pl CN:ad.lometr.pl BR:loja.tray.com.br JP:bookweb.kinokuniya.co.jp :apply.reedexpo.co.jp BR:www.imusica.com.br JP:www.okilogistics.co.jp :www.imagemfolheados.com.br UA:www.indev.kiev.ua BR:www.sextoy.com.br JP:m-repo.lib.meiji.ac.jp US:www.pirateparty.in.ua JP:133.26.200.10:443 174.123.60.178:443 BR:201.20.45.207:443 JP:202.226.91.62:443 US:69.57.128.35:443 US:69.61.11.226:443 UA:77.120.104.50:443 UA:77.120.110.76:443 EU:91.196.95.24:443 |
135 | pcap | raw alerts ruleset |
irc http 137 lines |
Yeah : 1.8 profile |
none | summary tarball |
29 of 32 28 of 32 36 of 41 |
8a75955033 NEW 9276c8b36b NEW f0a4409bf8 NEW |
2bf3e548b9 [0] none [0] none [none] |
ASM:Graph none:none none:none |
tElock| Armadillo| none|none |
lines=126 embedded dns lines=90 none |
trace trace none |
| T:13:30:00 | Win2K-f | 210.117.52.225 (KRLINE.NET): KRNIC, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
60.190.222.139:65520 | CN:proxima.ircgalaxy.pl US:microsoft.com CN:ad.lometr.pl UA:bunker.org.ua DE:www.miltenyibiotec.co.jp BR:www.imusica.com.br :nodes.com.ua JP:ss1.coressl.jp UA:global-host.com.ua JP:ex2.broadserver.jp JP:www.marantz.jp CN:ku1.installstorm.com BR:www.billboxrecords.com.br :la2.meganet.org.ua :www.imagemfolheados.com.br BR:www.sextoy.com.br JP:center.umin.ac.jp BR:loja.tray.com.br JP:www.aandd.jp UA:isu2.tup.km.ua BR:ssl876.locaweb.com.br UA:spooky.cartoons.org.ua US:www.pirateparty.in.ua 115.125.150.227:443 JP:130.69.92.68:443 UA:195.214.214.53:443 BR:200.192.143.87:443 JP:202.218.170.179:443 US:69.61.11.226:443 UA:77.120.110.76:443 EU:79.171.122.236:443 95.169.190.41:443 |
135 | pcap | raw alerts ruleset |
irc http 148 lines |
Yeah : 1.8 profile |
none | summary tarball |
36 of 41 40 of 41 39 of 41 |
138360a64d NEW 1824c59f34 NEW caaeb70f9f NEW |
none[none] da8a48fc3a[0] fdabb272e7[0] |
none:none ASM:Graph ASM:Graph |
none|none tElock| Armadillo| |
none lines=112 embedded dns lines=91 |
none trace trace |
| T:13:44:00 | Win2K-f | 188.80.244.201 (WSSIC-B3-110-9.TELEPAC.PT): PT COMUNICACOES S.A, PT. (DSL) |
60.190.222.139:65520 | US:www.iknow.co.jp CN:proxima.ircgalaxy.pl CN:ad.lometr.pl JP:g105.secure.ne.jp JP:www.irtvnet.jp RU:www.treasuryislandcasino.com.ua US:www.pirateparty.in.ua JP:m-repo.lib.meiji.ac.jp JP:www.jaif.or.jp US:www.365.e-secom.jp DE:www.miltenyibiotec.co.jp JP:www.jica.go.jp JP:cg.ces.kyutech.ac.jp 115.125.150.227:443 JP:202.164.228.11:443 US:69.57.128.35:443 US:69.61.11.226:443 UA:77.120.104.50:443 UA:77.120.110.76:443 UA:77.120.121.35:443 EU:79.171.122.236:443 UA:82.193.122.190:443 RU:87.239.184.105:443 |
445 | pcap | raw alerts ruleset |
irc http 30 lines |
Yeah : 1.3 profile |
none | summary tarball |
36 of 41 | f0a4409bf8 NEW |
none[none] | none:none |
none|none | none | none |
| T:14:08:00 | Win2K-f | 99.50.229.91 (PACBELL.NET): AT&T INTERNET SERVICES, AUSTIN, TEXAS, US. (DSL) |
n/a | US:forums.ubuntulinux.jp JP:newsletter.gov-online.go.jp PL:ssl.aukro.ua :www.mlh.co.jp JP:www.irtvnet.jp UA:www.epravda.com.ua :cps-h3.ep.sci.hokudai.ac.jp 115.125.150.234:443 UA:195.214.214.53:443 PR:200.5.0.0:443 JP:202.164.228.11:443 JP:202.226.91.62:443 JP:203.79.51.238:443 JP:211.133.134.87:443 UA:212.111.198.59:443 US:69.72.149.166:443 UA:77.120.110.76:443 UA:77.120.121.35:443 |
445 | pcap | raw alerts ruleset |
other 24 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| 14:44:00 | Win2K-f | 149.75.199.175 (TRILOGYBEHC.ORG): TRILOGY INC, AUSTIN, TEXAS, US. (DSL) |
n/a | US:www.maxmind.com US:www.getmyip.org EU:getmyip.co.uk :checkip.dyndns.org DE:131.220.6.26:80 208.78.70.70:80 US:75.126.138.202:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 4 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:15:39:00 | Win2K-f | 173.24.242.74 (MCHSI.COM): MEDIACOM COMMUNICATIONS CORP, HUNTSVILLE, ALABAMA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 40 38 of 40 |
474acf88e5 NEW 68f0c14692 NEW |
1f53944b24 [0] ccc1b24d53[0] |
ASM:Graph ASM:Graph |
tElock| Armadillo| |
lines=64 embedded dns lines=91 |
trace trace |
| T:16:06:00 | Win2K-f | 4.232.0.157 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, FULLERTON, CALIFORNIA, US. (DIAL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 99 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:16:11:00 | WinXP | 72.184.109.116 (RR.COM): ROAD RUNNER HOLDCO LLC, TAMPA, FLORIDA, US. (DSL) |
n/a | :moscow-advokat.ru | 445 | pcap | raw alerts ruleset |
other 0 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | 042774a2b7 NEW |
none[0] | none:none |
PolyEnE| | lines=69 embedded dns |
trace |
| T:17:00:00 | WinXP | 4.244.33.205 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, IMPERIAL, MISSOURI, US. (DIAL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 148 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 8 of 33 |
53bfe15e91 NEW b7082104e4 NEW |
1473091351 [0] c5b49e7b82[0] |
ASM:Graph ASM:Graph |
tElock| tElock| |
lines=75 embedded dns lines=41 |
trace trace |
| T:17:38:00 | Win2K-f | 202.127.113.2 (-): BEIJING CJWX COMMUNICATION TECHNOLOGY LTD CO, BEIJING, BEIJING, CN. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 18 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:18:09:00 | WinXP | 208.103.155.51 (CORETEL.NET): CORETEL AMERICA INC, MYERSTOWN, PENNSYLVANIA, US. (DIAL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
41 of 41 | 72134e4b44 NEW |
28c60e99a7 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:18:51:00 | WinXP | 113.152.69.135 (DION.NE.JP): UQ COMMUNICATIONS INC, TOKYO, TOKYO, JP. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 | 8015c2d45f NEW |
749cbc2739 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:19:55:00 | Win2K-f | 152.48.222.69 (UNC.EDU): NORTH CAROLINA RESEARCH AND EDUCATION NETWORK, DURHAM, NORTH CAROLINA, US. (100Mbps) |
n/a | US:microsoft.com DE:irc.zief.pl CN:ad.lometr.pl UA:bunker.org.ua BR:loja.tray.com.br JP:www.irtvnet.jp :www.imagemfolheados.com.br JP:v.rentalserver.jp JP:www.nrw.co.jp EU:accounts.comodo.od.ua BR:www.digimer.com.br UA:195.214.214.53:443 BR:200.192.143.87:443 BR:201.20.35.20:443 BR:201.20.45.207:443 JP:202.214.40.87:443 JP:202.218.111.122:443 JP:203.79.51.238:443 US:69.61.11.226:443 UA:77.120.110.76:443 UA:77.120.121.35:443 EU:91.196.95.24:443 |
135 | pcap | raw alerts ruleset |
http 223 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 40 36 of 41 36 of 40 |
09e6d1f4c7 NEW 138360a64d NEW b0a98823d1 NEW |
none[none] none [none] none [none] |
none:none none:none none:none |
none|none none|none none|none |
none none none |
none none none |
| T:20:04:00 | Win2K-f | 118.101.53.164 (TM.NET.MY): TELEKOM MALAYSIA BERHAD, SHAH ALAM, SELANGOR, MY. (DSL) |
n/a | BR:loja.tray.com.br BR:ssl876.locaweb.com.br JP:g105.secure.ne.jp JP:cg.ces.kyutech.ac.jp US:microsoft.com DE:irc.zief.pl CN:ad.lometr.pl JP:131.113.221.138:443 JP:131.206.55.11:443 UA:195.214.214.53:443 BR:201.20.35.20:443 BR:201.20.45.207:443 JP:202.164.228.11:443 US:207.44.220.4:443 JP:210.171.131.16:443 UA:212.111.198.59:443 US:69.57.128.35:443 US:69.61.11.226:443 EU:79.171.122.236:443 |
445 | pcap | raw alerts ruleset |
http 26 lines |
Yeah : 0.8 profile |
none | summary tarball |
36 of 41 | 138360a64d NEW |
none[none] | none:none |
none|none | none | none |
| T:20:49:00 | WinXP | 186.141.195.103 (-): . |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| 21:21:00 | Win2K-f | 189.106.59.184 (VELOXZONE.COM.BR): COMITE GESTOR DA INTERNET NO BRASIL, NITERóI, RIO DE JANEIRO, BR. (DSL) |
n/a | US:www.maxmind.com EU:getmyip.co.uk GB:www.vouchercodez.com US:www.getmyip.org :checkip.dyndns.org DE:131.220.6.26:80 208.78.70.70:80 US:67.15.94.80:80 US:75.126.138.202:80 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
7 of 37 | 7587773eea NEW |
none[3] | none:none |
StarForce| | none | trace |
| T:22:12:00 | Win2K-f | 220.229.211.147 (SPARQNET.NET): NEW CENTRY INFOCOM TECH. CO. LTD, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 18 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:22:36:00 | WinXP | 174.7.74.114 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, VANCOUVER, BRITISH COLUMBIA, CA. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:23:11:00 | WinXP | 68.146.75.67 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, CALGARY, ALBERTA, CA. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 41 38 of 41 |
270559591a NEW b3ae886db6 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:23:46:00 | WinXP | 24.213.224.238 (RR.COM): ROAD RUNNER HOLDCO LLC, AMSTERDAM, NOORD-HOLLAND, NL. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |