|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| 01:07:00 | WinXP | 112.203.71.247 (PLDT.NET): IPG, PH. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
39 of 41 | b9742fc32f NEW |
none[none] | none:none |
none|none | none | none |
| T:04:36:00 | Win2K-f | 72.187.106.67 (RR.COM): ROAD RUNNER HOLDCO LLC, NEW PORT RICHEY, FLORIDA, US. (100Mbps) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 115 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 40 37 of 39 |
1da4193446 NEW 6278c9374a NEW |
8a97c8536a [none] cc7aaf6ea9[none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:05:50:00 | WinXP | 120.138.157.31 (STARCAT.NE.JP): KMN CORPORATION, TOKYO, TOKYO, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 40 of 41 |
6a1dc43309 NEW 94e49d5627 NEW |
522dace6c1 [0] 777259292a[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=91 lines=64 embedded dns |
trace trace |
| T:06:07:00 | Win2K-f | 175.115.199.233 (-): . |
83.133.119.206:65520 | CN:proxim.ircgalaxy.pl US:microsoft.com LV:ad.ghura.pl CN:ku.perfectexe.com CN:mm.perfectexe.com US:sendinvest.com :findhobbits.com CN:pic.iwillhavesexygirls.com :www.infostockcotv.info CN:sky.perfectexe.com :in.7cy.net CN:122.224.4.121:250 US:64.120.176.66:8392 US:64.191.44.8:8392 |
135 | pcap | raw alerts ruleset |
irc http 155 lines |
Yeah : 1.8 profile |
none | summary tarball |
18 of 40 30 of 33 28 of 33 none 22 of 41 17 of 41 25 of 41 28 of 41 13 of 41 |
4feab58b34 NEW 533d15b5ce NEW 58c343a8d8 NEW aed98f9f95 NEW b6ce2450e0 NEW bc46417a2c NEW c19d441417 NEW c88f1a3028 NEW ceb9fe30e6 NEW |
none[none] c67adf46e2[0] none [0] none [none] none [none] none [none] none [none] none [none] none [none] |
none:none ASM:Graph none:none none:none none:none none:none none:none none:none none:none |
none|none tElock| Armadillo| none|none none|none none|none none|none none|none none|none |
none lines=126 embedded dns lines=91 none none none none none none |
none trace trace none none none none none none |
| T:06:09:00 | WinXP | 79.163.201.210 (CENTERTEL.PL): PTK CENTERTEL BROADBAND SERVICES, PL. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
41 of 41 | 5c6df5141d NEW |
none[none] | none:none |
none|none | none | none |
| T:06:25:00 | Win2K-f | 121.54.32.135 (SMARTBRO.NET): SMART BROADBAND INCORPORATED, MANILA, MANILA, PH. (DSL) |
n/a | :in1.7cy.net :www.romemarket.com 74.220.220.81:80 |
135 | pcap | raw alerts ruleset |
http irc 116 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:06:33:00 | Win2K-f | 61.62.75.155 (SO-NET.NET.TW): SONY NETWORK TAIWAN LIMITED, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | :www.jipewrvdsaf.com :www.ipewrvdaf.com :mongabya.com :ad.yieldmanager.com US:content.yieldmanager.com :cookex.amp.yahoo.com US:130.107.145.203:8773 US:204.2.136.88:80 74.54.152.15:80 |
445 | pcap | raw alerts ruleset |
irc http 43 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:06:41:00 | Win2K-f | 114.168.91.41 (OCN.NE.JP): OPEN COMPUTER NETWORK, JP. (DSL) |
83.133.119.206:65520 | :pinfan.net CN:mm.perfectexe.com CN:pic.iwillhavesexygirls.com :www.infostockcotv.info CN:sky.perfectexe.com CN:proxim.ircgalaxy.pl LV:ad.ghura.pl CN:ku.perfectexe.com US:microsoft.com |
135 | pcap | raw alerts ruleset |
http irc 45 lines |
Yeah : 1.3 profile |
none | summary tarball |
8 of 41 none 22 of 41 25 of 41 28 of 41 13 of 41 |
2cb2e4374e NEW aed98f9f95 NEW b6ce2450e0 NEW c19d441417 NEW c88f1a3028 NEW ceb9fe30e6 NEW |
none[none] none [none] none [none] none [none] none [none] none [none] |
none:none none:none none:none none:none none:none none:none |
none|none none|none none|none none|none none|none none|none |
none none none none none none |
none none none none none none |
| 07:48:00 | Win2K-f | 217.110.204.11 (-): DE-COLT-1100-59452891-BBDBGH, DE. (DSL) |
n/a | US:www.maxmind.com US:www.getmyip.org :checkip.dyndns.org EU:getmyip.co.uk 208.78.70.70:80 US:67.15.94.80:80 US:75.126.138.202:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:07:56:00 | Win2K-f | 217.110.204.11 (-): DE-COLT-1100-59452891-BBDBGH, DE. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org DE:131.220.6.26:80 US:67.15.94.80:80 |
445 | pcap | raw alerts ruleset |
http 3 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:08:11:00 | WinXP | 95.59.8.212 (DIAL.ONLINE.KZ): JSC KAZAKHTELECOM WEST KAZAKHSTAN AFFILIATE, KZ. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
34 of 34 | d20f157117 NEW |
738f555183 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:08:19:00 | WinXP | 193.248.139.233 (ABO.WANADOO.FR): NSLIL206 LILLE, LILLE, NORD-PAS-DE-CALAIS, FR. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 14 lines |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | 1a2c0e6130 NEW |
none[0] | none:none |
none|none | lines=60 | trace | |
| T:08:45:00 | WinXP | 175.119.62.46 (-): . |
60.190.222.139:65520 | CN:proxim.ircgalaxy.pl US:microsoft.com LV:ad.ghura.pl CN:ku.perfectexe.com CN:mm.perfectexe.com US:sendinvest.com :findhobbits.com CN:pic.iwillhavesexygirls.com CN:122.224.4.121:250 CN:60.190.222.139:65520 US:64.120.176.66:8392 US:64.191.44.8:8392 64.79.86.26:8392 |
135 | pcap | raw alerts ruleset |
irc http 242 lines |
Yeah : 1.8 profile |
none | summary tarball |
40 of 41 none 25 of 41 28 of 41 13 of 41 none |
41a34e5d13 NEW bddbe59f19 NEW c19d441417 NEW c88f1a3028 NEW ceb9fe30e6 NEW f74cbbe1cc NEW |
none[none] none [none] none [none] none [none] none [none] none [none] |
none:none none:none none:none none:none none:none none:none |
none|none none|none none|none none|none none|none none|none |
none none none none none none |
none none none none none none |
| T:10:12:00 | Win2K-f | 24.76.5.147 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, SELKIRK, MANITOBA, CA. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 42 39 of 42 |
a1fac31325 NEW c018e17b5b NEW |
0fd057b5e2 [0] 8caee80d88[0] |
none:none none:none |
Armadillo| StarForce| |
none none |
trace trace |
| T:10:42:00 | WinXP | 69.193.68.209 (RR.COM): ROAD RUNNER HOLDCO LLC, HERNDON, VIRGINIA, US. (DSL) |
62.193.249.122:3305 | KR:cx10man.weedns.com | 135 | pcap | raw alerts ruleset |
irc 695 lines |
Yeah : 1.8 profile |
none | summary tarball |
38 of 41 | ecfbf321d3 NEW |
none[none] | none:none |
none|none | none | none |
| T:10:47:00 | WinXP | 60.248.162.75 (HINET.NET): CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 39 35 of 38 |
2205443cc8 NEW b9297745a1 NEW |
04ce1ed773 [none] 4294884d84[0] |
none:none ASM:Graph |
none|none tElock| |
none lines=64 embedded dns |
none trace |
| T:11:01:00 | Win2K-f | 70.183.2.6 (COX.NET): COX COMMUNICATIONS, FAIRFAX, VIRGINIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:11:32:00 | Win2K-f | 110.11.176.95 (-): HANARO TELECOM, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 113 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 5 of 41 |
14f47ffd1e NEW 50437008d9 NEW |
90bf4b99ff [0] c1b09ac5d7[0] |
ASM:Graph ASM:Graph |
tElock| Armadillo| |
lines=56 embedded dns lines=90 |
trace trace |
| T:11:43:00 | WinXP | 93.113.176.74 (-): SC GLOBAL CITY NET SRL, BUCHAREST, BUCURESTI, RO. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
40 of 41 | 393e318752 NEW |
none[none] | none:none |
none|none | none | none |
| T:12:24:00 | WinXP | 188.195.188.221 (SUPERKABEL.DE): KABEL DEUTSCHLAND BREITBAND SERVICE GMBH, DE. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 13 lines |
Yeah : 0.8 profile |
none | summary tarball |
42 of 42 | c46f4552da NEW |
ce6ff736cf [0] | none:none |
none|none | none | trace | |
| T:12:35:00 | WinXP | 122.146.80.161 (SPARQNET.NET): NEW CENTRY INFOCOM TECH. CO. LTD, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:13:32:00 | Win2K-f | 219.112.185.33 (THN.NE.JP): TOKAI CORPORATION, SHIZUOKA, SHIZUOKA, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 39 of 41 |
5799ab6538 NEW f38e8d97da NEW |
2713679411 [0] 83f1400243[0] |
ASM:Graph ASM:Graph |
tElock| Armadillo| |
lines=64 embedded dns lines=91 |
trace trace |
| T:14:31:00 | WinXP | 95.236.36.50 (BUSINESS.TELECOMITALIA.IT): TELECOM ITALIA WIRELINE SERVICES, ROME, LAZIO, IT. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 14 lines |
Yeah : 1.3 profile |
none | summary tarball |
29 of 29 | 831f4ee0a7 NEW |
none[0] | none:none |
none|none | lines=60 | trace | |
| T:16:57:00 | WinXP | 66.50.4.68 (PRTC.NET): PRTC RAS, SAN JUAN, PUERTO RICO, PR. (DSL) |
n/a | CN:proxim.ircgalaxy.pl DE:citi-bank.ru DE:213.155.0.224:80 DE:83.133.119.206:65520 |
445 | pcap | raw alerts ruleset |
http irc 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
38 of 41 | 5d26f533fd NEW |
none[none] | none:none |
none|none | none | none |
| T:17:00:00 | WinXP | 70.184.145.120 (COX.NET): COX COMMUNICATIONS, OCALA, FLORIDA, US. (DSL) |
83.133.119.206:65520 | CN:proxim.ircgalaxy.pl US:microsoft.com LV:ad.ghura.pl CN:ku.perfectexe.com CN:mm.perfectexe.com US:sendinvest.com :findhobbits.com CN:pic.iwillhavesexygirls.com :www.infostockcotv.info US:64.191.44.8:8392 |
135 | pcap | raw alerts ruleset |
irc http 143 lines |
Yeah : 1.8 profile |
none | summary tarball |
0 of 41 26 of 41 32 of 33 29 of 33 17 of 41 25 of 41 28 of 41 13 of 41 none |
0723522d18 NEW 1e8d2d2ded NEW 87e1117f2a NEW b4fe4581c3 NEW bc46417a2c NEW c19d441417 NEW c88f1a3028 NEW ceb9fe30e6 NEW f74cbbe1cc NEW |
none[none] none [none] 3ff643aae6[0] 599b835896[0] none [none] none [none] none [none] none [none] none [none] |
none:none none:none ASM:Graph ASM:Graph none:none none:none none:none none:none none:none |
none|none none|none tElock| Armadillo| none|none none|none none|none none|none none|none |
none none lines=125 embedded dns lines=91 none none none none none |
none none trace trace none none none none none |
| 17:51:00 | Win2K-f | 190.55.240.226 (200.IN-ADDR.ARPA): TELECENTRO S.A. - CLIENTES RESIDENCIALES, BUENOS AIRES, BUENOS AIRES, AR. (DSL) |
n/a | US:www.maxmind.com US:www.getmyip.org EU:getmyip.co.uk :checkip.dyndns.org 208.78.70.70:80 US:67.15.94.80:80 US:75.126.138.202:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | dc331fb791 NEW |
none[3] | none:none |
UPX| | none | trace |
| T:17:56:00 | Win2K-f | 99.145.136.31 (SBCGLOBAL.NET): AT&T INTERNET SERVICES, HOUSTON, TEXAS, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 59 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 8 of 33 |
53bfe15e91 NEW b7082104e4 NEW |
1473091351 [0] c5b49e7b82[0] |
ASM:Graph ASM:Graph |
tElock| tElock| |
lines=75 embedded dns lines=41 |
trace trace |
| T:19:20:00 | WinXP | 186.24.109.86 (TELCEL.NET.VE): TELCEL C.A, VE. (DSL) |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
29 of 29 | a0139d7ad8 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| 19:22:00 | WinXP | 4.156.81.49 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, BOSTON, MASSACHUSETTS, US. (DSL) |
n/a | :moscow-advokat.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
25 of 25 | 7f60162c2c NEW |
none[0] | none:none |
PolyEnE| | lines=93 embedded dns |
trace |
| T:21:00:00 | Win2K-f | 70.64.15.9 (GASOC.COM): SHAW COMMUNICATIONS INC, SASKATOON, SASKATCHEWAN, CA. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 18 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:21:00:00 | Win2K-f | 194.19.234.252 (-): BTG, RIGA, RIGA, LV. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:23:08:00 | WinXP | 79.163.251.157 (CENTERTEL.PL): PTK CENTERTEL BROADBAND SERVICES, KATOWICE, SLASKIE, PL. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
41 of 41 | 5c6df5141d NEW |
none[none] | none:none |
none|none | none | none |