Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
T:00:26:00 | Win2K-f | 66.219.12.78 (GVTEL.COM): GARDEN VALLEY TELEPHONE COMPANY, ERSKINE, MINNESOTA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 4 lines |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
T:02:05:00 | WinXP | 65.25.74.185 (RR.COM): ROAD RUNNER HOLDCO LLC, CANTON, OHIO, US. (100Mbps) |
n/a | 135 | pcap | raw alerts ruleset |
other 11 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
T:03:11:00 | Win2K-f | 110.8.46.149 (-): HANARO TELECOM, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 116 lines |
Yeah : 1.3 profile |
none | summary tarball |
none 0 of 32 |
a0a883bef1 NEW d41d8cd98f NEW |
none[none] none [3] |
none:none ASM:Graph |
none|none none|none |
none lines=0 |
none trace |
T:04:05:00 | Win2K-f | 173.27.197.92 (MCHSI.COM): MEDIACOM COMMUNICATIONS CORP, DAVENPORT, IOWA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 18 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
T:05:00:00 | WinXP | 122.100.91.86 (UBBN.NET): UNION BROADBAND NETWORK, TAIPEI, T'AI-PEI, TW. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
T:05:03:00 | Win2K-f | 174.111.57.246 (-): . |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
2 of 36 0 of 32 |
af1ff397ee NEW d41d8cd98f NEW |
none[none] none [3] |
none:none ASM:Graph |
none|none none|none |
none lines=0 |
none trace |
T:05:13:00 | WinXP | 114.72.170.152 (OPTUSNET.COM.AU): OPTUS INTERNET - RETAIL, BRISBANE, QUEENSLAND, AU. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 59 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 | d41d8cd98f NEW |
none[3] | ASM:Graph |
none|none | lines=0 | trace |
T:06:10:00 | WinXP | 118.7.11.59 (OCN.NE.JP): OPEN COMPUTER NETWORK, JP. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 15 lines |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
T:06:16:00 | Win2K-f | 220.216.35.77 (TNC.NE.JP): TOKAI CORPORATION, TOKYO, TOKYO, JP. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 10 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
T:07:31:00 | WinXP | 70.60.198.57 (RR.COM): ROAD RUNNER HOLDCO LLC, MONROE, NORTH CAROLINA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 | d41d8cd98f NEW |
none[3] | ASM:Graph |
none|none | lines=0 | trace |
T:07:57:00 | WinXP | 70.184.154.68 (COX.NET): COX COMMUNICATIONS, YUKON, OKLAHOMA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 89 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 | d41d8cd98f NEW |
none[3] | ASM:Graph |
none|none | lines=0 | trace |
T:08:50:00 | Win2K-f | 211.207.194.165 (FRONTIEROIL.NET): HANARO TELECOM INC, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
83.133.119.206:65520 | LV:proxima.ircgalaxy.pl US:microsoft.com LV:ad.ghura.pl DE:83.133.119.206:65520 |
135 | pcap | raw alerts ruleset |
irc http 165 lines |
Yeah : 1.8 profile |
none | summary tarball |
0 of 32 | d41d8cd98f NEW |
none[3] | ASM:Graph |
none|none | lines=0 | trace |
T:10:12:00 | WinXP | 71.67.108.40 (RR.COM): ROAD RUNNER HOLDCO LLC, CINCINNATI, OHIO, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 | d41d8cd98f NEW |
none[3] | ASM:Graph |
none|none | lines=0 | trace |
T:11:13:00 | Win2K-f | 70.62.88.176 (RR.COM): ROAD RUNNER HOLDCO LLC, CONCORD, NORTH CAROLINA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
2 of 36 0 of 32 |
af1ff397ee NEW d41d8cd98f NEW |
none[none] none [3] |
none:none ASM:Graph |
none|none none|none |
none lines=0 |
none trace |
T:12:09:00 | Win2K-f | 70.168.130.230 (COX.NET): COX COMMUNICATIONS, SPRINGFIELD, VIRGINIA, US. (DSL) |
60.190.222.139:65520 | US:microsoft.com DE:proxim.ircgalaxy.pl |
135 | pcap | raw alerts ruleset |
irc 142 lines |
Yeah : 1.8 profile |
none | summary tarball |
0 of 32 | d41d8cd98f NEW |
none[3] | ASM:Graph |
none|none | lines=0 | trace |
T:12:16:00 | WinXP | 98.173.216.77 (COX.NET): COX COMMUNICATIONS, SANTA BARBARA, CALIFORNIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
2 of 36 0 of 32 |
af1ff397ee NEW d41d8cd98f NEW |
none[none] none [3] |
none:none ASM:Graph |
none|none none|none |
none lines=0 |
none trace |
T:12:35:00 | WinXP | 119.234.128.216 (-): SINGTEL MOBILE, SINGAPORE, SINGAPORE, SG. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none |
T:12:36:00 | Win2K-f | 87.116.197.231 (TNP.PL): NETWORK OF INTERNET SERVICE PROVIDER, WARSAW, WARSZAWA, PL. (DSL) |
83.133.119.206:65520 | DE:proxim.ircgalaxy.pl LV:ad.ghura.pl US:microsoft.com DE:83.133.119.206:65520 |
445 | pcap | raw alerts ruleset |
irc http 27 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
T:14:03:00 | Win2K-f | 216.211.247.60 (NORWOODLIGHT.COM): NORWOOD LIGHT BROADBAND, NEW YORK, NEW YORK, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
5 of 41 0 of 32 |
7254c517c8 NEW d41d8cd98f NEW |
none[none] none [3] |
none:none ASM:Graph |
none|none none|none |
none lines=0 |
none trace |
T:14:07:00 | WinXP | 79.163.235.14 (CENTERTEL.PL): PTK CENTERTEL BROADBAND SERVICES, PL. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
T:14:30:00 | WinXP | 70.66.140.239 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, QUALICUM BEACH, BRITISH COLUMBIA, CA. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 | d41d8cd98f NEW |
none[3] | ASM:Graph |
none|none | lines=0 | trace |
T:15:09:00 | WinXP | 72.184.225.130 (RR.COM): ROAD RUNNER HOLDCO LLC, AUBURNDALE, FLORIDA, US. (DSL) |
n/a | US:gg.arrancar.org US:69.43.160.145:555 |
135 | pcap | raw alerts ruleset |
other 186 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 | d41d8cd98f NEW |
none[3] | ASM:Graph |
none|none | lines=0 | trace |
15:27:00 | Win2K-f | 61.224.99.168 (HINET.NET): CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:www.maxmind.com EU:getmyip.co.uk US:www.getmyip.org :checkip.dyndns.org DE:131.220.6.26:80 US:75.126.138.202:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none |
T:18:54:00 | WinXP | 70.169.52.29 (COX.NET): COX COMMUNICATIONS, TULSA, OKLAHOMA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 1008 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 | d41d8cd98f NEW |
none[3] | ASM:Graph |
none|none | lines=0 | trace | |
T:18:56:00 | Win2K-f | 69.134.46.167 (RR.COM): ROAD RUNNER HOLDCO LLC, DUDLEY, NORTH CAROLINA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 112 lines |
Yeah : 1.3 profile |
none | summary tarball |
5 of 41 0 of 32 |
afe6f31650 NEW d41d8cd98f NEW |
none[none] none [3] |
none:none ASM:Graph |
none|none none|none |
none lines=0 |
none trace |
T:19:31:00 | Win2K-f | 70.183.7.117 (COX.NET): COX COMMUNICATIONS, VIENNA, VIRGINIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 78 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 | d41d8cd98f NEW |
none[3] | ASM:Graph |
none|none | lines=0 | trace |
T:20:22:00 | WinXP | 118.83.26.12 (HTOJ.J-CNET.JP): JCN-HTMNET, TOKYO, TOKYO, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 122 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 | d41d8cd98f NEW |
none[3] | ASM:Graph |
none|none | lines=0 | trace |
T:22:51:00 | Win2K-f | 220.229.85.92 (SPARQNET.NET): NEW CENTRY INFOCOM TECH. CO. LTD, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 118 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 5 of 41 |
d41d8cd98f NEW f0bf2b87bb NEW |
none[3] none [none] |
ASM:Graph none:none |
none|none none|none |
lines=0 none |
trace none |