Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

03 September 2010
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:20:00 Win2K-f 219.251.116.214 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 83.133.119.206:65520 US:microsoft.com
CN:proxima.ircgalaxy.pl
LV:ad.ghura.pl
JP:www.myeclipseide.jp
UA:isu2.tup.km.ua
JP:cg.ces.kyutech.ac.jp
US:www.365.e-secom.jp
PL:ssl.aukro.ua
JP:www.nrw.co.jp
BR:www.billboxrecords.com.br
US:www.stone.co.ua
JP:www.marantz.jp
JP:www.aandd.jp
UA:spooky.cartoons.org.ua
US:mst.com.ua
JP:www.jica.go.jp
:www.imagemfolheados.com.br
UA:hosting.cnrg.com.ua
:www.mlh.co.jp
EU:wow.merlin.org.ua
:itmedia.smartseminar.jp
JP:ssl.form-mailer.jp
:secure.fox
GB:forum.gryada.org.ua
JP:ir.kagoshima-u.ac.jp
LV:kdert.com
JP:www.science-forum.co.jp
BR:loja.tray.com.br
JP:center.umin.ac.jp
JP:131.206.55.11:443
UA:193.178.147.110:443
JP:202.214.40.79:443
JP:202.218.111.122:443
US:67.15.97.220:443
US:68.232.187.4:443
US:69.57.128.35:443
UA:77.120.121.35:443
UA:82.193.122.190:443 135 pcap raw alerts
ruleset irc
http
137 lines Yeah : 1.8
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:00:31:00 WinXP 121.120.32.128 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:00:41:00 Win2K-f 67.87.54.35 (OPTONLINE.NET):
OPTIMUM ONLINE (CABLEVISION SYSTEMS),
BRIDGEPORT, CONNECTICUT, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:00:48:00 Win2K-f 98.92.106.205 (BELLSOUTH.NET):
BELLSOUTH.NET INC,
ATLANTA, GEORGIA, US. (DSL) n/a :cps-h3.ep.sci.hokudai.ac.jp
BR:loja.tray.com.br
:www.pirateparty.in.ua
:www.inde
JP:ssl.form-mailer.jp
JP:130.69.92.68:443
191.132.154.190:443
PR:200.5.0.0:443
JP:210.171.131.16:443
UA:212.82.216.42:443
JP:219.99.163.45:443
JP:222.146.58.38:443
UA:77.120.121.35:443 445 pcap raw alerts
ruleset irc
24 lines Argh : 0.3
profile none summary
tarball none none none none none none none

T:00:49:00 WinXP 60.250.199.56 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a 135 pcap raw alerts
ruleset other
10 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:01:25:00 Win2K-f 119.234.172.152 (-):
SINGTEL MOBILE,
SINGAPORE, SINGAPORE, SG. (DSL) n/a US:mst.com.ua
UA:weather.co.ua
BR:loja.tray.com.br
JP:center.umin.ac.jp
JP:130.69.92.68:443
JP:133.87.45.189:443
JP:163.209.180.1:443
UA:193.178.147.110:443
BR:200.143.10.165:443
BR:201.20.45.207:443
US:207.44.220.4:443
UA:212.82.216.42:443
JP:219.99.163.41:443
US:66.96.213.5:443
UA:77.120.104.50:443
UA:77.120.121.35:443
EU:91.196.95.24:443 445 pcap raw alerts
ruleset other
19 lines Argh : 0.3
profile none summary
tarball none none none none none none none

T:01:38:00 Win2K-f 113.255.154.150 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HK. (DSL) n/a 135 pcap raw alerts
ruleset other
1002 lines Yeah : 1.3
profile none summary
tarball none 1c88df4d4a
NEW none[none] none:none
none|none none none

T:01:43:00 WinXP 178.92.212.235 (FINEBLANK.COM):
EU-ZZ,
UK. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:02:59:00 WinXP 121.121.193.140 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:03:04:00 WinXP 75.58.126.247 (SBCGLOBAL.NET):
AT&T INTERNET SERVICES,
NAUGATUCK, CONNECTICUT, US. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:03:11:00 Win2K-f 173.170.223.26 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:04:00:00 WinXP 174.5.74.122 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:04:24:00 WinXP 112.197.73.13 (-):
SAIGON TOURIST CABLE TELEVISION,
VN. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:05:07:00 WinXP 193.93.110.216 (GRAT.NET.UA):
GRAT NETWORK INTERNET SERVICE PROVIDER,
KIEV, KYYIV, UA. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:06:06:00 WinXP 115.81.13.149 (TAIWANMOBILE.NET):
TAIWAN MOBILE CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:06:39:00 WinXP 121.120.209.71 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:07:03:00 Win2K-f 70.168.133.197 (COX.NET):
COX COMMUNICATIONS,
FAIRFAX, VIRGINIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 2 of 36
0 of 32 ca832de942
NEW
d41d8cd98f
NEW none[3]
none [3] none:none
ASM:Graph
none|none
none|none none
lines=0 trace
trace

T:07:07:00 WinXP 61.62.63.98 (SO-NET.NET.TW):
SONY NETWORK TAIWAN LIMITED,
TAIPEI, T'AI-PEI, TW. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:09:28:00 Win2K-f 175.124.153.185 (-):
. n/a DE:proxim.ircgalaxy.pl
US:microsoft.com
DE:83.133.119.206:65520 135 pcap raw alerts
ruleset other
114 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:09:42:00 WinXP 84.224.31.104 (PGSM.HU):
PANNON GSM TELECOMMUNICATIONS INC,
BUDAPEST, BUDAPEST, HU. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:09:49:00 Win2K-f 61.218.191.251 (-):
LIAN HONG BUSINESS CO. LTD,
TAIPEI, T'AI-PEI, TW. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball none
0 of 32 bd5cd2a0fd
NEW
d41d8cd98f
NEW none[none]
none [3] none:none
ASM:Graph
none|none
none|none none
lines=0 none
trace

T:09:56:00 WinXP 186.40.177.167 (-):
. n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:10:13:00 Win2K-f 70.128.20.170 (PARAGOULD.NET):
PARAGOULD CITY LIGHT & WATER,
PARAGOULD, ARKANSAS, US. (DSL) n/a US:gg.arrancar.org
US:69.43.160.145:555 135 pcap raw alerts
ruleset other
186 lines Yeah : 1.3
profile none summary
tarball none
0 of 32 13923caf71
NEW
d41d8cd98f
NEW none[none]
none [3] none:none
ASM:Graph
none|none
none|none none
lines=0 none
trace

T:10:21:00 WinXP 89.36.208.118 (TVAS.RO):
SC TV ADLER TRADING SRL,
RO. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball none none none none none none none

T:10:44:00 WinXP 109.86.115.152 (JWS.COM):
EU-ZZ,
UK. (DSL) n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:11:06:00 WinXP 216.210.82.218 (SPEAKEASY.NET):
US. (DSL) n/a 135 pcap raw alerts
ruleset other
10 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:11:24:00 Win2K-f 97.96.10.161 (RR.COM):
ROAD RUNNER HOLDCO LLC,
VALRICO, FLORIDA, US. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:11:31:00 WinXP 89.214.166.194 (-):
GPRS COSTUMERS,
LISBON, LISBOA, PT. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:11:51:00 WinXP 174.6.21.151 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
WINNIPEG, MANITOBA, CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:12:05:00 WinXP 79.163.158.223 (CENTERTEL.PL):
PTK CENTERTEL BROADBAND SERVICES,
WROCLAW, DOLNOSLASKIE, PL. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball none none none none none none none

T:12:25:00 Win2K-f 24.103.26.100 (RR.COM):
ROAD RUNNER HOLDCO LLC,
FLUSHING, NEW YORK, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
114 lines Yeah : 1.3
profile none summary
tarball none
0 of 32 14335fc765
NEW
d41d8cd98f
NEW none[none]
none [3] none:none
ASM:Graph
none|none
none|none none
lines=0 none
trace

T:12:31:00 WinXP 178.92.234.248 (FINEBLANK.COM):
EU-ZZ,
UK. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:12:36:00 WinXP 213.191.239.191 (O2.IE):
O2 IRELAND MOBILE PHONE OPERATOR,
ATHLONE, WESTMEATH, IE. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:13:36:00 WinXP 95.69.78.220 (-):
GPRS COSTUMERS,
LISBON, LISBOA, PT. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:14:46:00 WinXP 219.115.239.58 (ZAQ.NE.JP):
K CABLE TELEVISION CORPORATION INC,
TOKYO, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
89 lines Yeah : 1.3
profile none summary
tarball none
0 of 32 20c94c7ab1
NEW
d41d8cd98f
NEW none[none]
none [3] none:none
ASM:Graph
none|none
none|none none
lines=0 none
trace

T:14:47:00 WinXP 83.185.16.195 (TELE2.SE):
TELE2-MOBILE-INTERNET,
VAXJO, KRONOBERGS LAN, SE. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:15:57:00 Win2K-f 122.196.4.102 (ZAQ.NE.JP):
J:COM WEST CO. LTD,
OSAKA, OSAKA, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:16:04:00 WinXP 174.39.165.56 (WINDSTREAM.NET):
ALLTEL MIP CUSTOMERS - OMAHA,
NORTH PLATTE, NEBRASKA, US. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:16:07:00 Win2K-f 65.43.182.173 (AMERITECH.NET):
AT&T INTERNET SERVICES,
CLEVELAND, OHIO, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
59 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:16:11:00 WinXP 186.10.193.145 (-):
. n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:16:52:00 WinXP 75.24.2.148 (SBCGLOBAL.NET):
AT&T INTERNET SERVICES,
YOUNGSTOWN, OHIO, US. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:18:16:00 WinXP 211.23.226.98 (-):
LIOU-TZUNG-YI-TC,
TAIPEI, T'AI-PEI, TW. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:19:04:00 WinXP 173.28.199.202 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
CHANHASSEN, MINNESOTA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball none
0 of 32 c9b4b7f0b9
NEW
d41d8cd98f
NEW none[none]
none [3] none:none
ASM:Graph
none|none
none|none none
lines=0 none
trace

T:20:37:00 WinXP 76.189.154.103 (RR.COM):
ROAD RUNNER HOLDCO LLC,
CLEVELAND, OHIO, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

21:07:00 Win2K-f 186.9.129.39 (IMOVIL.ENTELPCS.CL):
ENTEL PCS TELECOMUNICACIONES S.A,
SANTIAGO, REGION METROPOLITANA, CL. (DSL) n/a US:www.maxmind.com
EU:checkip.dyndns.org
US:67.15.94.80:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:21:16:00 Win2K-f 186.9.129.39 (IMOVIL.ENTELPCS.CL):
ENTEL PCS TELECOMUNICACIONES S.A,
SANTIAGO, REGION METROPOLITANA, CL. (DSL) n/a US:www.maxmind.com
EU:getmyip.co.uk
:www.vouchercodes.com
:checkip.dyndns.org
DE:131.220.6.26:80 445 pcap raw alerts
ruleset http
44 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:21:28:00 WinXP 200.119.186.53 (-):
GT. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:21:44:00 WinXP 186.10.225.96 (-):
. 164.77.252.196:80 CL:gw.vas.entelpcs.cl 445 pcap raw alerts
ruleset http
3 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

22:04:00 WinXP 64.53.76.128 (INFOAVE.NET):
BEN LOMAND,
US. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none