Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

30 September 2010
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:39:00 WinXP 180.70.142.66 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 83.133.119.206:65520 CN:proxima.ircgalaxy.pl
US:microsoft.com
LV:ad.ghura.pl
BR:loja.tray.com.br
UA:global-host.com.ua
:rastu.com.ua
US:forums.ubuntulinux.jp
UA:weather.co.ua
:www.imagemfolheados.com.br
JP:www.science-forum.co.jp
UA:spooky.cartoons.org.ua
BR:www.billboxrecords.com.br
JP:www.marantz.jp
JP:133.87.45.189:443
UA:195.214.214.53:443
JP:202.218.111.122:443
UA:62.149.23.110:443
US:64.131.68.169:443
US:65.74.140.3:443
US:69.64.68.151:443
UA:77.120.110.76:443
UA:82.193.122.190:443
DE:83.133.119.206:65520 135 pcap raw alerts
ruleset irc
http
150 lines Yeah : 1.8
profile none summary
tarball 18 of 43
13 of 43
39 of 41
31 of 33 65e302400b
NEW
73c8396e88
NEW
ab9c4b5f21
NEW
d789c8d157
NEW none[none]
none [none]
5fe48b2dcc[0]
5f6572479f[0] none:none
none:none
ASM:Graph
ASM:Graph
none|none
none|none
Armadillo|
PolyEnE| none
none
lines=42
lines=113
embedded dns none
none
trace
trace

T:01:02:00 Win2K-f 4.178.60.148 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
VERADALE, WASHINGTON, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 40 of 43
39 of 43 a7894c0618
NEW
eb152d57cb
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

01:25:00 WinXP 180.17.227.206 (OCN.NE.JP):
NTT COMMUNICATIONS CORPORATION,
JP. (DSL) 61.86.5.250:3305 US:tinker.weedns.com 135 pcap raw alerts
ruleset irc
185 lines Yeah : 1.3
profile none summary
tarball 40 of 43 acdacd69d6
NEW none[none] none:none
none|none none none

T:01:40:00 Win2K-f 211.127.157.38 (CUSTOMER.SOLOOT.JP):
KIMITSU INC,
TOKYO, TOKYO, JP. (DSL) n/a 135 pcap raw alerts
ruleset other
264 lines Yeah : 1.3
profile none summary
tarball 41 of 43
40 of 42 17bc59fcd3
NEW
20537a9457
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:01:53:00 WinXP 117.254.227.95 (STERLINGSTUDENTS.NET):
NIB (NATIONAL INTERNET BACKBONE),
NEW DELHI, DELHI, IN. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 29 of 29 986b59708d
NEW none[0] none:none
PolyEnE| lines=57 trace

T:03:09:00 WinXP 119.154.108.101 (PIE.NET.PK):
PAKISTAN TELECOMMUNICATION COMPANY LIMITED,
ISLAMABAD, ISLAMABAD, PK. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 41 of 43 7d7da21a34
NEW none[none] none:none
none|none none none

T:03:18:00 WinXP 94.77.51.194 (-):
SKYLINK-IZHEVSK,
MOSCOW, MOSCOW CITY, RU. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:03:24:00 Win2K-f 59.120.228.224 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a 135 pcap raw alerts
ruleset other
52 lines Yeah : 1.3
profile none summary
tarball 0 of 33 57ce4acac2
NEW none[0] none:none
Armadillo| lines=90 trace

T:03:27:00 WinXP 122.125.1.190 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 39 of 41 d8040f84d4
NEW d683995e84 [0] ASM:Graph
PolyEnE| lines=73 trace

T:04:09:00 WinXP 114.145.119.164 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
TOKYO, TOKYO, JP. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:04:32:00 WinXP 219.251.116.108 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 83.133.119.206:65520 CN:proxima.ircgalaxy.pl
US:microsoft.com
LV:ad.ghura.pl
:bb.iwillhavebigdick.com
LV:kdert.com
LV:streq.cn
LV:bestkind.ru
PL:randomname.in
173.192.153.178:80
PL:89.149.223.252:80
LV:91.188.59.199:80 135 pcap raw alerts
ruleset irc
http
120 lines Yeah : 1.8
profile none summary
tarball 31 of 33
26 of 43
28 of 43
39 of 41
14 of 43
26 of 43
4 of 42 168aab35a3
NEW
2c19b67965
NEW
34d6e95d5b
NEW
aa6d257461
NEW
ac7d456668
NEW
afd0915c1a
NEW
f34ba103d5
NEW 60b730b97e [0]
none [none]
none [none]
6aca567868[0]
none [none]
none [none]
none [none] ASM:Graph
none:none
none:none
ASM:Graph
none:none
none:none
none:none
tElock|
none|none
none|none
Armadillo|
none|none
none|none
none|none lines=120
embedded dns
none
none
lines=91
none
none
none trace
none
none
trace
none
none
none

T:05:14:00 WinXP 125.4.31.192 (ZAQ.NE.JP):
J:COM WEST CO. LTD,
OSAKA, OSAKA, JP. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 a73c16ccd0
NEW 5568131b79 [0] ASM:Graph
none|none lines=63 trace

T:06:03:00 Win2K-f 119.26.168.14 (ZAQ.NE.JP):
KANSAI MULTIMEDIA SERVICE COMPANY,
JP. (DSL) 62.193.249.122:3305 FR:cx10man.weedns.com 135 pcap raw alerts
ruleset irc
575 lines Yeah : 1.8
profile none summary
tarball 39 of 40 70ec5c4b3f
NEW f697adabdd [0] none:none
StarForce| none trace

T:06:06:00 WinXP 193.93.110.216 (GRAT.NET.UA):
GRAT NETWORK INTERNET SERVICE PROVIDER,
KIEV, KYYIV, UA. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 40 of 41 1d0ce31c6d
NEW none[none] none:none
none|none none none

T:06:17:00 WinXP 202.225.80.74 (MESH.AD.JP):
NEC CORPORATION,
TOKYO, TOKYO, JP. (DSL) n/a RU:siliconfireware.ru
RU:auction.nic.ru
:www.google-analytics.com
RU:domain-parking.ru
:wpad 445 pcap raw alerts
ruleset http
http
http
38 lines Yeah : 0.8
profile none summary
tarball 29 of 29 df17a625ee
NEW none[0] none:none
ASPack| lines=298
embedded dns trace

T:06:52:00 WinXP 93.86.8.62 (-):
TELEKOM SRBIJA ADSL USERS,
RS. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 29 of 29 986b59708d
NEW none[0] none:none
PolyEnE| lines=57 trace

T:07:22:00 WinXP 189.38.203.217 (VELOXZONE.COM.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
SãO BERNARDO DO CAMPO, SAO PAULO, BR. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:07:23:00 Win2K-f 175.117.20.152 (-):
. 60.190.222.139:65520 US:microsoft.com
DE:proxim.ircgalaxy.pl
LV:ad.ghura.pl
:bb.iwillhavebigdick.com
LV:kdert.com
173.192.153.178:80
CN:60.190.222.139:65520
LV:91.188.59.199:80
LV:91.188.60.16:80 135 pcap raw alerts
ruleset irc
138 lines Yeah : 1.8
profile none summary
tarball 30 of 33
28 of 33 533d15b5ce
NEW
58c343a8d8
NEW c67adf46e2 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=126
embedded dns
lines=91 trace
trace

T:07:53:00 WinXP 79.163.218.159 (CENTERTEL.PL):
PTK CENTERTEL BROADBAND SERVICES,
PL. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 41 of 41 5c6df5141d
NEW none[none] none:none
none|none none none

T:08:34:00 WinXP 216.183.60.63 (GRANDERIVER.COM):
VTX BROADBAND INC,
WEST COLUMBIA, TEXAS, US. (DIAL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 42 of 43 c19c8a2776
NEW none[none] none:none
none|none none none

T:08:42:00 WinXP 68.206.28.216 (RR.COM):
ROAD RUNNER HOLDCO LLC,
BEAUMONT, TEXAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:08:56:00 WinXP 188.28.76.213 (THREE.CO.UK):
HUTCHISON 3G UK LIMITED,
UK. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 39 of 41 d8040f84d4
NEW d683995e84 [0] ASM:Graph
PolyEnE| lines=73 trace

T:09:13:00 WinXP 77.47.63.133 (CABLESURF.DE):
KKG-GUE-DHCP-SPACE,
BERLIN, BERLIN, DE. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
30 lines Yeah : 0.8
profile none summary
tarball 35 of 40 c473a72583
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:09:14:00 Win2K-f 86.38.85.33 (ERDVES.LT):
SC LITHUANIAN RADIO AND TV CENTER,
VILNIUS, VILNIAUS APSKRITIS, LT. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 38 of 41 f996bf0275
NEW 1e4ad6cdb1 [0] ASM:Graph
ASPack| lines=3065
embedded dns trace

T:09:14:00 WinXP 81.183.82.231 (T-ONLINE.HU):
T-COM HUNGARY RETAIL ADSL CLIENT POOL,
BUDAPEST, BUDAPEST, HU. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
26 lines Yeah : 0.8
profile none summary
tarball 42 of 43 49c5a946bf
NEW none[none] none:none
none|none none none

T:09:16:00 WinXP 82.56.2.92 (RETAIL.TELECOMITALIA.IT):
TELECOM ITALIA S.P.A. TIN EASY LITE,
NOVARA, PIEMONTE, IT. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
40 lines Yeah : 0.8
profile none summary
tarball 40 of 41 f534041536
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:09:16:00 Win2K-f 71.42.133.191 (RR.COM):
ROAD RUNNER HOLDCO LLC,
MCALLEN, TEXAS, US. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 40 of 41 bedf29b824
NEW 1e4ad6cdb1 [0] ASM:Graph
ASPack| lines=3065
embedded dns trace

T:09:18:00 Win2K-f 94.251.249.123 (-):
SERVERS STREAM COMMUNICATIONS,
PL. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 40 of 41 b68d420d61
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:09:21:00 Win2K-f 123.193.206.72 (KBRONET.COM.TW):
TUNG HO MULTIMEDIA CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 40 of 40 0629d7fc42
NEW none[none] none:none
none|none none none

T:09:27:00 WinXP 86.63.149.12 (NET.PL):
PRONET,
LUBLIN, LUBELSKIE, PL. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
36 lines Yeah : 0.8
profile none summary
tarball 40 of 41 b68d420d61
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

09:31:00 WinXP 188.28.76.213 (THREE.CO.UK):
HUTCHISON 3G UK LIMITED,
UK. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 41 d8040f84d4
NEW d683995e84 [0] ASM:Graph
PolyEnE| lines=73 trace

T:09:38:00 WinXP 86.63.140.93 (NET.PL):
PRONET,
LUBLIN, LUBELSKIE, PL. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
34 lines Yeah : 0.8
profile none summary
tarball 40 of 41 e3faefa56a
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:09:44:00 WinXP 178.36.14.123 (FINEBLANK.COM):
EU-ZZ,
UK. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
33 lines Yeah : 0.8
profile none summary
tarball 39 of 41 29f397698f
NEW none[none] none:none
none|none none none

T:09:50:00 Win2K-f 113.43.52.187 (UCOM.NE.JP):
UCOM CORP,
JP. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 39 of 43 c90e8eb08a
NEW none[none] none:none
none|none none none

T:09:53:00 Win2K-f 84.109.229.232 (BEZEQINT.NET):
CABLES-CUSTOMERS-CONNECTION,
RAMAT GAN, TEL AVIV, IL. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 41 of 41 e25842bcd6
NEW none[none] none:none
none|none none none

T:09:55:00 Win2K-f 221.125.2.82 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
34 lines Yeah : 0.8
profile none summary
tarball 40 of 41 8128405d8c
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:10:08:00 WinXP 93.114.174.6 (TELECOMROMANIA.RO):
SC SIL-MIRO COM SRL,
BUCHAREST, BUCURESTI, RO. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
30 lines Yeah : 0.8
profile none summary
tarball 40 of 41 e3faefa56a
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:10:10:00 Win2K-f 94.251.249.141 (-):
SERVERS STREAM COMMUNICATIONS,
PL. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
32 lines Yeah : 0.8
profile none summary
tarball 40 of 41 b68d420d61
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:10:13:00 WinXP 188.173.124.23 (RIPE.NET):
EUROPEAN REGIONAL REGISTRY,
UK. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
32 lines Yeah : 0.8
profile none summary
tarball 40 of 43 531a598a70
NEW none[none] none:none
none|none none none

T:10:17:00 WinXP 87.110.170.150 (-):
ADDRESS POOL FOR LTC-HOME CUSTOMERS,
RIGA, RIGA, LV. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
35 lines Yeah : 0.8
profile none summary
tarball 41 of 41 29a3030e16
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:10:29:00 WinXP 77.64.164.242 (PRIMACOM.NET):
PRIMACOM-HEADENDS,
CHEMNITZ, SACHSEN, DE. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
32 lines Yeah : 0.8
profile none summary
tarball 41 of 42 6770a90b2d
NEW none[none] none:none
none|none none none

T:10:31:00 Win2K-f 61.219.143.4 (HINET.NET):
CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
57ce4acac2
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:10:40:00 Win2K-f 217.125.198.163 (RIMA-TDE.NET):
TELEFONICA DE ESPANA SAU (NCC#2001040161),
TORREVIEJA, COMUNIDAD VALENCIANA, ES. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 37 of 43 3f7ae0a64b
NEW none[none] none:none
none|none none none

T:10:41:00 Win2K-f 88.132.131.113 (-):
PRTELECOM,
HU. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 38 of 42 3f350b87ce
NEW none[none] none:none
none|none none none

T:10:46:00 Win2K-f 61.222.0.158 (HINET.NET):
JIN JER CO. LTD,
TAIPEI, T'AI-PEI, TW. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
57ce4acac2
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:10:47:00 WinXP 85.66.151.171 (BACS-NET.HU):
FIBERNET COMMUNICATION CO,
BUDAPEST, BUDAPEST, HU. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
34 lines Yeah : 0.8
profile none summary
tarball 40 of 41 8128405d8c
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:10:48:00 WinXP 77.236.173.199 (-):
VCABLE,
SOFIA, GRAD SOFIYA, BG. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
30 lines Yeah : 0.8
profile none summary
tarball 40 of 41 f534041536
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:10:58:00 WinXP 173.25.155.83 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
ALBANY, GEORGIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:11:13:00 Win2K-f 86.52.14.34 (REV.STOFANET.DK):
STOFANET-INET-CIDR,
ÅRHUS, ARHUS, DK. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 39 of 40 b91423b944
NEW none[none] none:none
none|none none none

T:11:19:00 Win2K-f 85.217.153.74 (ARB-WR01.EVO.BG):
EVO IP ADDRESS SPACE,
SOFIA, GRAD SOFIYA, BG. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 40 of 41 c13a6c3da5
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:11:21:00 Win2K-f 78.84.142.198 (-):
ADDRESS POOL FOR LTC-HOME CUSTOMERS,
RIGA, RIGA, LV. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:11:31:00 WinXP 78.61.49.92 (ZEBRA.LT):
LIETUVOS-TELEKOMAS,
KAUNAS, KAUNO APSKRITIS, LT. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
24 lines Yeah : 0.8
profile none summary
tarball 37 of 39 3ae841bfda
NEW none[none] none:none
none|none none none

T:11:40:00 WinXP 174.6.21.151 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
WINNIPEG, MANITOBA, CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:11:43:00 Win2K-f 24.69.113.133 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VICTORIA, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
113 lines Yeah : 1.3
profile none summary
tarball 31 of 32
23 of 33 bca9e0fb5f
NEW
e53a9ea82e
NEW 1d6b20137d [0]
none [0] ASM:Graph
none:none
PolyEnE|
Armadillo| lines=64
embedded dns
lines=90 trace
trace

T:11:59:00 WinXP 88.215.97.48 (CABLESURF.DE):
FAKS-FFO-DHCP-SPACE,
BERLIN, BERLIN, DE. (DSL) n/a 139 pcap raw alerts
ruleset ftp
9 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:12:04:00 Win2K-f 88.118.95.135 (ZEBRA.LT):
LIETUVOS,
VILNIUS, VILNIAUS APSKRITIS, LT. (DSL) n/a 139 pcap raw alerts
ruleset ftp
16 lines Yeah : 0.8
profile none summary
tarball 37 of 40 4dd4197eb4
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:12:05:00 WinXP 85.175.123.139 (KES.RU):
PUBLIC JOINT STOCK COMPANY,
MOSCOW, MOSCOW CITY, RU. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:12:08:00 WinXP 79.163.166.111 (CENTERTEL.PL):
PTK CENTERTEL BROADBAND SERVICES,
PL. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 41 of 41 5c6df5141d
NEW none[none] none:none
none|none none none

T:12:12:00 Win2K-f 180.177.172.227 (-):
. n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 42 of 43 87c037c9e8
NEW none[none] none:none
none|none none none

T:12:12:00 Win2K-f 77.64.191.196 (PRIMACOM.NET):
PRIMACOM-HEADENDS,
LEIPZIG, SACHSEN, DE. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
13 lines Yeah : 0.8
profile none summary
tarball 41 of 42 687eb47a37
NEW none[none] none:none
none|none none none

T:12:43:00 Win2K-f 94.78.188.211 (-):
HOMENET TECHNOLOGIES SP. Z O.O,
GDANSK, POMORSKIE, PL. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 35 of 40 c473a72583
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:12:47:00 Win2K-f 87.246.56.57 (-):
TRIPLE PLAY OF CABLETEL PLC IN SHUMEN - NEW CMTS,
SOFIA, GRAD SOFIYA, BG. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 39 of 41 1b3d8e9fe7
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:12:49:00 WinXP 123.193.166.178 (KBRONET.COM.TW):
TUNG HO MULTIMEDIA CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
18 lines Yeah : 0.8
profile none summary
tarball 41 of 42 6049c3efc1
NEW none[none] none:none
none|none none none

T:12:51:00 WinXP 151.59.115.140 (51-151.NET24.IT):
IUNET-BNET,
TURIN, PIEMONTE, IT. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
24 lines Yeah : 0.8
profile none summary
tarball 40 of 42 471388fe46
NEW none[none] none:none
none|none none none

T:12:56:00 Win2K-f 95.68.87.234 (-):
ADDRESS POOL FOR LTC-HOME CUSTOMERS,
RIGA, RIGA, LV. (DSL) n/a 139 pcap raw alerts
ruleset ftp
10 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:13:08:00 WinXP 86.52.16.198 (REV.STOFANET.DK):
STOFANET-INET-CIDR,
ÅRHUS, ARHUS, DK. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
22 lines Yeah : 0.8
profile none summary
tarball 39 of 40 b91423b944
NEW none[none] none:none
none|none none none

T:13:10:00 Win2K-f 82.115.70.218 (NET.PL):
INTERNET SOLUTIONS ISP,
WARSAW, WARSZAWA, PL. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 41 of 41 2d26223e2f
NEW none[none] none:none
none|none none none

T:13:15:00 Win2K-f 24.79.36.77 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
18 lines Yeah : 0.8
profile none summary
tarball 41 of 43 c23a910a12
NEW none[none] none:none
none|none none none

T:13:19:00 WinXP 95.74.202.86 (-):
TELECOM ITALIA MOBILE,
IT. (DSL) n/a PR:m.drd3h.com 139 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 0.8
profile none summary
tarball 39 of 42 80659b2686
NEW none[none] none:none
none|none none none

T:13:28:00 Win2K-f 98.141.163.84 (CAVTEL.NET):
CAVALIER TELEPHONE,
PHILADELPHIA, PENNSYLVANIA, US. (DSL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:13:46:00 Win2K-f 173.31.87.182 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
MIDDLETOWN, NEW YORK, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:13:53:00 Win2K-f 113.252.180.245 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 39 of 41 46bf358cc3
NEW afaf06d6cd [0] ASM:Graph
pex| lines=42 trace

T:13:54:00 WinXP 64.38.90.205 (-):
CURATEL LLC,
LOS ANGELES, CALIFORNIA, US. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
26 lines Yeah : 0.8
profile none summary
tarball 42 of 43 0d499b2d7b
NEW none[none] none:none
none|none none none

T:13:55:00 WinXP 212.129.92.58 (-):
METEOR MOBILE BROADBAND,
DUBLIN, DUBLIN, IE. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 40 of 41 01c4a6b3eb
NEW dd524b0259 [0] ASM:Graph
PolyEnE| lines=68 trace

T:14:05:00 Win2K-f 78.84.225.154 (-):
ADDRESS POOL FOR LTC-HOME CUSTOMERS,
VENTSPILS, VENTSPILS, LV. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 39 of 41 1b3d8e9fe7
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:14:18:00 Win2K-f 173.168.81.7 (RR.COM):
ROAD RUNNER HOLDCO LLC,
LUTZ, FLORIDA, US. (DSL) n/a 135 pcap raw alerts
ruleset other
1008 lines Yeah : 1.3
profile none summary
tarball 31 of 41 682a384fe9
NEW none[3] none:none
none|none none trace

T:14:30:00 Win2K-f 174.3.216.6 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CA. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
24 lines Yeah : 0.8
profile none summary
tarball 36 of 40 9363d60262
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:14:49:00 Win2K-f 87.121.229.80 (-):
IP ADDRESS RANGE FOR EVO - VT,
BG. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 39 of 41 c45a01fbcc
NEW afaf06d6cd [0] ASM:Graph
pex| lines=42 trace

T:14:52:00 Win2K-f 208.103.245.177 (EASTLINK.CA):
EASTLINK HSI,
HALIFAX, NOVA SCOTIA, CA. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 40 of 41 ffbb6cbe61
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:15:03:00 WinXP 70.128.25.15 (PARAGOULD.NET):
PARAGOULD CITY LIGHT & WATER,
PARAGOULD, ARKANSAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 42
41 of 42 4d91db06f4
NEW
80ad2a0006
NEW 67419c8838 [0]
06729732e0[0] none:none
none:none
Armadillo|
tElock| none
none trace
trace

T:15:10:00 Win2K-f 24.32.159.223 (CEBRIDGE.NET):
CEBRIDGE CONNECTIONS,
WOODWARD, OKLAHOMA, US. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
26 lines Yeah : 0.8
profile none summary
tarball 41 of 42 a8c7b1bcff
NEW none[none] none:none
none|none none none

T:15:35:00 Win2K-f 173.31.92.213 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
MIDDLETOWN, NEW YORK, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:15:58:00 WinXP 75.18.154.82 (SBCGLOBAL.NET):
KS CHANDI & SONS INC,
PLANO, TEXAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 39 of 41
40 of 41 1e12f5145a
NEW
f208493e65
NEW 617af909de [0]
5100adb4f9[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:16:21:00 Win2K-f 113.19.9.15 (VSNL.NET.IN):
INTERNET SERVICE PROVIDER,
CHENNAI, TAMIL NADU, IN. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 39 of 41 c45a01fbcc
NEW afaf06d6cd [0] ASM:Graph
pex| lines=42 trace

T:17:07:00 WinXP 95.88.65.136 (SUPERKABEL.DE):
KABEL-DEUTSCHLAND-CUSTOMER-SERVICES,
DE. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 42 of 42 c46f4552da
NEW ce6ff736cf [0] none:none
none|none none trace

T:17:46:00 WinXP 186.97.142.121 (-):
. 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 40 of 40 65db8c1d0d
NEW none[none] none:none
none|none none none

T:17:49:00 WinXP 95.74.103.86 (-):
TELECOM ITALIA MOBILE,
IT. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 35 of 35 9716d7995a
NEW c3a5354b6f [0] ASM:Graph
PolyEnE| lines=68 trace

T:18:01:00 Win2K-f 63.27.240.60 (UU.NET):
UUNET TECHNOLOGIES INC,
ASHLAND, OHIO, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
115 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:18:01:00 Win2K-f 4.155.117.226 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
PITTSBURGH, PENNSYLVANIA, US. (DSL) n/a 135 pcap raw alerts
ruleset other
3 lines Argh : 0.3
profile none summary
tarball none none none none none none none

18:47:00 WinXP 180.218.172.78 (-):
. 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 29 of 29 986b59708d
NEW none[0] none:none
PolyEnE| lines=57 trace

T:19:11:00 Win2K-f 114.74.236.98 (OPTUSNET.COM.AU):
OPTUS INTERNET - RETAIL,
MELBOURNE, VICTORIA, AU. (DSL) n/a 135 pcap raw alerts
ruleset other
1027 lines Yeah : 1.3
profile none summary
tarball 42 of 43 065bfd0d85
NEW none[none] none:none
none|none none none

T:19:16:00 Win2K-f 67.125.140.230 (PACBELL.NET):
AT&T INTERNET SERVICES,
FRESNO, CALIFORNIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:19:33:00 WinXP 4.178.236.29 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
BONNERS FERRY, IDAHO, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
201 lines Yeah : 1.3
profile none summary
tarball 40 of 42
40 of 41 25be4ab6cf
NEW
c47649a89f
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:19:42:00 Win2K-f 89.152.87.167 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
FARO, FARO, PT. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 40 of 41 f534041536
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:20:09:00 WinXP 173.31.97.190 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
MIDDLETOWN, NEW YORK, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:20:14:00 WinXP 113.252.210.108 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
24 lines Yeah : 0.8
profile none summary
tarball 38 of 41 8887d42f5c
NEW afaf06d6cd [0] ASM:Graph
pex| lines=42 trace

T:20:34:00 WinXP 68.147.35.222 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 38 of 41
38 of 41 270559591a
NEW
b3ae886db6
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:21:34:00 Win2K-f 122.196.24.7 (ZAQ.NE.JP):
J:COM WEST CO. LTD,
OSAKA, OSAKA, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 40 of 41
40 of 41 71e6f60517
NEW
ab4e3226c4
NEW 1ef1781501 [0]
c2d0313e73[0] ASM:Graph
none:none
Armadillo|
tElock| lines=91
none trace
trace

T:22:01:00 WinXP 123.150.43.252 (163DATA.COM.CN):
CHINANET TIANJIN PROVINCE NETWORK,
TIANJIN, TIANJIN, CN. (DSL) n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 32 of 32 b502f83a7c
NEW 28f5be93b0 [0] ASM:Graph
PolyEnE| lines=73 trace

T:22:30:00 WinXP 92.115.136.183 (HOST-STATIC-92-115-28-10.MOLDTELECOM.MD):
JSC MOLDTELECOM SA,
CHISINAU, CHISINAU, MD. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

22:53:00 WinXP 92.115.136.183 (HOST-STATIC-92-115-28-10.MOLDTELECOM.MD):
JSC MOLDTELECOM SA,
CHISINAU, CHISINAU, MD. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:23:10:00 WinXP 70.183.161.202 (COX.NET):
COX COMMUNICATIONS,
MANCHESTER, CONNECTICUT, US. (DSL) n/a 135 pcap raw alerts
ruleset other
1002 lines Yeah : 1.3
profile none summary
tarball 31 of 43 8e015d66f3
NEW none[none] none:none
none|none none none

T:23:21:00 WinXP 70.68.156.221 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
COQUITLAM, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

23:29:00 WinXP 123.150.43.252 (163DATA.COM.CN):
CHINANET TIANJIN PROVINCE NETWORK,
TIANJIN, TIANJIN, CN. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 32 of 32 b502f83a7c
NEW 28f5be93b0 [0] ASM:Graph
PolyEnE| lines=73 trace