|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:00:07:00 | WinXP | 109.162.36.40 (STERLINGSTUDENTS.NET): EU-ZZ, UK. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
40 of 41 | d11b1f56f9 NEW |
none[none] | none:none |
none|none | none | none | |
| 00:20:00 | WinXP | 164.132.15.138 (-): IUNET S.P.A, MILANO, LOMBARDIA, IT. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
42 of 43 | 442f18292b NEW |
none[none] | none:none |
none|none | none | none |
| 00:29:00 | Win2K-f | 202.73.35.237 (INNOVAX.CO.JP): INNOVAX-WEST SG, SINGAPORE, SINGAPORE, SG. (100Mbps) |
n/a | US:www.maxmind.com EU:getmyip.co.uk :www.getmyip.org US:checkip.dyndns.org DE:131.220.6.26:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:00:29:00 | Win2K-f | 116.58.146.229 (CCNET-AI.NE.JP): COMMUNITY NETWORK CENTER INC, TOYOKAWA, AICHI, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 33 of 33 |
07fabc79ef NEW 53bfe15e91 NEW |
none[0] 1473091351[0] |
none:none ASM:Graph |
Armadillo| tElock| |
lines=90 lines=75 embedded dns |
trace trace |
| 00:53:00 | WinXP | 112.78.65.219 (-): VIBO TELECOM INC, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:01:21:00 | WinXP | 182.164.231.62 (-): . |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 15 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 41 | 7b313206a2 NEW |
0c866c8cce [0] | ASM:Graph |
none|none | lines=59 | trace | |
| T:01:48:00 | Win2K-f | 76.189.154.103 (RR.COM): ROAD RUNNER HOLDCO LLC, CLEVELAND, OHIO, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 89 lines |
Yeah : 1.3 profile |
none | summary tarball |
37 of 42 33 of 33 |
359d245014 NEW 53bfe15e91 NEW |
none[none] 1473091351[0] |
none:none ASM:Graph |
none|none tElock| |
none lines=75 embedded dns |
none trace |
| T:02:23:00 | Win2K-f | 4.159.165.28 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, BROOKLYN PARK, MINNESOTA, US. (DIAL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:02:28:00 | WinXP | 121.121.139.80 (MAXIS.NET.MY): MAXIS BROADBAND SDN BHD, KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
40 of 41 | 0393e25f86 NEW |
51aaf10e18 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:02:54:00 | WinXP | 46.130.68.111 (-): . |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 3 lines |
Yeah : 1.3 profile |
none | summary tarball |
24 of 43 | 1cc12ecd99 NEW |
none[none] | none:none |
none|none | none | none |
| T:03:21:00 | WinXP | 113.210.7.143 (MAXIS.NET.MY): MAXIS BROADBAND SDN BHD, MY. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
43 of 43 | 7e2a86b9a4 NEW |
none[none] | none:none |
none|none | none | none |
| T:03:24:00 | WinXP | 189.127.99.218 (UNOTEL.COM.BR): COMITE GESTOR DA INTERNET NO BRASIL, BR. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
42 of 42 | 4aa9b2104a NEW |
none[none] | none:none |
none|none | none | none |
| T:03:34:00 | WinXP | 188.176.70.20 (DSL.TELE.DK): TDC-TELEDANMARK-BREDBAANDSADSL-NET, DK. (DSL) |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
32 of 32 | b502f83a7c NEW |
28f5be93b0 [0] | ASM:Graph |
PolyEnE| | lines=73 | trace |
| T:03:35:00 | WinXP | 109.52.14.25 (JWS.COM): EU-ZZ, UK. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru :althawry.org |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 43 | c1a5d60ec6 NEW |
none[none] | none:none |
none|none | none | none |
| T:04:01:00 | Win2K-f | 85.217.147.179 (ARB-WR01.EVO.BG): EVO IP ADDRESS SPACE, SOFIA, GRAD SOFIYA, BG. (DSL) |
n/a | US:m.DRD3H.COM US:66.197.134.136:6668 |
139 | pcap | raw alerts ruleset |
ftp irc 28 lines |
Yeah : 0.8 profile |
none | summary tarball |
37 of 40 | 50cdd5c6cf NEW |
1d04d6dc84 [0] | ASM:Graph |
ASPack| | lines=3292 embedded dns |
trace |
| T:04:12:00 | WinXP | 109.185.176.35 (STERLINGSTUDENTS.NET): EU-ZZ, UK. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 | d8040f84d4 NEW |
d683995e84 [0] | ASM:Graph |
PolyEnE| | lines=73 | trace |
| T:04:36:00 | WinXP | 94.253.179.31 (XNET.HR): BNET HRVATSKA, HR. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
41 of 43 | 6e6fde936f NEW |
none[none] | none:none |
none|none | none | none |
| T:04:38:00 | WinXP | 92.86.68.227 (TELELINK-RO.COM): ARTELECOM, BUCHAREST, BUCURESTI, RO. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.8 profile |
none | summary tarball |
39 of 43 | ad97e8accf NEW |
none[none] | none:none |
none|none | none | none |
| T:05:02:00 | WinXP | 79.163.237.37 (CENTERTEL.PL): PTK CENTERTEL BROADBAND SERVICES, PL. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
41 of 41 | 5c6df5141d NEW |
none[none] | none:none |
none|none | none | none |
| T:05:07:00 | WinXP | 121.121.200.195 (MAXIS.NET.MY): MAXIS BROADBAND SDN BHD, KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
41 of 43 | fb486908b0 NEW |
none[none] | none:none |
none|none | none | none |
| 05:29:00 | WinXP | 188.176.70.20 (DSL.TELE.DK): TDC-TELEDANMARK-BREDBAANDSADSL-NET, DK. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
32 of 32 | b502f83a7c NEW |
28f5be93b0 [0] | ASM:Graph |
PolyEnE| | lines=73 | trace |
| T:05:41:00 | Win2K-f | 86.63.64.36 (COM.PL): ASTA-NET PILA POLAND, WARSAW, WARSZAWA, PL. (DSL) |
n/a | US:h.maqder.info | 139 | pcap | raw alerts ruleset |
ftp irc 17 lines |
Yeah : 0.8 profile |
none | summary tarball |
41 of 43 | a5d5c8ec12 NEW |
none[none] | none:none |
none|none | none | none |
| T:05:54:00 | Win2K-f | 89.115.152.59 (-): ILINK REZIDENTIAL, BUCHAREST, BUCURESTI, RO. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
ftp 12 lines |
Yeah : 0.8 profile |
none | summary tarball |
42 of 43 | 8bff1912e0 NEW |
none[none] | none:none |
none|none | none | none | |
| 06:50:00 | Win2K-f | 194.225.115.82 (-): IRAN POLYMER INSTITUTE, TEHRAN, ESFAHAN, IR. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
http 3 lines |
Argh : 0.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:06:52:00 | WinXP | 98.124.88.61 (HOMESC.COM): HOME TELEPHONE COMPANY INC, MONCKS CORNER, SOUTH CAROLINA, US. (100Mbps) |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:07:16:00 | WinXP | 1.224.156.85, 122.224.5.167 (INVALID IPV4 ADDRESS): INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS. (INVALID IPV4 ADDRESS) |
n/a | DE:irc.zief.pl US:microsoft.com EU:ii.derquda.com CN:k.perfectexe.com CN:exe4.perfectexe.com EU:www.derquda.com CN:d.perfectexe.com EU:justnewleft.ru :atlasmortgagees.info :computersinternets.info :animalelectricity.info 174.123.160.195:80 DE:83.133.119.206:80 |
135 | pcap | raw alerts ruleset |
irc http 558 lines |
Yeah : 1.3 profile |
none | summary tarball |
12 of 42 30 of 43 37 of 41 40 of 41 33 of 42 37 of 43 29 of 43 |
043621a659 NEW 1b8d9f2929 NEW 34cd9e2f76 NEW 376a6b6ecd NEW 735053e788 NEW b285975966 NEW b34e640329 NEW |
none[none] none [none] none [none] none [none] none [none] none [none] none [none] |
none:none none:none none:none none:none none:none none:none none:none |
none|none none|none none|none none|none none|none none|none none|none |
none none none none none none none |
none none none none none none none |
| T:07:25:00 | WinXP | 217.17.100.28 (-): CS-SAT-TRAKT, CS. (DSL) |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 1.3 profile |
none | summary tarball |
34 of 34 | d20f157117 NEW |
738f555183 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:07:45:00 | WinXP | 61.228.158.235 (PRESTONAUTO.COM): CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP, TAIPEI, T'AI-PEI, TW. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:08:37:00 | WinXP | 121.121.21.190 (MAXIS.NET.MY): MAXIS BROADBAND SDN BHD, KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) |
n/a | :moscow-advokat.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
42 of 43 | 1511a3f219 NEW |
none[none] | none:none |
none|none | none | none |
| T:08:39:00 | Win2K-f | 124.104.123.199 (PLDT.NET): JNEC7300I01_CONSUMER, CEBU, CEBU CITY, PH. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
42 of 43 40 of 43 |
49eb307fd1 NEW 9b3f2d3e0a NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:08:48:00 | WinXP | 70.182.94.31, 122.224.5.167 (INVALID IPV4 ADDRESS): INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS. (INVALID IPV4 ADDRESS) |
83.133.119.206:65520 | EU:proxim.ircgalaxy.pl US:microsoft.com EU:ii.derquda.com CN:k.perfectexe.com CN:exe4.perfectexe.com EU:www.derquda.com EU:justnewleft.ru CN:d.perfectexe.com CN:2b.yigeyuming.com US:get.whitesmoke.com |
135 | pcap | raw alerts ruleset |
irc http 154 lines |
Yeah : 1.8 profile |
none | summary tarball |
12 of 42 30 of 43 33 of 42 37 of 43 29 of 43 41 of 43 32 of 36 11 of 32 35 of 36 |
043621a659 NEW 1b8d9f2929 NEW 735053e788 NEW b285975966 NEW b34e640329 NEW b4afa1df1d NEW bea8cb1865 NEW cc18b85518 NEW fac78fde16 NEW |
none[none] none [none] none [none] none [none] none [none] none [none] 154de51a66[0] none [none] 882896ab05[0] |
none:none none:none none:none none:none none:none none:none ASM:Graph none:none ASM:Graph |
none|none none|none none|none none|none none|none none|none Armadillo| none|none tElock| |
none none none none none none lines=91 none lines=126 embedded dns |
none none none none none none trace none trace |
| T:09:00:00 | WinXP | 121.123.46.48 (MAXIS.NET.MY): MAXIS BROADBAND SDN BHD, KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 3 lines |
Yeah : 0.8 profile |
none | summary tarball |
34 of 34 | d20f157117 NEW |
738f555183 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:09:13:00 | Win2K-f | 211.117.100.229, 122.224.5.167 (INVALID IPV4 ADDRESS): INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS. (INVALID IPV4 ADDRESS) |
91.193.194.67:65520 | DE:proxima.ircgalaxy.pl US:microsoft.com EU:ii.derquda.com CN:k.perfectexe.com EU:www.derquda.com EU:justnewleft.ru CN:exe4.perfectexe.com CN:d.perfectexe.com US:get.whitesmoke.com US:c0007083.cdn2.cloudfiles.rackspacecloud.com US:track.zugo.com US:208.111.148.6:80 US:66.45.233.2:80 |
135 | pcap | raw alerts ruleset |
irc http 180 lines |
Yeah : 1.8 profile |
none | summary tarball |
12 of 42 23 of 43 33 of 42 39 of 41 37 of 43 2 of 43 29 of 43 11 of 32 31 of 33 |
043621a659 NEW 18d5ebebab NEW 735053e788 NEW ab9c4b5f21 NEW b285975966 NEW b2c1ecbb4e NEW b34e640329 NEW cc18b85518 NEW d789c8d157 NEW |
none[none] none [none] none [none] 5fe48b2dcc[0] none [none] none [none] none [none] none [none] 5f6572479f[0] |
none:none none:none none:none ASM:Graph none:none none:none none:none none:none ASM:Graph |
none|none none|none none|none Armadillo| none|none none|none none|none none|none PolyEnE| |
none none none lines=42 none none none none lines=113 embedded dns |
none none none trace none none none none trace |
| T:09:22:00 | Win2K-f | 75.24.11.78 (SBCGLOBAL.NET): AT&T INTERNET SERVICES, YOUNGSTOWN, OHIO, US. (DSL) |
91.193.194.67:65520 | US:microsoft.com :tbtrack.zugo.com CN:exe4.perfectexe.com EU:justnewleft.ru DE:proxima.ircgalaxy.pl CN:d.perfectexe.com EU:ii.derquda.com CN:122.224.5.167:88 US:208.111.148.6:80 US:64.20.48.219:80 EU:91.217.162.97:80 |
445 | pcap | raw alerts ruleset |
http irc http 38 lines |
Yeah : 1.3 profile |
none | summary tarball |
12 of 42 23 of 43 6 of 43 14 of 35 29 of 43 |
043621a659 NEW 18d5ebebab NEW 2266759fba NEW 6eb7c89012 NEW b34e640329 NEW |
none[none] none [none] none [none] none [none] none [none] |
none:none none:none none:none none:none none:none |
none|none none|none none|none none|none none|none |
none none none none none |
none none none none none |
| T:09:33:00 | WinXP | 121.121.52.115 (MAXIS.NET.MY): MAXIS BROADBAND SDN BHD, KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 43 | 9d1d2a8799 NEW |
none[none] | none:none |
none|none | none | none |
| T:09:33:00 | Win2K-f | 24.234.79.82 (COX.NET): COX COMMUNICATIONS INC, LAS VEGAS, NEVADA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:09:39:00 | WinXP | 12.65.210.216 (PRSERV.NET): AT&T GLOBAL SERVICES, ARLINGTON, TEXAS, US. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:09:47:00 | WinXP | 121.120.245.193 (MAXIS.NET.MY): MAXIS BROADBAND SDN BHD, KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 3 lines |
Yeah : 1.3 profile |
none | summary tarball |
41 of 43 | fb486908b0 NEW |
none[none] | none:none |
none|none | none | none |
| T:10:18:00 | WinXP | 87.96.173.235 (BLIXTVIK.SE): BLIXTVIK INTERNET OCH TELEFONI AB, STOCKHOLM, STOCKHOLMS LAN, SE. (DSL) |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
34 of 34 | d20f157117 NEW |
738f555183 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| 10:41:00 | WinXP | 87.96.173.235 (BLIXTVIK.SE): BLIXTVIK INTERNET OCH TELEFONI AB, STOCKHOLM, STOCKHOLMS LAN, SE. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
34 of 34 | d20f157117 NEW |
738f555183 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:10:52:00 | WinXP | 91.64.104.223 (SUPERKABEL.DE): KABEL-DEUTSCHLAND-CUSTOMER-SERVICES, BERLIN, BERLIN, DE. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
ftp 12 lines |
Yeah : 0.8 profile |
none | summary tarball |
42 of 42 | c46f4552da NEW |
ce6ff736cf [0] | none:none |
none|none | none | trace | |
| T:11:17:00 | WinXP | 93.102.135.234 (REV.OPTIMUS.PT): OPTIMUS PORTUGAL, PT. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
42 of 42 | f5c22b9979 NEW |
none[none] | none:none |
none|none | none | none | |
| 11:20:00 | Win2K-f | 61.8.64.173 (-): MASTER SYSTEM INFOTAMA, JAKARTA, JAKARTA RAYA, ID. (100Mbps) |
n/a | US:www.maxmind.com EU:getmyip.co.uk EU:checkip.dyndns.org :www.getmyip.org US:67.15.94.80:80 EU:78.40.35.134:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:11:39:00 | WinXP | 95.221.38.226 (-): FAIRLIE HOLDING & FINANCE LIMITED, MOSCOW, MOSCOW CITY, RU. (DSL) |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
34 of 34 | d20f157117 NEW |
738f555183 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:11:50:00 | WinXP | 92.86.88.171 (TELELINK-RO.COM): ARTELECOM, BUCHAREST, BUCURESTI, RO. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 43 | ad97e8accf NEW |
none[none] | none:none |
none|none | none | none |
| T:12:19:00 | WinXP | 79.163.215.133 (CENTERTEL.PL): PTK CENTERTEL BROADBAND SERVICES, PL. (DSL) |
n/a | RU:moscow-advokat.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
25 of 25 | 7f60162c2c NEW |
none[0] | none:none |
PolyEnE| | lines=93 embedded dns |
trace |
| T:12:19:00 | Win2K-f | 202.125.60.208 (CTT.NE.JP): CABLE TELEVISION TOYAMA INCORPORETED, TOYAMA, TOYAMA, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 43 41 of 43 |
95173a796c NEW c2f1f7d01e NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:12:26:00 | WinXP | 91.149.109.85 (SKYLINK.RU): CELLULAR COMMUNICATION OF CHERNOZEMYE STATIC IP POOL, RU. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
42 of 43 | 88f3393e20 NEW |
none[none] | none:none |
none|none | none | none |
| T:12:51:00 | WinXP | 174.39.141.56 (WINDSTREAM.NET): ALLTEL MIP CUSTOMERS - OMAHA, NORTH PLATTE, NEBRASKA, US. (DSL) |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
40 of 41 | d11b1f56f9 NEW |
none[none] | none:none |
none|none | none | none |
| T:13:07:00 | WinXP | 41.207.212.115 (10.AVISO.CI): AFRINIC, ABIDJAN, ABIDJAN, CI. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
34 of 34 | d20f157117 NEW |
738f555183 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| 14:01:00 | WinXP | 145.236.4.226 (TELEKOM.HU): HUNGARIAN TELECOMMUNICATIONS COMPANY LIMITED, BUDAPEST, BUDAPEST, HU. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
42 of 43 | 95d1a78f0d NEW |
none[none] | none:none |
none|none | none | none |
| 14:13:00 | Win2K-f | 119.92.50.246 (PLDT.NET): IPG, PH. (DSL) |
n/a | US:www.maxmind.com EU:getmyip.co.uk :www.getmyip.org EU:checkip.dyndns.org US:67.15.94.80:80 EU:78.40.35.134:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | dc331fb791 NEW |
none[3] | none:none |
UPX| | none | trace |
| T:14:22:00 | Win2K-f | 119.92.50.246 (PLDT.NET): IPG, PH. (DSL) |
n/a | US:www.maxmind.com EU:getmyip.co.uk US:www.vouchercodes.net :checkip.dyndns.org DE:131.220.6.26:80 |
445 | pcap | raw alerts ruleset |
http 67 lines |
Yeah : 0.8 profile |
none | summary tarball |
1 of 42 3 of 37 |
5cd577e2b5 NEW dc331fb791 NEW |
none[none] none [3] |
none:none none:none |
none|none UPX| |
none none |
none trace |
| T:14:36:00 | WinXP | 201.162.6.174 (CABLEXTREMO.COM.MX): CABLEVISION DE SALTILLO SA DE CV, MX. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
34 of 34 | d20f157117 NEW |
738f555183 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| 14:55:00 | WinXP | 114.26.145.45 (HINET.NET): CHTD CHUNGHWA TELECOM CO. LTD, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
39 of 41 | d8040f84d4 NEW |
d683995e84 [0] | ASM:Graph |
PolyEnE| | lines=73 | trace |
| T:15:12:00 | Win2K-f | 86.63.64.36 (COM.PL): ASTA-NET PILA POLAND, WARSAW, WARSZAWA, PL. (DSL) |
n/a | 139 | pcap | raw alerts ruleset |
ftp 12 lines |
Yeah : 0.8 profile |
none | summary tarball |
41 of 43 | a5d5c8ec12 NEW |
none[none] | none:none |
none|none | none | none | |
| T:15:15:00 | WinXP | 187.80.61.207 (CAMPUSEAI.ORG): COMITE GESTOR DA INTERNET NO BRASIL, BR. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| 15:26:00 | WinXP | 187.80.61.207 (CAMPUSEAI.ORG): COMITE GESTOR DA INTERNET NO BRASIL, BR. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:15:48:00 | WinXP | 151.81.177.236 (51-151.NET24.IT): IUNET-BNET, IT. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
42 of 43 | 10291a1bdb NEW |
none[none] | none:none |
none|none | none | none |
| T:16:21:00 | WinXP | 81.81.64.30 (WWW.E-COW.IT): WIND TELECOMUNICAZIONI S.P.A, ROME, LAZIO, IT. (DSL) |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 3 lines |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:16:49:00 | WinXP | 65.36.21.193 (GRANDENETWORKS.NET): GRANDE COMMUNICATIONS ODESSA HUB, SAN MARCOS, TEXAS, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:17:14:00 | Win2K-f | 210.0.207.190 (HUTCHCITY.COM): HUTCHISON GLOBAL COMMUNICATIONS, HONG KONG, HONG KONG (SAR), HK. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 39 of 41 |
0563ea7af7 NEW 7e1532574f NEW |
bc2e11a802 [0] e6930769d0[0] |
ASM:Graph ASM:Graph |
tElock| Armadillo| |
lines=65 embedded dns lines=91 |
trace trace |
| T:18:37:00 | WinXP | 186.180.46.18 (-): . |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
38 of 42 | 8a2553433c NEW |
none[none] | none:none |
none|none | none | none |
| T:19:13:00 | WinXP | 200.165.247.115 (STERLINGSTUDENTS.NET): COMITE GESTOR DA INTERNET NO BRASIL, BR. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 3 lines |
Yeah : 1.3 profile |
none | summary tarball |
42 of 42 | e17148b26b NEW |
none[none] | none:none |
none|none | none | none |
| T:19:16:00 | Win2K-f | 69.193.78.147 (RR.COM): ROAD RUNNER HOLDCO LLC, HERNDON, VIRGINIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| 19:16:00 | WinXP | 186.180.46.18 (-): . |
n/a | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| T:19:22:00 | WinXP | 173.25.93.250 (MCHSI.COM): MEDIACOM COMMUNICATIONS CORP, GOLD BAR, WASHINGTON, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| 20:28:00 | WinXP | 186.180.23.157 (-): . |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
32 of 43 | 3924c45dd8 NEW |
none[none] | none:none |
none|none | none | none |
| T:21:23:00 | WinXP | 175.112.215.180 (-): . |
60.190.222.139:65520 | EU:proxim.ircgalaxy.pl US:microsoft.com EU:ii.derquda.com EU:www.derquda.com EU:justnewleft.ru US:get.whitesmoke.com US:c0007083.cdn2.cloudfiles.rackspacecloud.com US:track.zugo.com US:components.zugo.com 109.196.134.25:80 US:208.111.148.6:80 CN:60.190.222.139:65520 |
135 | pcap | raw alerts ruleset |
irc http 157 lines |
Yeah : 1.8 profile |
none | summary tarball |
12 of 42 30 of 43 3 of 40 0 of 43 33 of 42 40 of 43 2 of 43 11 of 32 40 of 43 |
043621a659 NEW 1b8d9f2929 NEW 3759ddc041 NEW 5819395367 NEW 735053e788 NEW 92b7f99e20 NEW b2c1ecbb4e NEW cc18b85518 NEW ec7cec691c NEW |
none[none] none [none] none [none] none [none] none [none] none [none] none [none] none [none] none [none] |
none:none none:none none:none none:none none:none none:none none:none none:none none:none |
none|none none|none none|none none|none none|none none|none none|none none|none none|none |
none none none none none none none none none |
none none none none none none none none none |
| T:21:32:00 | WinXP | 164.132.19.196 (-): IUNET S.P.A, MILANO, LOMBARDIA, IT. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
39 of 41 | d8040f84d4 NEW |
d683995e84 [0] | ASM:Graph |
PolyEnE| | lines=73 | trace |
| T:21:37:00 | WinXP | 117.254.213.62 (STERLINGSTUDENTS.NET): NIB (NATIONAL INTERNET BACKBONE), NEW DELHI, DELHI, IN. (DSL) |
213.155.0.224:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
36 of 42 | e18a983c20 NEW |
none[none] | none:none |
none|none | none | none |
| T:21:37:00 | Win2K-f | 112.203.7.125 (PLDT.NET): IPG, PH. (DSL) |
n/a | :1.h8cbf.in | 135 | pcap | raw alerts ruleset |
other 224 lines |
Yeah : 1.3 profile |
none | summary tarball |
42 of 43 | 11ec6b462f NEW |
none[none] | none:none |
none|none | none | none |
| 21:46:00 | WinXP | 201.238.124.180 (TSTT.NET.TT): TELECOMMUNICATION SERVICES OF TRINIDAD AND TOBAGO, TT. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.0.224:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:22:57:00 | Win2K-f | 173.168.182.128 (RR.COM): ROAD RUNNER HOLDCO LLC, OLDSMAR, FLORIDA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 40 of 40 |
1761e9db94 NEW d1e83e2d0a NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |