Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

15 February 2011
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:42:00 Win2K-f 211.124.227.213 (ZAQ.NE.JP):
K CABLE TELEVISION CORPORATION INC,
TOKYO, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:01:31:00 Win2K-f 61.198.97.237 (THN.NE.JP):
TOKAI CORPORATION,
FUJI, SHIZUOKA, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:01:48:00 WinXP 79.163.238.253 (CENTERTEL.PL):
PTK CENTERTEL BROADBAND SERVICES,
PL. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:02:51:00 WinXP 211.20.90.193 (HINET.NET):
TAOYUAN JING KAO COMMUNITY,
TAOYUAN, T'AI-WAN, TW. (100Mbps) n/a 135 pcap raw alerts
ruleset other
19 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:03:01:00 WinXP 188.192.120.61 (SUPERKABEL.DE):
KABEL-DEUTSCHLAND-CUSTOMER-SERVICES,
DE. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:04:43:00 Win2K-f 122.149.104.124 (DODO.COM.AU):
LAYER 2 BROADBAND CUSTOMER NETWORK,
AU. (DSL) n/a 135 pcap raw alerts
ruleset other
358 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:05:02:00 WinXP 4.90.7.223 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
HAWKINS, TEXAS, US. (DIAL) n/a 135 pcap raw alerts
ruleset other
170 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:05:02:00 WinXP 93.102.200.45 (REV.OPTIMUS.PT):
OPTIMUS PORTUGAL,
PT. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:05:20:00 WinXP 117.20.144.92 (-):
STARHUB HSPA,
SINGAPORE, SINGAPORE, SG. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:06:00:00 WinXP 109.55.163.74 (JWS.COM):
EU-ZZ,
UK. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:06:51:00 WinXP 121.120.226.176 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:07:40:00 WinXP 115.165.83.29 (CATV02.ITSCOM.JP):
ITS COMMUNICATIONS INC,
KAWASAKI, KANAGAWA, JP. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:08:07:00 WinXP 219.85.86.145 (SO-NET.NET.TW):
SONY NETWORK TAIWAN LIMITED,
TAIPEI, T'AI-PEI, TW. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:08:33:00 Win2K-f 113.254.195.210 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) n/a 135 pcap raw alerts
ruleset other
184 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:09:16:00 WinXP 96.48.240.77 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SURREY, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
117 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:09:52:00 WinXP 110.50.132.27 (-):
VIBO TELECOM INC,
TAIPEI, T'AI-PEI, TW. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:10:16:00 WinXP 121.121.142.129 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:11:05:00 WinXP 87.119.34.46 (NET.PL):
COMMERCIAL IP NETWORK MNI TELECOM S.A,
WARSAW, WARSZAWA, PL. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:11:14:00 WinXP 50.9.58.248 (-):
. n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:12:40:00 WinXP 112.78.88.107 (-):
VIBO TELECOM INC,
TAIPEI, T'AI-PEI, TW. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:13:39:00 Win2K-f 72.45.22.137 (ATLANTICBB.NET):
ATLANTIC BROADBAND,
ESSEX, MASSACHUSETTS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:13:59:00 WinXP 46.202.222.95 (-):
. n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:15:21:00 WinXP 200.100.140.51 (TELESP.NET.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
SãO PAULO, SAO PAULO, BR. (DIAL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:15:26:00 WinXP 206.126.123.80 (KARIBCABLE.COM):
KARIB CABLE,
KINGSTOWN, SAINT GEORGE, VC. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:18:39:00 WinXP 186.24.165.84 (-):
. n/a DE:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:18:44:00 WinXP 190.105.28.171 (NET.AR):
VER TV S.A,
BUENOS AIRES, BUENOS AIRES, AR. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:18:51:00 Win2K-f 71.71.203.158 (RR.COM):
ROAD RUNNER HOLDCO LLC,
CHARLOTTE, NORTH CAROLINA, US. (100Mbps) 83.133.119.197:65520 CN:proxim.ircgalaxy.pl
US:microsoft.com
CN:lb.perfectexe.com
EU:www.derquda.com
CN:122.224.6.48:88
EU:91.193.194.114:80 135 pcap raw alerts
ruleset irc
139 lines Yeah : 1.8
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:19:32:00 Win2K-f 211.124.232.104 (ZAQ.NE.JP):
K CABLE TELEVISION CORPORATION INC,
OSAKA, OSAKA, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:20:37:00 WinXP 65.50.52.192 (BILTMORECOMMUNICATIONS.NET):
DIRECPATH LLC,
ATLANTA, GEORGIA, US. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:21:05:00 Win2K-f 65.111.124.188 (GRANDENETWORKS.NET):
GRANDE COMMUNICATIONS WACO HUB,
WACO, TEXAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:22:09:00 WinXP 206.126.123.80 (KARIBCABLE.COM):
KARIB CABLE,
KINGSTOWN, SAINT GEORGE, VC. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:22:21:00 Win2K-f 61.218.205.52 (HINET.NET):
TAIWAN PROVINCE TAP-WATER CO. LTD,
KAOHSIUNG, T'AI-WAN, TW. (100Mbps) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:22:39:00 Win2K-f 219.254.234.66 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
95 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:23:15:00 WinXP 115.241.190.155 (PHOTONINFOTECH.COM):
RELIANCE COMMUNICATIONS LTD,
MEERUT, UTTAR PRADESH, IN. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
97 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace

T:23:30:00 WinXP 77.20.98.160 (SUPERKABEL.DE):
KABEL-DEUTSCHLAND-CUSTOMER-SERVICES,
BERLIN, BERLIN, DE. (DSL) n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:23:35:00 WinXP 24.79.95.60 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
WINNIPEG, MANITOBA, CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
123 lines Yeah : 1.3
profile none summary
tarball 0 of 32 d41d8cd98f
NEW none[3] ASM:Graph
none|none lines=0 trace