Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

17 October 2011
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:19:00 WinXP 110.12.71.87 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 83.133.119.197:65520 :proxim.ircgalaxy.pl
US:microsoft.com
CN:sb.letmedo.net
CN:w.nucleardiscover.com
EU:huyechek.com
CN:hn.yigeyuming.com
RU:sedsed1.com
:a.95622.com
CN:ru.letmedo.net
174.123.157.154:80
EU:91.226.97.54:80 135 pcap raw alerts
ruleset irc
http
135 lines Yeah : 1.8
profile none summary
tarball 35 of 43
35 of 43
37 of 43
29 of 32
28 of 32
16 of 44 3129f5662b
NEW
595430f951
NEW
69f32b85f1
NEW
8a75955033
NEW
9276c8b36b
NEW
f593071f74
NEW none[none]
none [none]
none [none]
2bf3e548b9[0]
none [0]
none [none] none:none
none:none
none:none
ASM:Graph
none:none
none:none
none|none
none|none
none|none
tElock|
Armadillo|
none|none none
none
none
lines=126
embedded dns
lines=90
none none
none
none
trace
trace
none

T:01:24:00 WinXP 188.176.70.26 (DSL.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
DK. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 32 of 32 b502f83a7c
NEW 28f5be93b0 [0] ASM:Graph
PolyEnE| lines=73 trace

01:34:00 WinXP 176.59.156.110 (-):
. n/a DE:citi-bank.ru
DE:213.155.14.161:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 42 c9ee7be5fa
NEW none[none] none:none
none|none none none

05:04:00 WinXP 178.46.200.249 (FINEBLANK.COM):
EU-ZZ,
UK. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 42 d0c8854c1e
NEW none[none] none:none
none|none none none

T:06:27:00 WinXP 31.18.144.28 (-):
. n/a DE:citi-bank.ru
DE:213.155.14.161:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 42 of 43 5f186aa322
NEW none[none] none:none
none|none none none

T:06:51:00 WinXP 178.124.126.171 (FINEBLANK.COM):
EU-ZZ,
UK. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
NEW none[0] none:none
none|none lines=60 trace

T:06:51:00 Win2K-f 4.191.54.128 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
PORTLAND, OREGON, US. (DIAL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 37 of 41
36 of 40 47d3548e36
NEW
d8722af110
NEW ab13346633 [0]
ab30a55931[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:08:15:00 WinXP 70.165.19.225 (COX.NET):
COX COMMUNICATIONS,
OKLAHOMA CITY, OKLAHOMA, US. (DSL) 83.133.119.197:65520 :proxim.ircgalaxy.pl
US:microsoft.com
CN:sb.letmedo.net
CN:w.nucleardiscover.com
CN:hn.yigeyuming.com
:a.95622.com
CN:ru.letmedo.net
CN:myck.nucleardiscover.com
CN:122.224.6.164:82
CN:60.190.223.60:888 135 pcap raw alerts
ruleset irc
http
135 lines Yeah : 1.8
profile none summary
tarball 39 of 42
15 of 42
none
4 of 41
35 of 43
37 of 43
16 of 44 220c0b183d
NEW
3420de55b8
NEW
40a82f045f
NEW
4be1c730de
NEW
595430f951
NEW
69f32b85f1
NEW
f593071f74
NEW none[none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none] none:none
none:none
none:none
none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none
none|none
none|none
none|none none
none
none
none
none
none
none none
none
none
none
none
none
none

T:09:23:00 Win2K-f 61.215.144.153 (CABLENET.NE.JP):
CABLENET SAITAMA CO. LTD,
TOKYO, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 38 of 41
38 of 41 10eebdc28e
NEW
761a66b891
NEW e2ca2da35d [0]
b469dac5dc[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:11:31:00 WinXP 173.28.152.17 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
CHANHASSEN, MINNESOTA, US. (DSL) n/a :siliconfireware.ru
:wpad
:www.proxy-socks.net 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 df17a625ee
NEW none[0] none:none
ASPack| lines=298
embedded dns trace

11:34:00 Win2K-f 122.160.71.49 (122.AIRTELBROADBAND.IN):
ABTS-DSL-DEL,
NEW DELHI, DELHI, IN. (DSL) n/a US:www.maxmind.com
:www.getmyip.org
:getmyip.co.uk
EU:checkip.dyndns.org
DE:131.220.6.26:80 445 pcap raw alerts
ruleset http
5 lines Yeah : 0.8
profile none summary
tarball 2 of 37 223d8089f8
NEW none[3] none:none
StarForce| none trace

T:11:50:00 WinXP 193.93.110.216 (GRAT.NET.UA):
GRAT NETWORK INTERNET SERVICE PROVIDER,
KIEV, KYYIV, UA. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 40 of 41 1d0ce31c6d
NEW none[none] none:none
none|none none none

T:12:19:00 WinXP 59.113.163.136 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) 213.155.14.161:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 35 of 42 7e7a9115ba
NEW none[none] none:none
none|none none none

T:12:22:00 Win2K-f 49.133.48.163 (-):
. n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 41 of 44
41 of 44 99f212a9df
NEW
9fa81e360b
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:12:22:00 WinXP 190.227.147.230 (NET.AR):
TELECOM PERSONAL BS AS,
AR. (DSL) n/a :siliconfireware.ru
:wpad
RU:ebookfinaltrash.ru
:www.bankofmadura.com 445 pcap raw alerts
ruleset http
http
3 lines Yeah : 0.8
profile none summary
tarball 29 of 29 df17a625ee
NEW none[0] none:none
ASPack| lines=298
embedded dns trace

T:12:30:00 WinXP 59.103.195.16 (PIE.NET.PK):
PAKISTAN TELECOMMUNICATION COMPANY LIMITED,
ISLAMABAD, ISLAMABAD, PK. (DSL) 213.155.14.161:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:13:04:00 WinXP 109.52.176.232 (JWS.COM):
EU-ZZ,
UK. (DSL) n/a :siliconfireware.ru
:www.proxy-socks.net
:wpad 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
NEW none[0] none:none
ASPack| lines=281
embedded dns trace

T:13:36:00 Win2K-f 58.146.10.85 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:14:40:00 WinXP 67.213.206.252 (ARTELCO.COM):
WORLD LYNX,
CLINTON, ARKANSAS, US. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 41 of 42 ff90c1ff00
NEW none[none] none:none
none|none none none

15:20:00 WinXP 59.103.195.16 (PIE.NET.PK):
PAKISTAN TELECOMMUNICATION COMPANY LIMITED,
ISLAMABAD, ISLAMABAD, PK. (DSL) n/a DE:citi-bank.ru
DE:213.155.14.161:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:15:48:00 WinXP 200.70.144.84 (COM.AR):
TELEFONICA DATA ARGENTINA S.A,
BUENOS AIRES, BUENOS AIRES, AR. (DSL) 213.155.14.161:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 a92e3f8fc8
NEW none[0] none:none
PolyEnE| lines=68 trace

16:07:00 WinXP 151.59.62.108 (51-151.NET24.IT):
IUNET-BNET,
MILANO, LOMBARDIA, IT. (DSL) n/a DE:citi-bank.ru
DE:213.155.14.161:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 41 of 43 fb486908b0
NEW none[none] none:none
none|none none none

17:53:00 WinXP 62.169.80.233 (REV.OPTIMUS.PT):
OPTIMUS PORTUGAL,
LISBON, LISBOA, PT. (DSL) n/a DE:citi-bank.ru
DE:213.155.14.161:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 41 of 43 fb486908b0
NEW none[none] none:none
none|none none none

T:17:59:00 Win2K-f 24.234.229.17 (COX.NET):
COX COMMUNICATIONS INC,
LAS VEGAS, NEVADA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

20:09:00 Win2K-f 119.92.50.242 (PLDT.NET):
IPG,
PH. (DSL) n/a US:www.maxmind.com
US:checkip.dyndns.org
US:208.43.124.51:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 3 of 37 dc331fb791
NEW none[3] none:none
UPX| none trace

T:20:39:00 WinXP 24.155.22.128 (GRANDENETWORKS.NET):
CLEARSOURCE INC,
SAN ANTONIO, TEXAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 38 of 41
38 of 41 d031b42d3f
NEW
fa14802705
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none