|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:03:01:00 | WinXP | 188.214.220.43 (TIM.RO): JUMP NETWORK SERVICES S.R.L, RO. (DSL) |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
38 of 42 | 8a2553433c NEW |
none[none] | none:none |
none|none | none | none |
| T:03:39:00 | Win2K-f | 68.114.82.49 (CHARTER.COM): CHARTER COMMUNICATIONS, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:05:31:00 | WinXP | 176.59.218.152 (-): . |
n/a | DE:moscow-advokat.ru DE:82.98.86.164:6667 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
none | ba3012ac9f NEW |
none[none] | none:none |
none|none | none | none |
| T:08:31:00 | WinXP | 27.2.149.5 (-): . |
213.155.14.161:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
37 of 43 | ca3e3b13f3 NEW |
none[none] | none:none |
none|none | none | none |
| T:09:17:00 | WinXP | 222.232.195.65 (HANANET.NET): HANARO TELECOM INC, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
83.133.119.197:65520 | :proxima.ircgalaxy.pl US:microsoft.com :serf654.com EU:open-consulting-company.com :www.zzxml.com US:nevof.com :www.google-analytics.com US:images01.tzimg.com US:209.59.194.240:80 EU:91.217.162.94:80 |
135 | pcap | raw alerts ruleset |
irc http 160 lines |
Yeah : 1.8 profile |
none | summary tarball |
37 of 43 none 39 of 41 none 31 of 33 none |
69f32b85f1 NEW 8fd94dbad5 NEW ab9c4b5f21 NEW b11aed7093 NEW d789c8d157 NEW ff5f5bc234 NEW |
none[none] none [none] 5fe48b2dcc[0] none [none] 5f6572479f[0] none [none] |
none:none none:none ASM:Graph none:none ASM:Graph none:none |
none|none none|none Armadillo| none|none PolyEnE| none|none |
none none lines=42 none lines=113 embedded dns none |
none none trace none trace none |
| T:10:24:00 | WinXP | 68.114.61.35 (CHARTER.COM): CHARTER COMMUNICATIONS, BARRE, VERMONT, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 42 40 of 42 |
26fa50f7e1 NEW 28682ab74c NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:13:16:00 | Win2K-f | 120.138.128.3 (STARCAT.NE.JP): KMN CORPORATION, TOKYO, TOKYO, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 40 of 41 |
6a1dc43309 NEW 94e49d5627 NEW |
522dace6c1 [0] 777259292a[0] |
ASM:Graph ASM:Graph |
Armadillo| tElock| |
lines=91 lines=64 embedded dns |
trace trace |
| T:13:33:00 | WinXP | 87.14.142.219 (RETAIL.TELECOMITALIA.IT): TELECOM ITALIA S.P.A. TIN EASY LITE, MONZA, LOMBARDIA, IT. (DSL) |
n/a | DE:moscow-advokat.ru DE:82.98.86.164:6667 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
42 of 42 | d1e8440870 NEW |
none[none] | none:none |
none|none | none | none |
| T:15:26:00 | WinXP | 94.153.44.82 (KYIVSTAR.NET): UA-KYIVSTAR, KIEV, KYYIV, UA. (DSL) |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| 15:30:00 | WinXP | 87.14.142.219 (RETAIL.TELECOMITALIA.IT): TELECOM ITALIA S.P.A. TIN EASY LITE, MONZA, LOMBARDIA, IT. (DSL) |
n/a | DE:moscow-advokat.ru DE:82.98.86.164:6667 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
42 of 42 | d1e8440870 NEW |
none[none] | none:none |
none|none | none | none |
| T:16:41:00 | WinXP | 210.236.22.233 (MEGAEGG.NE.JP): ENERGIA COMMUNICATIONS INC, TAHARA, AICHI, JP. (DSL) |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
43 of 43 | debeecd50c NEW |
none[none] | none:none |
none|none | none | none |
| 17:07:00 | WinXP | 69.63.31.219 (NETINS.NET): MONTEZUMA MUTUAL TELEPHONE COMPANY, MONTEZUMA, IOWA, US. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.14.161:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
40 of 42 | 412a3c6dfe NEW |
none[none] | none:none |
none|none | none | none |
| T:20:01:00 | WinXP | 70.65.228.19 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, LETHBRIDGE, ALBERTA, CA. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 1029 lines |
Yeah : 1.3 profile |
none | summary tarball |
32 of 41 | 43b8f21924 NEW |
none[3] | none:none |
none|none | none | trace | |
| T:21:32:00 | Win2K-f | 65.111.104.152 (GRANDENETWORKS.NET): GRANDE COMMUNICATIONS SAN MARCOS, SAN MARCOS, TEXAS, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 41 38 of 41 |
d031b42d3f NEW fa14802705 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:21:56:00 | Win2K-f | 58.146.58.157 (STARCAT.NE.JP): KMN CORPORATION, NAGOYA, TOKYO, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 40 39 of 41 |
3f89b1ddee NEW 6b887aded4 NEW |
20017af26d [0] c28c1ffb6f[0] |
ASM:Graph ASM:Graph |
tElock| Armadillo| |
lines=64 embedded dns lines=91 |
trace trace |
| T:23:05:00 | WinXP | 221.121.243.222 (CCNW.NE.JP): CHUBU CABLE NETWORK COMPANY INCORPORATED, NAGOYA, TOKYO, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
0 of 32 33 of 33 |
07fabc79ef NEW 53bfe15e91 NEW |
none[0] 1473091351[0] |
none:none ASM:Graph |
Armadillo| tElock| |
lines=90 lines=75 embedded dns |
trace trace |