Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

29 May 2012
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:01:19:00 WinXP 82.60.66.69 (RETAIL.TELECOMITALIA.IT):
TELECOM ITALIA NET,
MILANO, LOMBARDIA, IT. (DSL) n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none bf51b53672
NEW none[none] none:none
none|none none none

T:09:06:00 WinXP 31.207.134.100 (-):
. n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 41 18069de9ed
NEW none[none] none:none
none|none none none

T:09:12:00 WinXP 91.64.40.140 (SUPERKABEL.DE):
KABEL-DEUTSCHLAND-CUSTOMER-SERVICES,
HAMBURG, HAMBURG, DE. (DSL) n/a DE:moscow-advokat.ru
DE:82.98.86.164:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 42 of 43 1511a3f219
NEW none[none] none:none
none|none none none

T:09:27:00 WinXP 109.54.194.159 (JWS.COM):
EU-ZZ,
UK. (DSL) n/a DE:citi-bank.ru
DE:213.155.14.161:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 40 of 41 01c4a6b3eb
NEW dd524b0259 [0] ASM:Graph
PolyEnE| lines=68 trace

T:09:57:00 WinXP 31.40.202.97 (-):
. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:12:05:00 WinXP 92.41.148.42 (THREE.CO.UK):
MOBILE BROADBAND SERVICE,
UK. (DSL) n/a DE:moscow-advokat.ru
DE:82.98.86.164:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 41 of 43 048b720afe
NEW none[none] none:none
none|none none none

T:12:23:00 WinXP 61.218.136.162 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
132 lines Yeah : 1.3
profile none summary
tarball 38 of 41
38 of 41 10eebdc28e
NEW
761a66b891
NEW e2ca2da35d [0]
b469dac5dc[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:12:38:00 WinXP 46.109.73.31 (-):
. n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 41 of 43 67db574df4
NEW none[none] none:none
none|none none none

T:12:42:00 WinXP 178.24.184.62 (FINEBLANK.COM):
EU-ZZ,
UK. (DSL) n/a DE:citi-bank.ru
DE:213.155.14.161:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 42 of 42 0c3e031d4a
NEW none[none] none:none
none|none none none

T:14:29:00 WinXP 188.173.222.221 (RIPE.NET):
EUROPEAN REGIONAL REGISTRY,
UK. (DSL) n/a DE:citi-bank.ru
DE:213.155.14.161:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 41 of 44 dd0a92984c
NEW none[none] none:none
none|none none none

T:14:32:00 WinXP 216.119.0.66 (DARIENTEL.NET):
THE DARIEN TELEPHONE CO. INC,
TOWNSEND, MASSACHUSETTS, US. (DSL) 213.155.14.161:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.8
profile none summary
tarball none be27c77fb5
NEW none[none] none:none
none|none none none

T:15:22:00 WinXP 4.170.249.86 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
MIAMI, FLORIDA, US. (DSL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:16:42:00 WinXP 186.80.194.41 (CABLE.NET.CO):
TV CABLE S.A,
SANTAFé DE BOGOTá, DISTRITO ESPECIAL, CO. (DSL) 213.155.14.161:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:16:52:00 WinXP 173.19.212.186 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
IOWA CITY, IOWA, US. (DSL) n/a :gg.arrancar.org
199.59.166.108:555 135 pcap raw alerts
ruleset other
186 lines Yeah : 1.3
profile none summary
tarball 41 of 43 0afff56a4c
NEW none[none] none:none
none|none none none

T:20:23:00 Win2K-f 70.78.162.112 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
TORONTO, ONTARIO, CA. (DSL) n/a 135 pcap raw alerts
ruleset other
186 lines Yeah : 1.3
profile none summary
tarball 40 of 41 f3932b94a6
NEW 910494cc45 [0] ASM:Graph
none|none lines=546 trace

T:21:23:00 Win2K-f 210.0.207.190 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) n/a 135 pcap raw alerts
ruleset other
1093 lines Yeah : 1.3
profile none summary
tarball 37 of 42 73ea935efa
NEW none[none] none:none
none|none none none