|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:03:37:00 | WinXP | 84.224.183.214 (PGSM.HU): PANNON GSM TELECOMMUNICATIONS INC, HU. (DSL) |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
40 of 42 | bcb3ec60f2 NEW |
none[none] | none:none |
none|none | none | none |
| T:05:37:00 | WinXP | 31.40.214.67 (-): . |
n/a | DE:citi-bank.ru DE:213.155.14.161:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
none | f0a0c88348 NEW |
none[none] | none:none |
none|none | none | none |
| T:06:41:00 | WinXP | 221.142.123.193 (HANANET.NET): HANARO TELECOM INC, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
114.112.255.81:65520 | CN:proxim.ircgalaxy.pl US:microsoft.com CN:ad.ghura.pl CN:2wrmbdaily.com :der099.com CN:ck.ddcxlayer.net :clubprotecterld.com US:www.aaxml.com CA:eyemasks.net CA:74.117.116.78:80 |
135 | pcap | raw alerts ruleset |
irc http http http 168 lines |
Yeah : 1.8 profile |
none | summary tarball |
none none none none none 33 of 42 none none 39 of 42 none |
0a4523e2da NEW 3c87cc076e NEW 42a5162551 NEW 5a8d417636 NEW 5bfaa8ef5b NEW 69f59a0454 NEW a3ea0a87e0 NEW d6c29fd556 NEW f4c93e7909 NEW ff5f5bc234 NEW |
none[none] none [none] none [none] none [none] none [none] none [none] none [none] none [none] none [none] none [none] |
none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none |
none|none none|none none|none none|none none|none none|none none|none none|none none|none none|none |
none none none none none none none none none none |
none none none none none none none none none none |
| T:08:20:00 | Win2K-f | 120.61.153.117 (BOL.NET.IN): MTNL CAT B ISP, NEW DELHI, DELHI, IN. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
none | f88d9cac8f NEW |
none[none] | none:none |
none|none | none | none | |
| T:09:56:00 | WinXP | 180.27.199.26 (OCN.NE.JP): NTT COMMUNICATIONS CORPORATION, JP. (DSL) |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
none | 4fb872b3d8 NEW |
none[none] | none:none |
none|none | none | none |
| T:10:26:00 | WinXP | 67.197.205.171 (COMPORIUM.NET): COMPORIUM COMMUNICATIONS, ROCK HILL, SOUTH CAROLINA, US. (DSL) |
213.155.14.161:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
41 of 43 | fb486908b0 NEW |
none[none] | none:none |
none|none | none | none |
| T:13:09:00 | WinXP | 72.0.163.205 (BENDBROADBAND.COM): BEND CABLE COMMUNICATIONS LLC, BEND, OREGON, US. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.14.161:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
none | 94227c2434 NEW |
none[none] | none:none |
none|none | none | none |
| T:14:58:00 | WinXP | 70.62.133.95 (RR.COM): ROAD RUNNER HOLDCO LLC, COLUMBUS, OHIO, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:15:43:00 | WinXP | 216.119.0.66 (DARIENTEL.NET): THE DARIEN TELEPHONE CO. INC, TOWNSEND, MASSACHUSETTS, US. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.14.161:80 |
445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 0.8 profile |
none | summary tarball |
none | be27c77fb5 NEW |
none[none] | none:none |
none|none | none | none |
| T:16:59:00 | WinXP | 93.102.51.211 (REV.OPTIMUS.PT): OPTIMUS PORTUGAL, PT. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.14.161:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
34 of 34 | d20f157117 NEW |
738f555183 [0] | ASM:Graph |
PolyEnE| | lines=68 | trace |
| T:17:03:00 | Win2K-f | 202.94.147.114 (-): CALNET CO. LTD, YOKOHAMA, KANAGAWA, JP. (100Mbps) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 120 lines |
Yeah : 1.3 profile |
none | summary tarball |
none 38 of 41 |
70c48e0cc8 NEW 761a66b891 NEW |
none[none] b469dac5dc[0] |
none:none ASM:Graph |
none|none tElock| |
none lines=64 embedded dns |
none trace |
| 18:00:00 | WinXP | 216.119.0.66 (DARIENTEL.NET): THE DARIEN TELEPHONE CO. INC, TOWNSEND, MASSACHUSETTS, US. (DSL) |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
none | be27c77fb5 NEW |
none[none] | none:none |
none|none | none | none |
| 19:10:00 | Win2K-f | 210.7.71.147 (DIRECT.NET.IN): TATA COMMUNICATIONS INTERNET SERVICES LTD, NEW DELHI, DELHI, IN. (DSL) |
n/a | :www.maxmind.com :getmyip.co.uk :www.getmyip.org US:checkip.dyndns.org DE:131.220.6.26:80 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:20:14:00 | WinXP | 4.182.164.12 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, NEW YORK, NEW YORK, US. (DIAL) |
n/a | DE:moscow-advokat.ru DE:82.98.86.164:6667 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
25 of 25 | 7f60162c2c NEW |
none[0] | none:none |
PolyEnE| | lines=93 embedded dns |
trace |
| T:22:16:00 | WinXP | 31.63.221.148 (-): . |
n/a | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |