|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:05:21:00 | WinXP | 130.180.113.250 (BEA.COM): VARIOUS REGISTRIES, UK. (DSL) |
59.124.27.180:3305 | :cx10man.weedns.com :fx010413.whyI.org :gynoman.weedns.com TW:g.0x20.biz 208.87.35.103:3305 US:66.237.42.81:3305 |
135 | pcap | raw alerts ruleset |
shell ftp irc 22 lines |
Yeah : 1.8 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:06:05:00 | WinXP | 130.180.64.170 (BEA.COM): VARIOUS REGISTRIES, UK. (DSL) |
59.124.27.180:3305 | :cx10man.weedns.com GB:fx010413.whyI.org :gynoman.weedns.com JP:g.0x20.biz 208.87.35.103:3305 US:66.237.42.81:3305 |
135 | pcap | raw alerts ruleset |
shell ftp irc 22 lines |
Yeah : 1.8 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| 09:18:00 | Win2K-f | 187.19.203.107 (VELOXZONE.COM.BR): COMITE GESTOR DA INTERNET NO BRASIL, BR. (DSL) |
n/a | :www.maxmind.com :www.getmyip.org :getmyip.co.uk EU:checkip.dyndns.org DE:131.220.6.26:80 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
40 of 41 41 of 43 none 7 of 37 40 of 41 41 of 42 none 40 of 43 3 of 37 none none none 2 of 37 none none none 37 of 40 none none 43 of 43 5 of 37 31 of 32 none 26 of 28 39 of 42 none 38 of 42 4 of 37 3 of 37 38 of 41 none none 41 of 42 40 of 43 42 of 43 35 of 36 none none 40 of 41 37 of 43 34 of 34 2 of 37 none 3 of 37 40 of 42 34 of 41 29 of 29 41 of 42 41 of 43 41 of 42 |
01c4a6b3eb NEW 048b720afe NEW 085f286a6f NEW 08f384b76a NEW 1096ba143e NEW 22340630ac NEW 267b33fd90 NEW 283970c2d1 NEW 2daf861bde NEW 33a806c2c2 NEW 3679444e79 NEW 37cbbcb33e NEW 409ef22885 NEW 48048cfbf5 NEW 4eb2a4de70 NEW 51529da007 NEW 5285741560 NEW 56950ee6b1 NEW 656ea74fff NEW 6ffc4847e4 NEW 741c93f3c1 NEW 741e3b03b3 NEW 765c35504c NEW 7d99b0e910 NEW 8689eac5d3 NEW 8883bbf19e NEW 8a2553433c NEW 8ce32ded17 NEW 917c085aca NEW 9276456bf8 NEW 94227c2434 NEW 9ebcc2e373 NEW a4140e4032 NEW ac1d14519f NEW b269b15ffd NEW b27d73bfcb NEW b76758d4ca NEW b7f91029e4 NEW bb460ddce2 NEW ca3e3b13f3 NEW d20f157117 NEW d60e538e72 NEW d6b1899047 NEW d9cb288f31 NEW de4624560d NEW deffdf68e8 NEW df17a625ee NEW e99261ba46 NEW fb486908b0 NEW ff90c1ff00 NEW |
dd524b0259 [0] none [none] none [none] none [3] none [none] none [none] none [none] none [none] none [3] none [none] none [none] none [none] none [3] none [none] none [none] none [none] 60590b8b67[0] none [none] none [none] none [none] none [3] none [0] none [none] none [0] none [none] none [none] none [none] none [3] none [3] none [none] none [none] none [none] none [none] none [none] none [none] 473c6454ce[0] none [none] none [none] none [none] none [none] 738f555183[0] none [3] none [none] 45603a001c[0] none [none] 2b011e15ba[0] none [0] none [none] none [none] none [none] |
ASM:Graph none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none ASM:Graph none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none ASM:Graph none:none none:none none:none none:none ASM:Graph none:none none:none ASM:Graph none:none ASM:Graph none:none none:none none:none none:none |
PolyEnE| none|none none|none MEW| none|none none|none none|none none|none Armadillo| none|none none|none none|none UPX| none|none none|none none|none none|none none|none none|none none|none UPX| none|none none|none PolyEnE| none|none none|none none|none Armadillo| Armadillo| none|none none|none none|none none|none none|none none|none PolyEnE| none|none none|none none|none none|none PolyEnE| UPX| none|none UPX| none|none StarForce| ASPack| none|none none|none none|none |
lines=68 none none none none none none none none none none none none none none none lines=59 none none none none lines=61 none lines=68 none none none none none none none none none none none lines=68 none none none none lines=68 none none lines=174 embedded dns none lines=3122 embedded dns lines=298 embedded dns none none none |
trace none none trace none none none none trace none none none trace none none none trace none none none trace trace none trace none none none trace trace none none none none none none trace none none none none trace trace none trace none trace trace none none none |
| 09:56:00 | WinXP | 91.201.121.83 (MIKOLOW.NET): MICONET, WARSAW, WARSZAWA, PL. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.14.161:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
40 of 41 41 of 43 none 7 of 37 40 of 41 41 of 42 none 40 of 43 3 of 37 none none none 2 of 37 none none none 37 of 40 none none 43 of 43 5 of 37 31 of 32 none 26 of 28 39 of 42 none 38 of 42 4 of 37 3 of 37 38 of 41 none none 41 of 42 40 of 43 42 of 43 35 of 36 none none 40 of 41 37 of 43 34 of 34 2 of 37 none 3 of 37 40 of 42 34 of 41 29 of 29 41 of 42 41 of 43 41 of 42 |
01c4a6b3eb NEW 048b720afe NEW 085f286a6f NEW 08f384b76a NEW 1096ba143e NEW 22340630ac NEW 267b33fd90 NEW 283970c2d1 NEW 2daf861bde NEW 33a806c2c2 NEW 3679444e79 NEW 37cbbcb33e NEW 409ef22885 NEW 48048cfbf5 NEW 4eb2a4de70 NEW 51529da007 NEW 5285741560 NEW 56950ee6b1 NEW 656ea74fff NEW 6ffc4847e4 NEW 741c93f3c1 NEW 741e3b03b3 NEW 765c35504c NEW 7d99b0e910 NEW 8689eac5d3 NEW 8883bbf19e NEW 8a2553433c NEW 8ce32ded17 NEW 917c085aca NEW 9276456bf8 NEW 94227c2434 NEW 9ebcc2e373 NEW a4140e4032 NEW ac1d14519f NEW b269b15ffd NEW b27d73bfcb NEW b76758d4ca NEW b7f91029e4 NEW bb460ddce2 NEW ca3e3b13f3 NEW d20f157117 NEW d60e538e72 NEW d6b1899047 NEW d9cb288f31 NEW de4624560d NEW deffdf68e8 NEW df17a625ee NEW e99261ba46 NEW fb486908b0 NEW ff90c1ff00 NEW |
dd524b0259 [0] none [none] none [none] none [3] none [none] none [none] none [none] none [none] none [3] none [none] none [none] none [none] none [3] none [none] none [none] none [none] 60590b8b67[0] none [none] none [none] none [none] none [3] none [0] none [none] none [0] none [none] none [none] none [none] none [3] none [3] none [none] none [none] none [none] none [none] none [none] none [none] 473c6454ce[0] none [none] none [none] none [none] none [none] 738f555183[0] none [3] none [none] 45603a001c[0] none [none] 2b011e15ba[0] none [0] none [none] none [none] none [none] |
ASM:Graph none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none ASM:Graph none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none ASM:Graph none:none none:none none:none none:none ASM:Graph none:none none:none ASM:Graph none:none ASM:Graph none:none none:none none:none none:none |
PolyEnE| none|none none|none MEW| none|none none|none none|none none|none Armadillo| none|none none|none none|none UPX| none|none none|none none|none none|none none|none none|none none|none UPX| none|none none|none PolyEnE| none|none none|none none|none Armadillo| Armadillo| none|none none|none none|none none|none none|none none|none PolyEnE| none|none none|none none|none none|none PolyEnE| UPX| none|none UPX| none|none StarForce| ASPack| none|none none|none none|none |
lines=68 none none none none none none none none none none none none none none none lines=59 none none none none lines=61 none lines=68 none none none none none none none none none none none lines=68 none none none none lines=68 none none lines=174 embedded dns none lines=3122 embedded dns lines=298 embedded dns none none none |
trace none none trace none none none none trace none none none trace none none none trace none none none trace trace none trace none none none trace trace none none none none none none trace none none none none trace trace none trace none trace trace none none none |
| T:10:02:00 | WinXP | 173.27.247.31 (MCHSI.COM): MEDIACOM COMMUNICATIONS CORP, STREAMWOOD, ILLINOIS, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 111 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:10:25:00 | WinXP | 27.63.181.182 (-): . |
213.155.14.161:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 3 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:12:52:00 | WinXP | 109.98.101.33 (JWS.COM): EU-ZZ, UK. (DSL) |
213.155.14.161:80 | DE:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 41 of 43 none 7 of 37 40 of 41 41 of 42 none 40 of 43 3 of 37 none none none 2 of 37 none none none 37 of 40 none none 43 of 43 5 of 37 31 of 32 none 26 of 28 39 of 42 none 38 of 42 4 of 37 3 of 37 38 of 41 none none 41 of 42 40 of 43 42 of 43 35 of 36 none none 40 of 41 37 of 43 34 of 34 2 of 37 none 3 of 37 40 of 42 34 of 41 29 of 29 41 of 42 41 of 43 41 of 42 |
01c4a6b3eb NEW 048b720afe NEW 085f286a6f NEW 08f384b76a NEW 1096ba143e NEW 22340630ac NEW 267b33fd90 NEW 283970c2d1 NEW 2daf861bde NEW 33a806c2c2 NEW 3679444e79 NEW 37cbbcb33e NEW 409ef22885 NEW 48048cfbf5 NEW 4eb2a4de70 NEW 51529da007 NEW 5285741560 NEW 56950ee6b1 NEW 656ea74fff NEW 6ffc4847e4 NEW 741c93f3c1 NEW 741e3b03b3 NEW 765c35504c NEW 7d99b0e910 NEW 8689eac5d3 NEW 8883bbf19e NEW 8a2553433c NEW 8ce32ded17 NEW 917c085aca NEW 9276456bf8 NEW 94227c2434 NEW 9ebcc2e373 NEW a4140e4032 NEW ac1d14519f NEW b269b15ffd NEW b27d73bfcb NEW b76758d4ca NEW b7f91029e4 NEW bb460ddce2 NEW ca3e3b13f3 NEW d20f157117 NEW d60e538e72 NEW d6b1899047 NEW d9cb288f31 NEW de4624560d NEW deffdf68e8 NEW df17a625ee NEW e99261ba46 NEW fb486908b0 NEW ff90c1ff00 NEW |
dd524b0259 [0] none [none] none [none] none [3] none [none] none [none] none [none] none [none] none [3] none [none] none [none] none [none] none [3] none [none] none [none] none [none] 60590b8b67[0] none [none] none [none] none [none] none [3] none [0] none [none] none [0] none [none] none [none] none [none] none [3] none [3] none [none] none [none] none [none] none [none] none [none] none [none] 473c6454ce[0] none [none] none [none] none [none] none [none] 738f555183[0] none [3] none [none] 45603a001c[0] none [none] 2b011e15ba[0] none [0] none [none] none [none] none [none] |
ASM:Graph none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none ASM:Graph none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none ASM:Graph none:none none:none none:none none:none ASM:Graph none:none none:none ASM:Graph none:none ASM:Graph none:none none:none none:none none:none |
PolyEnE| none|none none|none MEW| none|none none|none none|none none|none Armadillo| none|none none|none none|none UPX| none|none none|none none|none none|none none|none none|none none|none UPX| none|none none|none PolyEnE| none|none none|none none|none Armadillo| Armadillo| none|none none|none none|none none|none none|none none|none PolyEnE| none|none none|none none|none none|none PolyEnE| UPX| none|none UPX| none|none StarForce| ASPack| none|none none|none none|none |
lines=68 none none none none none none none none none none none none none none none lines=59 none none none none lines=61 none lines=68 none none none none none none none none none none none lines=68 none none none none lines=68 none none lines=174 embedded dns none lines=3122 embedded dns lines=298 embedded dns none none none |
trace none none trace none none none none trace none none none trace none none none trace none none none trace trace none trace none none none trace trace none none none none none none trace none none none none trace trace none trace none trace trace none none none |
| T:13:06:00 | WinXP | 173.212.35.24 (-): . |
n/a | DE:moscow-advokat.ru DE:82.98.86.164:6667 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| 14:05:00 | WinXP | 109.98.101.33 (JWS.COM): EU-ZZ, UK. (DSL) |
n/a | DE:citi-bank.ru DE:213.155.14.161:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
40 of 41 41 of 43 none 7 of 37 40 of 41 41 of 42 none 40 of 43 3 of 37 none none none 2 of 37 none none none 37 of 40 none none 43 of 43 5 of 37 31 of 32 none 26 of 28 39 of 42 none 38 of 42 4 of 37 3 of 37 38 of 41 none none 41 of 42 40 of 43 42 of 43 35 of 36 none none 40 of 41 37 of 43 34 of 34 2 of 37 none 3 of 37 40 of 42 34 of 41 29 of 29 41 of 42 41 of 43 41 of 42 |
01c4a6b3eb NEW 048b720afe NEW 085f286a6f NEW 08f384b76a NEW 1096ba143e NEW 22340630ac NEW 267b33fd90 NEW 283970c2d1 NEW 2daf861bde NEW 33a806c2c2 NEW 3679444e79 NEW 37cbbcb33e NEW 409ef22885 NEW 48048cfbf5 NEW 4eb2a4de70 NEW 51529da007 NEW 5285741560 NEW 56950ee6b1 NEW 656ea74fff NEW 6ffc4847e4 NEW 741c93f3c1 NEW 741e3b03b3 NEW 765c35504c NEW 7d99b0e910 NEW 8689eac5d3 NEW 8883bbf19e NEW 8a2553433c NEW 8ce32ded17 NEW 917c085aca NEW 9276456bf8 NEW 94227c2434 NEW 9ebcc2e373 NEW a4140e4032 NEW ac1d14519f NEW b269b15ffd NEW b27d73bfcb NEW b76758d4ca NEW b7f91029e4 NEW bb460ddce2 NEW ca3e3b13f3 NEW d20f157117 NEW d60e538e72 NEW d6b1899047 NEW d9cb288f31 NEW de4624560d NEW deffdf68e8 NEW df17a625ee NEW e99261ba46 NEW fb486908b0 NEW ff90c1ff00 NEW |
dd524b0259 [0] none [none] none [none] none [3] none [none] none [none] none [none] none [none] none [3] none [none] none [none] none [none] none [3] none [none] none [none] none [none] 60590b8b67[0] none [none] none [none] none [none] none [3] none [0] none [none] none [0] none [none] none [none] none [none] none [3] none [3] none [none] none [none] none [none] none [none] none [none] none [none] 473c6454ce[0] none [none] none [none] none [none] none [none] 738f555183[0] none [3] none [none] 45603a001c[0] none [none] 2b011e15ba[0] none [0] none [none] none [none] none [none] |
ASM:Graph none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none ASM:Graph none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none none:none ASM:Graph none:none none:none none:none none:none ASM:Graph none:none none:none ASM:Graph none:none ASM:Graph none:none none:none none:none none:none |
PolyEnE| none|none none|none MEW| none|none none|none none|none none|none Armadillo| none|none none|none none|none UPX| none|none none|none none|none none|none none|none none|none none|none UPX| none|none none|none PolyEnE| none|none none|none none|none Armadillo| Armadillo| none|none none|none none|none none|none none|none none|none PolyEnE| none|none none|none none|none none|none PolyEnE| UPX| none|none UPX| none|none StarForce| ASPack| none|none none|none none|none |
lines=68 none none none none none none none none none none none none none none none lines=59 none none none none lines=61 none lines=68 none none none none none none none none none none none lines=68 none none none none lines=68 none none lines=174 embedded dns none lines=3122 embedded dns lines=298 embedded dns none none none |
trace none none trace none none none none trace none none none trace none none none trace none none none trace trace none trace none none none trace trace none none none none none none trace none none none none trace trace none trace none trace trace none none none |
| T:16:38:00 | WinXP | 122.146.243.51 (SPARQNET.NET): NEW CENTRY INFOCOM TECH. CO. LTD, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 92 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| T:18:31:00 | Win2K-f | 70.183.98.170 (COX.NET): COX COMMUNICATIONS, CHULA VISTA, CALIFORNIA, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 1008 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none |