|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| 11:00:00 | Win2K-f | 213.81.178.2 (TELECOM.SK): STATIC IP ASSIGNMENT, POPRAD, PRESOV, SK. (DSL) |
n/a | :www.maxmind.com :getmyip.co.uk :www.getmyip.org EU:checkip.dyndns.org 108.168.255.243:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| 11:12:00 | Win2K-f | 95.0.212.105 (-): TR-TELEKOM, ANKARA, ANKARA, TR. (DSL) |
n/a | :www.maxmind.com :www.getmyip.org US:checkip.dyndns.org :getmyip.co.uk 108.168.255.243:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none |
| 21:31:00 | Win2K-f | 213.153.221.28 (TELLCOM.COM.TR): SATELKO IZMIR RAS IP POOL, ANKARA, ANKARA, TR. (DSL) |
n/a | :www.maxmind.com :www.getmyip.org US:checkip.dyndns.org :getmyip.co.uk 108.168.255.243:80 EU:91.198.22.70:80 |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
none | none | none | none | none | none | none |