| Pattern | Number of
samples | Target OS | Infection port | Listen ports | Snort IDs | Egg-download
ports | Upload ports | Antivirus labels | Processes created | Executables modified | MD5 (packed) | Registry keys | FTP chatter | HTTP chatter | Domain names |
| AUG-SEP-A | 1115 | WinXP (100%) | 445 (100%) | - | 1:2000032 (100%)
1:2000033 (100%)
1:2466 (100%)
1:99913 (100%)
1:2001683 (100%)
1:3000000 (100%)full list | 445 (99%)
1032 (93%) | 1032 (93%) | korgo (100%)
padobot (100%)
lsabot (98%) | MSMSGS.EXE (100%)
random 5/6/7/8
character filename | ftpupd.exe (100%)
random 5/6/7/8
character filename | 7d99b0... (48%)
a0139d... (8%)
3ae357... (8%)
1fcc14... (5%)full list | ...Microsoft\Wireless (100%) full list | - | - | - |
| AUG-SEP-B | 527 | Win2K-f (75%)
WinXP (25%) | 445 (99%) | 44445 (99%)
135 (75%)
500 (75%)
1026 (75%) | 1:2000032 (100%)
1:2466 (100%)
1:3000004 (99%)
1:5001684 (97%)
1:2001683 (95%)
1:2000046 (75%)full list | 68 (67%) | 44445 (99%) | sdbot (97%)
spybot (97%)
rbot (96%)
mybot (91%)
sdbo (89%) | MSMSGS.EXE (32%)
random 9
character filename | Abort (73%)
random 17
character filename | 7fdfe3... (67%)
None (22%)full list | ...CurrentVersion\RunServices (99%)
...Microsoft\OLE (99%)
...InternetSettings\5.0 (67%)
...InternetSettings\Connections (67%)full list | exec=resource32w.exe (98%)
pass=a (98%)
user=a (98%)
server=WinFtpd 1.2 (93%) | - | *@celestial.org (94%) |
| AUG-SEP-C | 506 | WinXP (54%)
Win2K-f (46%) | 445 (89%)
139 (10%) | 113 (68%)
135 (54%)
500 (54%)
1026 (54%) | 1:1390 (100%)
1:99998 (100%)
1:5001684 (93%)
1:2001683 (92%)
1:2001944 (89%)
1:3000006 (88%)full list | 445 (88%)
74 (47%)
68 (43%) | - | vipre (90%)
sdbot (78%)
sheur (48%)
heur (39%)
rbot (37%)
spybot (36%)full list | MSMSGS.EXE (56%)
random 8/9/10
character filename | o (97%) | None (10%) | ...CurrentVersion\RunServices (100%)
...InternetSettings\5.0 (45%)
...CurrentVersion\Run (31%)
...Microsoft\OLE (29%)full list | user=1 (100%)
pass=1 (100%)
server=StnyFtpd 0wns j0 (72%) | - | *@admin.com (98%)
paypal.com (79%)
PAYPAL.COM (77%)
de.yahoo.com (77%)
nitro.ucsc.edu (77%)
reconnect.in (77%)full list |
| AUG-SEP-D | 313 | Win2K-f (100%) | 445 (65%)
139 (35%) | 135 (100%)
500 (100%)
1026 (100%)
1027 (95%) | 1:3000003 (95%)
1:99913 (95%)
1:5001684 (91%)
1:2466 (65%) | 1028 (88%) | 1028 (95%) | ircbot (100%)
delbot (98%)
nirbot (98%)
rinbot (98%)
sdbot (98%)
rbot (77%)full list | ntvdm.exe (54%) | - | a0a7e8... (46%)
None (20%)
a7c70c... (10%)
cefc8f... (7%)
5777cb... (6%)full list | ...InternetSettings\5.0 (100%)
...InternetSettings\Connections (99%)
...Microsoft\DownloadManager (97%)full list | pass=1 (100%)
user=1 (100%)
server=fuckFtpd 0wns j0 (86%)
exec=Tilecomfree.com (43%)
exec=MSNGR32.com (29%) | UA=Mozilla/4.0 (compatibl... (100%)
version=1.0 (100%)
filename=/zmon.exe (100%)full list | - |
| AUG-SEP-E | 286 | WinXP (100%) | 445 (100%) | 113 (98%)
3067 (98%) | 1:2000032 (100%)
1:2000033 (100%)
1:2466 (100%)
1:99913 (100%)
555:5555005 (98%)
1:2001569 (98%)full list | 445 (98%)
1032 (93%) | 1032 (75%)
1054 (25%) | korgo (100%)
padobot (100%)
ircbot (72%)
sdbot (72%)
lsabot (26%) | MSMSGS.EXE (100%)
random 5/6/7/8
character filename | ftpupd.exe (100%)
random 5/6/7/8
character filename | 7f6016... (70%)
32a0d7... (6%)
042774... (5%)full list | ...Microsoft\Wireless (100%) full list | - | - | brussels.be.eu.undernet.o... (100%)
caen.fr.eu.undernet.org (100%)
flanders.be.eu.undernet.o... (100%)
gaspode.zanet.org.za (100%)
graz.at.eu.undernet.org (100%)
lia.zanet.net (100%)full list |
| AUG-SEP-F | 94 | WinXP (100%) | 445 (97%) | 44445 (93%) | 1:99913 (98%)
1:2000032 (97%)
1:2000033 (97%)
1:2466 (97%)
1:3000004 (88%)
1:5001684 (65%)full list | 74 (52%) | 44445 (88%) | - | MSMSGS.EXE (100%) | index.dat (100%)
resource32w.exe (70%) | None (98%) | - | user=a (97%)
pass=a (94%)
exec=resource32w.exe (90%)
server=WinFtpd 1.2 (80%)
destport=1025 (38%) | - | - |
| AUG-SEP-G | 86 | WinXP (100%) | 445 (98%) | 80 (97%) | 1:5001684 (100%)
1:2001683 (99%)
1:2000032 (98%)
1:2000033 (98%)
1:2466 (98%)
1:3000000 (98%)full list | 1032 (90%) | 80 (88%) | padobot (100%)
berbew (99%)
berkor (99%)
doxpar (99%)
korgo (95%)
padodor (79%) | MSMSGS.EXE (100%) | DCPROMO.LOG (99%)
index.dat (99%)
ndisrd.sys (99%)
random 6/8
character filename | a12cab... (73%)
df17a6... (10%)full list | ...ActivatingDocument\.Current (97%)
...CurrentVersion\InternetSettings (97%)
...FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN (97%)
...InternetSettings\Zones (97%)
...Main\FeatureControl (97%)
...Microsoft\Windows (97%)full list | pass=1 (100%)
user=1 (100%) | - | 53bank.com (100%)
acrolein-hawk.rubanking.h... (100%)
alfabank.ru (100%)
asmworm.com (100%)
atmacasoft.com (100%)
barclays.com (100%)full list |
| AUG-SEP-H | 61 | Win2K-f (100%) | 445 (100%) | 135 (100%)
500 (100%)
1026 (100%)
44445 (100%) | 1:2000032 (100%)
1:2000046 (100%)
1:2466 (100%)
1:3000004 (100%)
1:99906 (100%) | - | 44445 (100%) | - | - | - | None (100%) | - | user=a (100%)
pass=a (88%)
server=WinFtpd 1.2 (76%)
exec=resource32w.exe (65%) | - | - |
| AUG-SEP-K | 54 | WinXP (80%) | 445 (44%)
135 (30%)
1034 (24%) | 9996 (41%) | 1:99913 (91%)
1:2466 (63%)
1:5001684 (57%)
555:5555005 (48%)
1:2001683 (46%)
1:2001569 (39%)full list | 445 (44%)
9996 (35%)
1032 (33%) | - | korgo (31%)
lsabot (31%)
padobot (31%)
jobaka (29%)
poebot (29%)
muldrop (20%)full list | MSMSGS.EXE (80%)
random 7/8
character filename | index.dat (69%)
ftpupd.exe (31%)
random 6/8
character filename | None (20%)
7d99b0... (13%)
831f4e... (11%)
1a2c0e... (7%)
2aa59b... (7%)
a39875... (6%)full list | ...Microsoft\Wireless (52%)
...InternetSettings\5.0 (29%)full list | user=anonymous (64%)
pass=bin (57%)
server=OK (46%)
destport=1025 (29%) | - | - |
| AUG-SEP-I | 31 | WinXP (100%) | 445 (100%) | 1033 (48%)
113 (31%) | 1:2001683 (100%)
1:5001684 (100%)
1:2000032 (84%)
1:2000033 (84%)
1:2466 (84%)
1:3000000 (84%)full list | 445 (94%)
1032 (77%) | 1032 (77%) | virut (100%)
vipre (92%)
virutas (92%)
korgo (85%)
gen33 (77%)
padobot (77%)full list | MSMSGS.EXE (100%)
random 6/8
character filename | HelpCtr.exe (87%)
HelpHost.exe (87%)
HelpSvc.exe (87%)
NOTEPAD.EXE (87%)
UploadM.exe (87%)
accwiz.exe (87%)full list | 999e33... (13%)
175328... (6%)
388123... (6%)
4daafe... (6%)
628df4... (6%)
6df73d... (6%)full list | ...Microsoft\Wireless (83%) full list | pass=1 (100%)
server=StnyFtpd 0wns j0 (100%)
user=1 (100%)
exec=sertys.exe (60%)
destIP=130.107.209.120 (40%)
destIP=130.107.227.96 (40%)full list | - | *@admin.com (50%)
PAYPAL.COM (50%)
broadway.ny.us.dal.net (50%)
brussels.be.eu.undernet.o... (50%)
caen.fr.eu.undernet.org (50%)
ced.dal.net (50%)full list |
| AUG-SEP-L | 25 | WinXP (100%) | 445 (100%) | 1032 (100%) | 1:2000032 (100%)
1:2000033 (100%)
1:2466 (100%)
1:99913 (100%)
1:3000003 (92%)
1:2001683 (80%)full list | 1032 (84%) | 1032 (92%) | - | MSMSGS.EXE (100%) | ftpupd.exe (100%)
index.dat (100%) | None (96%) | - | - | - | - |
| AUG-SEP-J | 22 | WinXP (100%) | 445 (100%) | - | 1:2000032 (100%)
1:2000033 (100%)
1:2001683 (100%)
1:2466 (100%)
1:3000000 (100%)
1:3000003 (100%)full list | 1032 (100%)
445 (91%) | 1032 (100%)
1062 (27%) | korgo (100%)
lsabot (100%)
padobot (100%)
parite (91%)
pinfi (91%)
win32_parite_b (91%)full list | MSMSGS.EXE (100%) | ftpupd.exe (100%)
random 4
character filename | 736531... (50%)
0a944c... (9%)
528766... (9%)
651382... (9%)
95b642... (9%)full list | ...Microsoft\Wireless (100%) full list | - | - | - |
| AUG-SEP-M | 6 | Win2K-f (100%) | 445 (100%) | 135 (100%)
500 (100%)
1026 (100%) | 1:1390 (100%)
1:2001944 (100%)
1:3000006 (100%)
1:99998 (100%)
1:3003 (83%) | 445 (100%) | - | - | - | - | None (100%) | - | user=1 (100%)
pass=1 (67%)
server=StnyFtpd 0wns j0 (67%) | - | - |