Pattern AUGUST-I

11 samples (WinXP (100%))


Ports
InfectionListenEgg-downloadUpload
445 (100%)1033 (50%)
113 (40%)		445 (91%)
1032 (73%)		1032 (73%)
1061 (27%)
Filenames
ProcessesExecutables
MSMSGS.EXE (100%)

random 6
character filename		HelpCtr.exe (100%)
HelpHost.exe (100%)
HelpSvc.exe (100%)
NOTEPAD.EXE (100%)
UploadM.exe (100%)
accwiz.exe (100%)

full list

Registry keys
...Microsoft\Wireless (80%)

full list

Snort IDs
1:2001683 (100%)
1:5001684 (100%)
1:2000032 (82%)
1:2000033 (82%)
1:2466 (82%)
1:3000000 (82%)

full list

Network chatter
FTP
pass=1 (100%)
server=StnyFtpd 0wns j0 (100%)
user=1 (100%)
Static analysis
Antivirus labelsDomain
virut (100%)
vipre (91%)
virutas (91%)
korgo (82%)
gen33 (73%)
padobot (73%)

full list

*@admin.com (50%)
PAYPAL.COM (50%)
broadway.ny.us.dal.net (50%)
brussels.be.eu.undernet.o... (50%)
caen.fr.eu.undernet.org (50%)
ced.dal.net (50%)

full list