BotHunter ®
  Cyber-TA Internet Release
  Computer Science Laboratory
  SRI International


  SAMPLE NAME:    Baidu_botHunter.txt
  Last Updated: Tue Dec 29 11:44:45 2009
BOTHUNTER LOGO
www.BOTHUNTER.net


Victim IP
Max Score
Profiles
CCs
Events
192.168.71.146
2.3 VIEW 1
  • 61.135.158.241 Country: China (Cn), City: (Unknown City).
  • 192.168.71.2 Country: (Private Address) City: (Private Address).
  • 1:2002400 (2) {tcp} C&C Communication: ET MALWARE Suspicious User Agent (Microsoft Internet Explorer); 3013->80
  • 777:7777005 {udp} Outbound Scan: Detected intense non-malware port scanning of 30 IPs (28 /24s) (# pkts S/M/O/I=143/96/208/6): 61703u:1, 443:2, 17606u:3, 53u:22, 13557u:1, 19786u:1, 80:19, 3333u:4, 1111u:1, 123u:1, 10489u:1, 2418u:1
  • 777:7777005 (2) {tcp} Outbound Scan: Detected moderate malware port scanning of 9 IPs (6 /24s) (# pkts S/M/O/I=9/86/4/6): 137u:71, 138u:15
  • 777:7777005 {udp} Outbound Scan: Detected intense non-malware port scanning of 30 IPs (28 /24s) (# pkts S/M/O/I=29/92/94/6): 61703u:1, 53u:9, 13557u:1, 19786u:1, 123u:1, 10489u:1, 2418u:1, 54576u:1, 1900u:3, 40568u:1, 80:14, 3571u:1
  • 1:2600129 {udp} Attack Prep: SPYWARE-DNS DNS lookup 3 chars (.com); 3031->53
  • 777:7777008 {udp} Malware Scan: Detected intense malware port scanning of 21 IPs (18 /24s) (# pkts S/M/O/I=28/89/15/6): 137u:74, 138u:15