BotHunter ®
  Cyber-TA Internet Release
  Computer Science Laboratory
  SRI International


  SAMPLE NAME:    Korgo_botHunter.txt
  Last Updated: Mon Dec 28 21:15:45 2009
BOTHUNTER LOGO
www.BOTHUNTER.net


Victim IP
Max Score
Profiles
CCs
Events
192.168.171.137
2.4 VIEW 1
  • 213.219.245.212 Country: Switzerland (Ch), City: Zurich.
  • 89.114.89.218 Country: (Unknown Country?) City: (Unknown City?).
  • 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-1597
  • 1:22000033 {tcp} Inbound Attack: ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-1597
  • 1:2299913 (2) {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 445<-1597
  • 1:2000419 {tcp} Egg Download: ET POLICY PE EXE or DLL Windows file download; 1031<-6206
  • 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->6206
  • 1:3300004 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031<-6206