BotHunter ®
  Cyber-TA Internet Release
  Computer Science Laboratory
  SRI International


  SAMPLE NAME:    Korgo.N_botHunter.txt
  Last Updated: Mon Dec 28 21:15:27 2009
BOTHUNTER LOGO
www.BOTHUNTER.net


Victim IP
Max Score
Profiles
CCs
Events
192.168.1.217
2.8 VIEW 1
  • 210.245.211.11 Country: Iraq (Iq), City: Bagdad.
  • 1:22000032 {tcp} Inbound Attack: BLEEDING-EDGE EXPLOIT LSA exploit; 445<-2387
  • 1:22000033 {tcp} Inbound Attack: BLEEDING-EDGE EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP); 445<-2387
  • 1:22466 {tcp} Inbound Attack: NETBIOS SMB-DS IPC$ unicode share access; 445<-2387
  • 1:292000032 (2) {tcp} Inbound Attack: BotHunter EXPLOIT LSA exploit; 445<-2387
  • 1:299913 (2) {tcp} Inbound Attack: SHELLCODE x86 0x90 unicode NOOP; 445<-2387
  • 1:2001683 {tcp} Egg Download: BLEEDING-EDGE Malware Windows executable sent from remote host; 1031<-6341