BotHunter ®
  Cyber-TA Internet Release
  Computer Science Laboratory
  SRI International


  SAMPLE NAME:    Surlia.AW_botHunter.txt
  Last Updated: Tue Dec 29 11:45:13 2009
BOTHUNTER LOGO
www.BOTHUNTER.net


Victim IP
Max Score
Profiles
CCs
Events
192.168.1.58
2.6 VIEW 1
  • 62.90.134.24 (62-90-134-24.Barak.Net.Il), Country: Israel (Il), City: (Unknown City).
  • 210.245.211.11 Country: Iraq (Iq), City: Bagdad.
  • 67.149.121.39 (D149-67-39-121.Clv.Wideopenwest.Com), Country: United States (Us), City: Elgin, Il.
  • 1:22000032 {tcp} Inbound Attack: BLEEDING-EDGE EXPLOIT LSA exploit; 445<-2029
  • 1:22000033 {tcp} Inbound Attack: BLEEDING-EDGE EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP); 445<-2029
  • 1:22466 {tcp} Inbound Attack: NETBIOS SMB-DS IPC$ unicode share access; 445<-2029
  • 1:292000032 (2) {tcp} Inbound Attack: BotHunter EXPLOIT LSA exploit; 445<-2029
  • 1:299913 (2) {tcp} Inbound Attack: SHELLCODE x86 0x90 unicode NOOP; 445<-2029
  • 1:2007577 {tcp} Egg Download: ET TROJAN General Downloader Checkin URL (GUID+); 1053->80