BotHunter ®
  Cyber-TA Internet Release
  Computer Science Laboratory
  SRI International


  SAMPLE NAME:    Virut_botHunter.txt
  Last Updated: Mon Dec 28 21:20:11 2009
BOTHUNTER LOGO
www.BOTHUNTER.net


Victim IP
Max Score
Profiles
CCs
Events
192.168.1.149
1.3 VIEW 1
  • 194.54.90.246 Country: European Union (Eu), City: (Unknown City).
  • 1:22000032 {tcp} Inbound Attack: BLEEDING-EDGE EXPLOIT LSA exploit; 445<-4829
  • 1:22466 {tcp} Inbound Attack: NETBIOS SMB-DS IPC$ unicode share access; 445<-4829
  • 1:292000032 (2) {tcp} Inbound Attack: BotHunter EXPLOIT LSA exploit; 445<-4829
  • 1:299913 (2) {tcp} Inbound Attack: SHELLCODE x86 0x90 unicode NOOP; 445<-4829
  • 1:2001683 {tcp} Egg Download: BLEEDING-EDGE Malware Windows executable sent from remote host; 1031<-4809
  • 1:3000000 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031<-4809