BotHunter ®
  Cyber-TA Internet Release
  Computer Science Laboratory
  SRI International


  SAMPLE NAME:    Wootbot_botHunter.txt
  Last Updated: Mon Dec 28 21:20:32 2009
BOTHUNTER LOGO
www.BOTHUNTER.net


Victim IP
Max Score
Profiles
CCs
Events
192.168.1.24
3.1 VIEW 1
  • 67.149.121.39 (D149-67-39-121.Clv.Wideopenwest.Com), Country: United States (Us), City: Elgin, Il.
  • 1:22000032 {tcp} Inbound Attack: BLEEDING-EDGE EXPLOIT LSA exploit; 445<-4416
  • 1:22000033 {tcp} Inbound Attack: BLEEDING-EDGE EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP); 445<-4416
  • 1:22466 {tcp} Inbound Attack: NETBIOS SMB-DS IPC$ unicode share access; 445<-4416
  • 1:292000032 (2) {tcp} Inbound Attack: BotHunter EXPLOIT LSA exploit; 445<-4416
  • 1:299913 (2) {tcp} Inbound Attack: SHELLCODE x86 0x90 unicode NOOP; 445<-4416
  • 1:5001684 {tcp} Egg Download: BotHunter Malware Windows executable (PE) sent from remote host; 1033<-4985