Infected Target:  192.168.1.30
Score:            1.0 (>= 0.8)
Infector List:    <unobserved>
Egg Source List:  216.55.176.45
C & C List:       216.55.176.45 (2)
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   01/07/2010 16:46:43.000 PST
Gen. Time:        01/07/2010 16:46:43.000 PST

INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    216.55.176.45 (16:46:43.000 PST)
       event=1:2007771 {tcp} E3[rb] ET TROJAN Pushdo Update URL Detected, [] MAC_Src: 00:01:64:FF:CE:EA
          39895->80 (16:46:43.000 PST)
       
C and C TRAFFIC
    216.55.176.45 (2) (16:46:43.000 PST)
       event=1:15165 {tcp} E4[rb] BACKDOOR Pushdo client communication attempt, [] MAC_Src: 00:01:64:FF:CE:EA
          39895->80 (16:46:43.000 PST)
       -------------------------
       event=1:2007773 {tcp} E4[rb] ET TROJAN Pakes/Cutwall/Kobcka Update URL Detected, [/40E8001442563762363062383030372D31306233656520626C0000000366000000007600000642EB00053051637485] MAC_Src: 00:01:64:FF:CE:EA
          39895->80 (16:46:43.000 PST)
       
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
tcpslice 1262911603.000 1262911603.001 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.30'

============================== SEPARATOR ================================
Infected Target:  192.168.1.30
Score:            1.0 (>= 0.8)
Infector List:    <unobserved>
Egg Source List:  216.55.176.45
C & C List:       216.55.176.45 (3)
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   01/07/2010 16:46:43.000 PST
Gen. Time:        01/07/2010 16:50:09.218 PST

INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    216.55.176.45 (2) (16:46:43.000 PST)
       event=1:2007771 (2) {tcp} E3[rb] ET TROJAN Pushdo Update URL Detected, [] MAC_Src: 00:01:64:FF:CE:EA
          39895->80 (16:46:43.000 PST)
          36849->80 (16:49:09.675 PST)
       
C and C TRAFFIC
    216.55.176.45 (3) (16:46:43.000 PST)
       event=1:15165 (2) {tcp} E4[rb] BACKDOOR Pushdo client communication attempt, [] MAC_Src: 00:01:64:FF:CE:EA
          39895->80 (16:46:43.000 PST)
          36849->80 (16:49:09.675 PST)
       -------------------------
       event=1:2007773 {tcp} E4[rb] ET TROJAN Pakes/Cutwall/Kobcka Update URL Detected, [/40E8001442563762363062383030372D31306233656520626C0000000366000000007600000642EB00053051637485] MAC_Src: 00:01:64:FF:CE:EA
          39895->80 (16:46:43.000 PST)
       
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
tcpslice 1262911603.000 1262911603.001 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.30'

============================== SEPARATOR ================================