Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.190
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   06/20/2011 05:04:32.924 PDT
Gen. Time:        06/20/2011 05:04:32.924 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT
    46.252.130.7 (05:04:32.924 PDT)
       event=1:9910005 {tcp} E8[rb] BotHunter REPO confirmed botnet control server, [] MAC_Src: 00:30:48:30:03:AF
          1092->65520 (05:04:32.924 PDT)
       
tcpslice 1308571472.924 1308571472.925 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.190'

============================== SEPARATOR ================================
Score:            1.7 (>= 0.8)
Infected Target:  192.168.1.190
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       140.174.25.8 (3), 46.252.130.7, 64.38.232.180
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   06/20/2011 05:04:32.924 PDT
Gen. Time:        06/20/2011 05:08:10.835 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    140.174.25.8 (3) (05:04:40.128 PDT)
       event=1:2002196 (2) {tcp} E4[rb] ET MALWARE Casalemedia Spyware Reporting URL Visited 2, [/sd?s=84893&f=1] MAC_Src: 00:30:48:30:03:AF
          1106->80 (05:04:40.128 PDT)
          1106->80 (05:04:40.232 PDT)
       -------------------------
       event=1:2009880 {tcp} E4[rb] ET MALWARE Casalemedia Spyware Reporting URL Visited 3, [/sd?s=84893&f=1&C=1] MAC_Src: 00:30:48:30:03:AF
          1106->80 (05:04:40.232 PDT)
       
    46.252.130.7 (05:04:33.496 PDT)
       event=1:2003603 {tcp} E4[rb] ET TROJAN W32.Virut.A joining an IRC Channel, [] MAC_Src: 00:30:48:30:03:AF
          1092->65520 (05:04:33.496 PDT)
       
C and C TRAFFIC (RBN)
    64.38.232.180 (05:04:39.762 PDT)
       event=1:3810007 {tcp} E4[nbr] ET Known Russian Business Network Monitored Domain, [] MAC_Src: 00:30:48:30:03:AF
          1100->80 (05:04:39.762 PDT)
       
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT
    46.252.130.7 (2) (05:04:32.924 PDT)
       event=1:9910003 {tcp} E8[rb] BotHunter MTC confirmed botnet control server, [] MAC_Src: 00:30:48:30:03:AF
          1092->65520 (05:04:32.924 PDT)
       -------------------------
       event=1:9910005 {tcp} E8[rb] BotHunter REPO confirmed botnet control server, [] MAC_Src: 00:30:48:30:03:AF
          1092->65520 (05:04:32.924 PDT)
       
tcpslice 1308571472.924 1308571472.925 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.190'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.190
Infector List:    38.124.24.89
Egg Source List:  38.124.24.89
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   06/20/2011 07:14:14.839 PDT
Gen. Time:        06/20/2011 07:14:15.188 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    38.124.24.89 (4) (07:14:14.839 PDT-07:14:14.847 PDT)
       event=1:22000032 {tcp} E2[rb] ET EXPLOIT LSA exploit, [] MAC_Dst: 00:30:48:30:03:AE
          445<-24077 (07:14:14.851 PDT)
       -------------------------
       event=1:22000033 {tcp} E2[rb] ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP), [] MAC_Dst: 00:30:48:30:03:AE
          445<-24077 (07:14:14.847 PDT)
       -------------------------
       event=1:2299913 (2) {tcp} E2[rb] ET SHELLCODE x86 0x90 unicode NOOP, [] MAC_Dst: 00:30:48:30:03:AE
          2: 445<-24077 (07:14:14.839 PDT-07:14:14.847 PDT)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    38.124.24.89 (07:14:15.188 PDT)
       event=1:3300003 {tcp} E3[rb] BotHunter HTTP-based .exe Upload on backdoor port, [] MAC_Src: 00:30:48:30:03:AF
          1031->8179 (07:14:15.188 PDT)
       
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
tcpslice 1308579254.839 1308579254.848 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.190'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.190
Infector List:    38.124.24.89
Egg Source List:  38.124.24.89
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   06/20/2011 07:14:14.839 PDT
Gen. Time:        06/20/2011 07:19:04.842 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    38.124.24.89 (4) (07:14:14.839 PDT-07:14:14.847 PDT)
       event=1:22000032 {tcp} E2[rb] ET EXPLOIT LSA exploit, [] MAC_Dst: 00:30:48:30:03:AE
          445<-24077 (07:14:14.851 PDT)
       -------------------------
       event=1:22000033 {tcp} E2[rb] ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP), [] MAC_Dst: 00:30:48:30:03:AE
          445<-24077 (07:14:14.847 PDT)
       -------------------------
       event=1:2299913 (2) {tcp} E2[rb] ET SHELLCODE x86 0x90 unicode NOOP, [] MAC_Dst: 00:30:48:30:03:AE
          2: 445<-24077 (07:14:14.839 PDT-07:14:14.847 PDT)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    38.124.24.89 (4) (07:14:15.188 PDT)
       event=1:2000419 {tcp} E3[rb] ET POLICY PE EXE or DLL Windows file download, [] MAC_Src: 00:21:1C:EE:14:00
          1031<-8179 (07:14:15.336 PDT)
       -------------------------
       event=1:3300003 {tcp} E3[rb] BotHunter HTTP-based .exe Upload on backdoor port, [] MAC_Src: 00:30:48:30:03:AF
          1031->8179 (07:14:15.188 PDT)
       -------------------------
       event=1:3300004 {tcp} E3[rb] BotHunter HTTP-based .exe Upload on backdoor port, [] MAC_Src: 00:21:1C:EE:14:00
          1031<-8179 (07:14:15.327 PDT)
       -------------------------
       event=1:3300007 {tcp} E3[rb] BotHunter Malware Windows executable (PE) sent from remote host, [] MAC_Src: 00:21:1C:EE:14:00
          1031<-8179 (07:14:15.336 PDT)
       
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
tcpslice 1308579254.839 1308579254.848 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.190'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.190
Infector List:    109.52.147.112
Egg Source List:  109.52.147.112
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   06/20/2011 10:09:11.123 PDT
Gen. Time:        06/20/2011 10:09:11.653 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    109.52.147.112 (4) (10:09:11.123 PDT-10:09:11.124 PDT)
       event=1:22000032 {tcp} E2[rb] ET EXPLOIT LSA exploit, [] MAC_Dst: 00:30:48:30:03:AE
          445<-52542 (10:09:11.129 PDT)
       -------------------------
       event=1:22000033 {tcp} E2[rb] ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP), [] MAC_Dst: 00:30:48:30:03:AE
          445<-52542 (10:09:11.124 PDT)
       -------------------------
       event=1:2299913 (2) {tcp} E2[rb] ET SHELLCODE x86 0x90 unicode NOOP, [] MAC_Dst: 00:30:48:30:03:AE
          2: 445<-52542 (10:09:11.123 PDT-10:09:11.124 PDT)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    109.52.147.112 (10:09:11.653 PDT)
       event=1:3300003 {tcp} E3[rb] BotHunter HTTP-based .exe Upload on backdoor port, [] MAC_Src: 00:30:48:30:03:AF
          1031->2782 (10:09:11.653 PDT)
       
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
tcpslice 1308589751.123 1308589751.125 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.190'

============================== SEPARATOR ================================
Score:            2.1 (>= 0.8)
Infected Target:  192.168.1.190
Infector List:    109.52.147.112
Egg Source List:  109.52.147.112
C & C List:       213.155.0.224
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   06/20/2011 10:09:11.123 PDT
Gen. Time:        06/20/2011 10:13:27.597 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    109.52.147.112 (4) (10:09:11.123 PDT-10:09:11.124 PDT)
       event=1:22000032 {tcp} E2[rb] ET EXPLOIT LSA exploit, [] MAC_Dst: 00:30:48:30:03:AE
          445<-52542 (10:09:11.129 PDT)
       -------------------------
       event=1:22000033 {tcp} E2[rb] ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP), [] MAC_Dst: 00:30:48:30:03:AE
          445<-52542 (10:09:11.124 PDT)
       -------------------------
       event=1:2299913 (2) {tcp} E2[rb] ET SHELLCODE x86 0x90 unicode NOOP, [] MAC_Dst: 00:30:48:30:03:AE
          2: 445<-52542 (10:09:11.123 PDT-10:09:11.124 PDT)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    109.52.147.112 (4) (10:09:11.653 PDT)
       event=1:2000419 {tcp} E3[rb] ET POLICY PE EXE or DLL Windows file download, [] MAC_Src: 00:21:1C:EE:14:00
          1031<-2782 (10:09:11.937 PDT)
       -------------------------
       event=1:3300003 {tcp} E3[rb] BotHunter HTTP-based .exe Upload on backdoor port, [] MAC_Src: 00:30:48:30:03:AF
          1031->2782 (10:09:11.653 PDT)
       -------------------------
       event=1:3300004 {tcp} E3[rb] BotHunter HTTP-based .exe Upload on backdoor port, [] MAC_Src: 00:21:1C:EE:14:00
          1031<-2782 (10:09:11.923 PDT)
       -------------------------
       event=1:3300007 {tcp} E3[rb] BotHunter Malware Windows executable (PE) sent from remote host, [] MAC_Src: 00:21:1C:EE:14:00
          1031<-2782 (10:09:11.937 PDT)
       
C and C TRAFFIC
    213.155.0.224 (10:09:15.499 PDT)
       event=1:2003070 {tcp} E4[rb] ET WORM Korgo.U Reporting, [/index.php?id=ysbbsghbfinbwo&scn=4&inf=0&ver=19&cnt=USA] MAC_Src: 00:30:48:30:03:AF
          1038->80 (10:09:15.499 PDT)
       
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT
    213.155.0.224 (10:09:15.293 PDT)
       event=1:9910003 {tcp} E8[rb] BotHunter MTC confirmed botnet control server, [] MAC_Src: 00:30:48:30:03:AF
          1038->80 (10:09:15.293 PDT)
       
tcpslice 1308589751.123 1308589751.125 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.190'

============================== SEPARATOR ================================