Score:            1.1 (>= 0.8)
Infected Target:  192.168.1.186
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   01/14/2013 06:15:54.968 PST
Gen. Time:        01/14/2013 06:15:55.225 PST


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    130.163.63.242 (06:15:54.968 PST)
       event=777:7777005 {tcp} E5[bh] Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10, [] MAC_Src: 00:30:48:30:03:AF
          0->0 (06:15:54.968 PST)
       
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    130.163.63.242 (06:15:55.225 PST)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/20/1/0): 445:20, [] MAC_Src: 00:30:48:30:03:AF
          0->0 (06:15:55.225 PST)
       
tcpslice 1358172954.968 1358172954.969 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.186'

============================== SEPARATOR ================================
Score:            1.9 (>= 0.8)
Infected Target:  192.168.1.186
Infector List:    174.126.143.252
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    174.126.143.252
Observed Start:   01/14/2013 06:15:54.968 PST
Gen. Time:        01/14/2013 06:19:32.639 PST


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    174.126.143.252 (06:15:55.850 PST)
       event=1:22000346 {tcp} E2[rb] ET ATTACK_RESPONSE IRC - Name response on non-std port, [] MAC_Dst: 00:30:48:30:03:AE
          14264<-3308 (06:15:55.850 PST)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    130.163.63.242 (06:15:54.968 PST)
       event=777:7777005 {tcp} E5[bh] Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10, [] MAC_Src: 00:30:48:30:03:AF
          0->0 (06:15:54.968 PST)
       
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    174.126.143.252 (06:15:55.718 PST)
       event=1:2000352 {tcp} E6[rb] ET ATTACK RESPONSE IRC - dns request on non-std port, [] MAC_Src: 00:30:48:30:03:AF
          14264->3308 (06:15:55.718 PST)
       
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    130.163.63.242 (06:15:55.225 PST)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/20/1/0): 445:20, [] MAC_Src: 00:30:48:30:03:AF
          0->0 (06:15:55.225 PST)
       
tcpslice 1358172954.968 1358172954.969 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.186'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.186
Infector List:    174.126.143.252
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    174.126.143.252
Observed Start:   01/14/2013 06:59:15.791 PST
Gen. Time:        01/14/2013 06:59:15.872 PST


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    174.126.143.252 (06:59:15.872 PST)
       event=1:22000346 {tcp} E2[rb] ET ATTACK_RESPONSE IRC - Name response on non-std port, [] MAC_Dst: 00:30:48:30:03:AE
          14264<-3308 (06:59:15.872 PST)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    174.126.143.252 (06:59:15.791 PST)
       event=1:2000352 {tcp} E6[rb] ET ATTACK RESPONSE IRC - dns request on non-std port, [] MAC_Src: 00:30:48:30:03:AF
          14264->3308 (06:59:15.791 PST)
       
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1358175555.791 1358175555.792 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.186'

============================== SEPARATOR ================================
Score:            1.1 (>= 0.8)
Infected Target:  192.168.1.186
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   01/14/2013 07:46:21.040 PST
Gen. Time:        01/14/2013 07:46:21.316 PST


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    130.164.220.190 (07:46:21.040 PST)
       event=777:7777005 {tcp} E5[bh] Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10, [] MAC_Src: 00:30:48:30:03:AF
          0->0 (07:46:21.040 PST)
       
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    130.132.192.37 (07:46:21.316 PST)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21, [] MAC_Src: 00:30:48:30:03:AF
          0->0 (07:46:21.316 PST)
       
tcpslice 1358178381.040 1358178381.041 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.186'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.186
Infector List:    174.126.143.252
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    174.126.143.252
Observed Start:   01/14/2013 09:09:16.121 PST
Gen. Time:        01/14/2013 09:09:16.549 PST


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    174.126.143.252 (09:09:16.549 PST)
       event=1:22000346 {tcp} E2[rb] ET ATTACK_RESPONSE IRC - Name response on non-std port, [] MAC_Dst: 00:30:48:30:03:AE
          14264<-3308 (09:09:16.549 PST)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    174.126.143.252 (09:09:16.121 PST)
       event=1:2000352 {tcp} E6[rb] ET ATTACK RESPONSE IRC - dns request on non-std port, [] MAC_Src: 00:30:48:30:03:AF
          14264->3308 (09:09:16.121 PST)
       
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1358183356.121 1358183356.122 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.186'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.186
Infector List:    174.126.143.252
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    174.126.143.252
Observed Start:   01/14/2013 09:52:36.233 PST
Gen. Time:        01/14/2013 09:52:36.775 PST


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    174.126.143.252 (09:52:36.775 PST)
       event=1:22000346 {tcp} E2[rb] ET ATTACK_RESPONSE IRC - Name response on non-std port, [] MAC_Dst: 00:30:48:30:03:AE
          14264<-3308 (09:52:36.775 PST)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    174.126.143.252 (09:52:36.233 PST)
       event=1:2000352 {tcp} E6[rb] ET ATTACK RESPONSE IRC - dns request on non-std port, [] MAC_Src: 00:30:48:30:03:AF
          14264->3308 (09:52:36.233 PST)
       
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1358185956.233 1358185956.234 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.186'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.186
Infector List:    174.126.143.252
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    174.126.143.252
Observed Start:   01/14/2013 10:35:56.376 PST
Gen. Time:        01/14/2013 10:35:56.617 PST


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    174.126.143.252 (10:35:56.617 PST)
       event=1:22000346 {tcp} E2[rb] ET ATTACK_RESPONSE IRC - Name response on non-std port, [] MAC_Dst: 00:30:48:30:03:AE
          14264<-3308 (10:35:56.617 PST)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    174.126.143.252 (10:35:56.376 PST)
       event=1:2000352 {tcp} E6[rb] ET ATTACK RESPONSE IRC - dns request on non-std port, [] MAC_Src: 00:30:48:30:03:AF
          14264->3308 (10:35:56.376 PST)
       
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1358188556.376 1358188556.377 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.186'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.186
Infector List:    174.126.143.252
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    174.126.143.252
Observed Start:   01/14/2013 11:19:16.468 PST
Gen. Time:        01/14/2013 11:19:16.795 PST


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    174.126.143.252 (11:19:16.795 PST)
       event=1:22000346 {tcp} E2[rb] ET ATTACK_RESPONSE IRC - Name response on non-std port, [] MAC_Dst: 00:30:48:30:03:AE
          14264<-3308 (11:19:16.795 PST)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    174.126.143.252 (11:19:16.468 PST)
       event=1:2000352 {tcp} E6[rb] ET ATTACK RESPONSE IRC - dns request on non-std port, [] MAC_Src: 00:30:48:30:03:AF
          14264->3308 (11:19:16.468 PST)
       
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1358191156.468 1358191156.469 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.186'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.186
Infector List:    174.126.143.252
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    174.126.143.252
Observed Start:   01/14/2013 12:45:56.731 PST
Gen. Time:        01/14/2013 12:45:56.820 PST


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    174.126.143.252 (12:45:56.820 PST)
       event=1:22000346 {tcp} E2[rb] ET ATTACK_RESPONSE IRC - Name response on non-std port, [] MAC_Dst: 00:30:48:30:03:AE
          14264<-3308 (12:45:56.820 PST)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    174.126.143.252 (12:45:56.731 PST)
       event=1:2000352 {tcp} E6[rb] ET ATTACK RESPONSE IRC - dns request on non-std port, [] MAC_Src: 00:30:48:30:03:AF
          14264->3308 (12:45:56.731 PST)
       
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1358196356.731 1358196356.732 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.186'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.186
Infector List:    174.126.143.252
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    174.126.143.252
Observed Start:   01/14/2013 15:39:17.152 PST
Gen. Time:        01/14/2013 15:39:17.239 PST


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    174.126.143.252 (15:39:17.239 PST)
       event=1:22000346 {tcp} E2[rb] ET ATTACK_RESPONSE IRC - Name response on non-std port, [] MAC_Dst: 00:30:48:30:03:AE
          14264<-3308 (15:39:17.239 PST)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    174.126.143.252 (15:39:17.152 PST)
       event=1:2000352 {tcp} E6[rb] ET ATTACK RESPONSE IRC - dns request on non-std port, [] MAC_Src: 00:30:48:30:03:AF
          14264->3308 (15:39:17.152 PST)
       
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1358206757.152 1358206757.153 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.186'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.186
Infector List:    174.126.143.252
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    174.126.143.252
Observed Start:   01/14/2013 17:05:57.363 PST
Gen. Time:        01/14/2013 17:05:57.463 PST


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    174.126.143.252 (17:05:57.463 PST)
       event=1:22000346 {tcp} E2[rb] ET ATTACK_RESPONSE IRC - Name response on non-std port, [] MAC_Dst: 00:30:48:30:03:AE
          14264<-3308 (17:05:57.463 PST)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    174.126.143.252 (17:05:57.363 PST)
       event=1:2000352 {tcp} E6[rb] ET ATTACK RESPONSE IRC - dns request on non-std port, [] MAC_Src: 00:30:48:30:03:AF
          14264->3308 (17:05:57.363 PST)
       
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1358211957.363 1358211957.364 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.186'

============================== SEPARATOR ================================
Score:            1.1 (>= 0.8)
Infected Target:  192.168.1.186
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   01/14/2013 19:57:40.460 PST
Gen. Time:        01/14/2013 19:57:40.639 PST


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    130.255.52.233 (19:57:40.460 PST)
       event=777:7777005 {tcp} E5[bh] Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10, [] MAC_Src: 00:30:48:30:03:AF
          0->0 (19:57:40.460 PST)
       
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    130.163.115.192 (19:57:40.639 PST)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/20/1/0): 135:20, [] MAC_Src: 00:30:48:30:03:AF
          0->0 (19:57:40.639 PST)
       
tcpslice 1358222260.460 1358222260.461 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.186'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.186
Infector List:    174.126.143.252
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    174.126.143.252
Observed Start:   01/14/2013 21:25:58.094 PST
Gen. Time:        01/14/2013 21:25:58.176 PST


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    174.126.143.252 (21:25:58.176 PST)
       event=1:22000346 {tcp} E2[rb] ET ATTACK_RESPONSE IRC - Name response on non-std port, [] MAC_Dst: 00:30:48:30:03:AE
          14264<-3308 (21:25:58.176 PST)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    174.126.143.252 (21:25:58.094 PST)
       event=1:2000352 {tcp} E6[rb] ET ATTACK RESPONSE IRC - dns request on non-std port, [] MAC_Src: 00:30:48:30:03:AF
          14264->3308 (21:25:58.094 PST)
       
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1358227558.094 1358227558.095 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.186'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.186
Infector List:    174.126.143.252
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    174.126.143.252
Observed Start:   01/14/2013 22:09:18.208 PST
Gen. Time:        01/14/2013 22:09:18.290 PST


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    174.126.143.252 (22:09:18.290 PST)
       event=1:22000346 {tcp} E2[rb] ET ATTACK_RESPONSE IRC - Name response on non-std port, [] MAC_Dst: 00:30:48:30:03:AE
          14264<-3308 (22:09:18.290 PST)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    174.126.143.252 (22:09:18.208 PST)
       event=1:2000352 {tcp} E6[rb] ET ATTACK RESPONSE IRC - dns request on non-std port, [] MAC_Src: 00:30:48:30:03:AF
          14264->3308 (22:09:18.208 PST)
       
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1358230158.208 1358230158.209 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.186'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.186
Infector List:    174.126.143.252
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    174.126.143.252
Observed Start:   01/14/2013 22:52:38.291 PST
Gen. Time:        01/14/2013 22:52:38.570 PST


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    174.126.143.252 (22:52:38.570 PST)
       event=1:22000346 {tcp} E2[rb] ET ATTACK_RESPONSE IRC - Name response on non-std port, [] MAC_Dst: 00:30:48:30:03:AE
          14264<-3308 (22:52:38.570 PST)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    174.126.143.252 (22:52:38.291 PST)
       event=1:2000352 {tcp} E6[rb] ET ATTACK RESPONSE IRC - dns request on non-std port, [] MAC_Src: 00:30:48:30:03:AF
          14264->3308 (22:52:38.291 PST)
       
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1358232758.291 1358232758.292 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.186'

============================== SEPARATOR ================================