Score: 1.1 (>= 0.8) Infected Target: 192.168.1.236 Infector List: Egg Source List: C & C List: Peer Coord. List: Resource List: Observed Start: 01/31/2013 03:05:20.451 PST Gen. Time: 01/31/2013 03:05:21.207 PST INBOUND SCAN EXPLOIT EXPLOIT MALWARE DNS EGG DOWNLOAD C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) 130.188.252.118 (03:05:20.451 PST) event=777:7777005 {tcp} E5[bh] Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10, [] MAC_Src: 00:30:48:30:03:AF 0->0 (03:05:20.451 PST) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN 130.188.252.118 (03:05:21.207 PST) event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21, [] MAC_Src: 00:30:48:30:03:AF 0->0 (03:05:21.207 PST) tcpslice 1359630320.451 1359630320.452 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.236' ============================== SEPARATOR ================================ Score: 1.1 (>= 0.8) Infected Target: 192.168.1.236 Infector List: Egg Source List: C & C List: Peer Coord. List: Resource List: Observed Start: 01/31/2013 07:10:42.725 PST Gen. Time: 01/31/2013 07:10:42.839 PST INBOUND SCAN EXPLOIT EXPLOIT MALWARE DNS EGG DOWNLOAD C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) 130.36.58.64 (07:10:42.725 PST) event=777:7777005 {tcp} E5[bh] Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10, [] MAC_Src: 00:30:48:30:03:AF 0->0 (07:10:42.725 PST) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN 130.144.73.69 (07:10:42.839 PST) event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21, [] MAC_Src: 00:30:48:30:03:AF 0->0 (07:10:42.839 PST) tcpslice 1359645042.725 1359645042.726 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.236' ============================== SEPARATOR ================================ Score: 1.1 (>= 0.8) Infected Target: 192.168.1.236 Infector List: Egg Source List: C & C List: Peer Coord. List: Resource List: Observed Start: 01/31/2013 09:45:29.205 PST Gen. Time: 01/31/2013 09:45:29.368 PST INBOUND SCAN EXPLOIT EXPLOIT MALWARE DNS EGG DOWNLOAD C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) 130.68.163.237 (09:45:29.205 PST) event=777:7777005 {tcp} E5[bh] Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10, [] MAC_Src: 00:30:48:30:03:AF 0->0 (09:45:29.205 PST) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN 130.68.163.237 (09:45:29.368 PST) event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21, [] MAC_Src: 00:30:48:30:03:AF 0->0 (09:45:29.368 PST) tcpslice 1359654329.205 1359654329.206 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.236' ============================== SEPARATOR ================================ Score: 1.1 (>= 0.8) Infected Target: 192.168.1.236 Infector List: Egg Source List: C & C List: Peer Coord. List: Resource List: Observed Start: 01/31/2013 11:20:38.799 PST Gen. Time: 01/31/2013 11:20:38.912 PST INBOUND SCAN EXPLOIT EXPLOIT MALWARE DNS EGG DOWNLOAD C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) 130.173.67.64 (11:20:38.799 PST) event=777:7777005 {tcp} E5[bh] Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10, [] MAC_Src: 00:30:48:30:03:AF 0->0 (11:20:38.799 PST) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN 130.173.67.64 (11:20:38.912 PST) event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21, [] MAC_Src: 00:30:48:30:03:AF 0->0 (11:20:38.912 PST) tcpslice 1359660038.799 1359660038.800 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.236' ============================== SEPARATOR ================================