Score: 1.1 (>= 0.8) Infected Target: 192.168.1.216 Infector List: Egg Source List: C & C List: Peer Coord. List: Resource List: Observed Start: 02/04/2013 03:42:32.752 PST Gen. Time: 02/04/2013 03:42:32.994 PST INBOUND SCAN EXPLOIT EXPLOIT MALWARE DNS EGG DOWNLOAD C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) 130.177.44.204 (03:42:32.752 PST) event=777:7777005 {tcp} E5[bh] Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10, [] MAC_Src: 00:30:48:30:03:AF 0->0 (03:42:32.752 PST) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN 130.8.176.70 (03:42:32.994 PST) event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21, [] MAC_Src: 00:30:48:30:03:AF 0->0 (03:42:32.994 PST) tcpslice 1359978152.752 1359978152.753 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.216' ============================== SEPARATOR ================================ Score: 1.1 (>= 0.8) Infected Target: 192.168.1.216 Infector List: Egg Source List: C & C List: Peer Coord. List: Resource List: Observed Start: 02/04/2013 09:37:58.437 PST Gen. Time: 02/04/2013 09:37:58.796 PST INBOUND SCAN EXPLOIT EXPLOIT MALWARE DNS EGG DOWNLOAD C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) 130.146.50.184 (09:37:58.437 PST) event=777:7777005 {tcp} E5[bh] Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10, [] MAC_Src: 00:30:48:30:03:AF 0->0 (09:37:58.437 PST) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN 130.237.175.197 (09:37:58.796 PST) event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21, [] MAC_Src: 00:30:48:30:03:AF 0->0 (09:37:58.796 PST) tcpslice 1359999478.437 1359999478.438 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.216' ============================== SEPARATOR ================================ Score: 1.1 (>= 0.8) Infected Target: 192.168.1.216 Infector List: Egg Source List: C & C List: Peer Coord. List: Resource List: Observed Start: 02/04/2013 19:28:05.260 PST Gen. Time: 02/04/2013 19:28:05.540 PST INBOUND SCAN EXPLOIT EXPLOIT MALWARE DNS EGG DOWNLOAD C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) 130.152.16.71 (19:28:05.260 PST) event=777:7777005 {tcp} E5[bh] Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10, [] MAC_Src: 00:30:48:30:03:AF 0->0 (19:28:05.260 PST) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN 130.39.223.169 (19:28:05.540 PST) event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21, [] MAC_Src: 00:30:48:30:03:AF 0->0 (19:28:05.540 PST) tcpslice 1360034885.260 1360034885.261 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.216' ============================== SEPARATOR ================================