Score: 1.1 (>= 0.8) Infected Target: 192.168.1.224 Infector List: Egg Source List: C & C List: Peer Coord. List: Resource List: Observed Start: 02/05/2013 00:44:29.174 PST Gen. Time: 02/05/2013 00:44:30.097 PST INBOUND SCAN EXPLOIT EXPLOIT MALWARE DNS EGG DOWNLOAD C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) 130.152.52.226 (00:44:29.174 PST) event=777:7777005 {tcp} E5[bh] Detected moderate malware port scanning of 11 IPs (11 /24s) (# pkts S/M/O/I=0/10/1/0): 445:9, 22, [] MAC_Src: 00:21:1C:EE:14:00 0->0 (00:44:29.174 PST) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN 130.152.52.226 (00:44:30.097 PST) event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/20/1/0): 445:19, 22, [] MAC_Src: 00:21:1C:EE:14:00 0->0 (00:44:30.097 PST) tcpslice 1360053869.174 1360053869.175 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.224' ============================== SEPARATOR ================================ Score: 1.1 (>= 0.8) Infected Target: 192.168.1.224 Infector List: Egg Source List: C & C List: Peer Coord. List: Resource List: Observed Start: 02/05/2013 05:43:37.365 PST Gen. Time: 02/05/2013 05:43:38.312 PST INBOUND SCAN EXPLOIT EXPLOIT MALWARE DNS EGG DOWNLOAD C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) 130.96.52.89 (05:43:37.365 PST) event=777:7777005 {tcp} E5[bh] Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10, [] MAC_Src: 00:30:48:30:03:AF 0->0 (05:43:37.365 PST) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN 130.173.195.244 (05:43:38.312 PST) event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21, [] MAC_Src: 00:30:48:30:03:AF 0->0 (05:43:38.312 PST) tcpslice 1360071817.365 1360071817.366 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.224' ============================== SEPARATOR ================================ Score: 1.1 (>= 0.8) Infected Target: 192.168.1.224 Infector List: Egg Source List: C & C List: Peer Coord. List: Resource List: Observed Start: 02/05/2013 14:23:57.200 PST Gen. Time: 02/05/2013 14:23:57.353 PST INBOUND SCAN EXPLOIT EXPLOIT MALWARE DNS EGG DOWNLOAD C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) 130.177.209.127 (14:23:57.200 PST) event=777:7777005 {tcp} E5[bh] Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 445:10, [] MAC_Src: 00:30:48:30:03:AF 0->0 (14:23:57.200 PST) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN 130.148.211.27 (14:23:57.353 PST) event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 445:21, [] MAC_Src: 00:30:48:30:03:AF 0->0 (14:23:57.353 PST) tcpslice 1360103037.200 1360103037.201 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.224' ============================== SEPARATOR ================================ Score: 1.1 (>= 0.8) Infected Target: 192.168.1.224 Infector List: Egg Source List: C & C List: Peer Coord. List: Resource List: Observed Start: 02/05/2013 17:39:02.978 PST Gen. Time: 02/05/2013 17:39:03.365 PST INBOUND SCAN EXPLOIT EXPLOIT MALWARE DNS EGG DOWNLOAD C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) 130.190.24.61 (17:39:02.978 PST) event=777:7777005 {tcp} E5[bh] Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 135:10, [] MAC_Src: 00:30:48:30:03:AF 0->0 (17:39:02.978 PST) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN 130.190.24.61 (17:39:03.365 PST) event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (21 /24s) (# pkts S/M/O/I=0/21/0/0): 135:21, [] MAC_Src: 00:30:48:30:03:AF 0->0 (17:39:03.365 PST) tcpslice 1360114742.978 1360114742.979 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.224' ============================== SEPARATOR ================================