Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 177.32.99.161, 77.193.55.86, 2.220.154.44, 178.239.54.151, 98.127.248.93
Resource List:    <unobserved>
Observed Start:   04/07/2013 00:39:10.613 PDT
Gen. Time:        04/07/2013 00:41:41.587 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    177.32.99.161 (00:39:10.613 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->10506 (00:39:10.613 PDT)
       
    77.193.55.86 (00:40:10.846 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->63805 (00:40:10.846 PDT)
       
    2.220.154.44 (00:41:10.195 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->29259 (00:41:10.195 PDT)
       
    178.239.54.151 (00:39:31.382 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          53230->2710 (00:39:31.382 PDT)
       
    98.127.248.93 (00:41:10.789 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          53571->6890 (00:41:10.789 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (00:41:41.587 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          53774->6099 (00:41:41.587 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365320350.613 1365320350.614 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 177.32.99.161, 77.193.55.86, 2.220.154.44, 178.239.54.151, 98.127.248.93, 137.147.177.3
Resource List:    <unobserved>
Observed Start:   04/07/2013 00:39:10.613 PDT
Gen. Time:        04/07/2013 00:42:12.092 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    177.32.99.161 (00:39:10.613 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->10506 (00:39:10.613 PDT)
       
    77.193.55.86 (00:40:10.846 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->63805 (00:40:10.846 PDT)
       
    2.220.154.44 (00:41:10.195 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->29259 (00:41:10.195 PDT)
       
    178.239.54.151 (00:39:31.382 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          53230->2710 (00:39:31.382 PDT)
       
    98.127.248.93 (00:41:10.789 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          53571->6890 (00:41:10.789 PDT)
       
    137.147.177.3 (00:42:12.092 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->53448 (00:42:12.092 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (00:41:41.587 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          53774->6099 (00:41:41.587 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365320350.613 1365320350.614 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 82.95.222.113, 46.240.47.228, 98.127.248.93
Resource List:    <unobserved>
Observed Start:   04/07/2013 02:40:20.589 PDT
Gen. Time:        04/07/2013 02:42:00.236 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    82.95.222.113 (02:40:27.188 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->44866 (02:40:27.188 PDT)
       
    46.240.47.228 (02:41:27.288 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->19678 (02:41:27.288 PDT)
       
    98.127.248.93 (02:40:20.589 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          50170->6890 (02:40:20.589 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (02:42:00.236 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (02:42:00.236 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365327620.589 1365327620.590 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 124.170.218.199, 189.101.100.209, 82.95.222.113, 46.240.47.228, 98.127.248.93 (2)
Resource List:    <unobserved>
Observed Start:   04/07/2013 02:40:20.589 PDT
Gen. Time:        04/07/2013 02:44:25.703 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    124.170.218.199 (02:42:27.692 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->62983 (02:42:27.692 PDT)
       
    189.101.100.209 (02:43:27.340 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6881 (02:43:27.340 PDT)
       
    82.95.222.113 (02:40:27.188 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->44866 (02:40:27.188 PDT)
       
    46.240.47.228 (02:41:27.288 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->19678 (02:41:27.288 PDT)
       
    98.127.248.93 (2) (02:40:20.589 PDT)
       event=1:1100012 (2) {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          50170->6890 (02:40:20.589 PDT)
          50809->6890 (02:42:12.117 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (02:42:00.236 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (02:42:00.236 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365327620.589 1365327620.590 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 98.127.248.93, 2.231.176.18
Resource List:    <unobserved>
Observed Start:   04/07/2013 04:43:12.115 PDT
Gen. Time:        04/07/2013 04:43:31.015 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    98.127.248.93 (04:43:20.685 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          53609->6890 (04:43:20.685 PDT)
       
    2.231.176.18 (04:43:12.115 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->12291 (04:43:12.115 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (04:43:31.015 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          53705->6099 (04:43:31.015 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365334992.115 1365334992.116 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 70.116.133.154, 144.64.44.110, 178.239.54.151, 108.70.88.136, 95.180.90.3, 98.127.248.93 (2), 2.231.176.18, 121.14.98.151
Resource List:    <unobserved>
Observed Start:   04/07/2013 04:43:12.115 PDT
Gen. Time:        04/07/2013 04:47:12.328 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    70.116.133.154 (04:47:12.328 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->58008 (04:47:12.328 PDT)
       
    144.64.44.110 (04:46:12.389 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->34650 (04:46:12.389 PDT)
       
    178.239.54.151 (04:46:21.685 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          55009->2710 (04:46:21.685 PDT)
       
    108.70.88.136 (04:45:12.097 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->13835 (04:45:12.097 PDT)
       
    95.180.90.3 (04:44:12.908 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->55437 (04:44:12.908 PDT)
       
    98.127.248.93 (2) (04:43:20.685 PDT)
       event=1:1100012 (2) {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          53609->6890 (04:43:20.685 PDT)
          55063->6890 (04:46:24.242 PDT)
       
    2.231.176.18 (04:43:12.115 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->12291 (04:43:12.115 PDT)
       
    121.14.98.151 (04:45:21.328 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          54668->9090 (04:45:21.328 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (04:43:31.015 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          53705->6099 (04:43:31.015 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365334992.115 1365334992.116 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   04/07/2013 06:43:50.995 PDT
Gen. Time:        04/07/2013 06:43:50.995 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (06:43:50.995 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (06:43:50.995 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365342230.995 1365342230.996 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 84.29.162.95, 190.131.113.59, 108.35.182.217, 5.14.8.97, 178.239.54.151, 121.14.98.151
Resource List:    <unobserved>
Observed Start:   04/07/2013 06:43:50.995 PDT
Gen. Time:        04/07/2013 06:47:40.366 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    84.29.162.95 (06:44:09.611 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->36139 (06:44:09.611 PDT)
       
    190.131.113.59 (06:46:09.455 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->56364 (06:46:09.455 PDT)
       
    108.35.182.217 (06:47:10.158 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->55845 (06:47:10.158 PDT)
       
    5.14.8.97 (06:45:09.209 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->64373 (06:45:09.209 PDT)
       
    178.239.54.151 (06:47:01.348 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          57183->2710 (06:47:01.348 PDT)
       
    121.14.98.151 (06:45:51.985 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          56785->9090 (06:45:51.985 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (06:43:50.995 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (06:43:50.995 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365342230.995 1365342230.996 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 5.14.8.97
Resource List:    <unobserved>
Observed Start:   04/07/2013 08:45:17.202 PDT
Gen. Time:        04/07/2013 08:45:50.801 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    5.14.8.97 (08:45:17.202 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->64373 (08:45:17.202 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (08:45:50.801 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          52669->6099 (08:45:50.801 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365349517.202 1365349517.203 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 69.172.82.39, 150.101.100.2, 5.14.8.97, 121.14.98.151
Resource List:    <unobserved>
Observed Start:   04/07/2013 08:45:17.202 PDT
Gen. Time:        04/07/2013 08:47:17.691 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    69.172.82.39 (08:47:17.691 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->51413 (08:47:17.691 PDT)
       
    150.101.100.2 (08:46:17.242 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->60053 (08:46:17.242 PDT)
       
    5.14.8.97 (08:45:17.202 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->64373 (08:45:17.202 PDT)
       
    121.14.98.151 (08:46:31.932 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          53026->9090 (08:46:31.932 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (08:45:50.801 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          52669->6099 (08:45:50.801 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365349517.202 1365349517.203 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 60.34.181.249, 90.177.15.195
Resource List:    <unobserved>
Observed Start:   04/07/2013 10:45:31.375 PDT
Gen. Time:        04/07/2013 10:46:51.138 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    60.34.181.249 (10:45:31.375 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->51413 (10:45:31.375 PDT)
       
    90.177.15.195 (10:46:31.421 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->48972 (10:46:31.421 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (10:46:51.138 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (10:46:51.138 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365356731.375 1365356731.376 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 36.1.109.132, 60.34.181.249, 94.209.46.10, 90.177.15.195, 121.14.98.151
Resource List:    <unobserved>
Observed Start:   04/07/2013 10:45:31.375 PDT
Gen. Time:        04/07/2013 10:49:05.694 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    36.1.109.132 (10:48:32.496 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->13565 (10:48:32.496 PDT)
       
    60.34.181.249 (10:45:31.375 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->51413 (10:45:31.375 PDT)
       
    94.209.46.10 (10:47:32.017 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->16335 (10:47:32.017 PDT)
       
    90.177.15.195 (10:46:31.421 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->48972 (10:46:31.421 PDT)
       
    121.14.98.151 (10:47:12.293 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          52952->9090 (10:47:12.293 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (10:46:51.138 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (10:46:51.138 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365356731.375 1365356731.376 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 193.152.150.114, 96.52.247.193, 201.243.61.64, 93.46.117.233, 121.14.98.151
Resource List:    <unobserved>
Observed Start:   04/07/2013 12:45:15.116 PDT
Gen. Time:        04/07/2013 12:48:41.571 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    193.152.150.114 (12:48:16.331 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->22797 (12:48:16.331 PDT)
       
    96.52.247.193 (12:46:15.826 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->15937 (12:46:15.826 PDT)
       
    201.243.61.64 (12:47:15.738 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->47942 (12:47:15.738 PDT)
       
    93.46.117.233 (12:45:15.116 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->25565 (12:45:15.116 PDT)
       
    121.14.98.151 (12:47:51.373 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          54707->9090 (12:47:51.373 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (12:48:41.571 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          55200->6099 (12:48:41.571 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365363915.116 1365363915.117 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 193.152.150.114, 96.52.247.193, 166.78.158.73, 201.243.61.64, 93.46.117.233, 121.14.98.151
Resource List:    <unobserved>
Observed Start:   04/07/2013 12:45:15.116 PDT
Gen. Time:        04/07/2013 12:49:16.009 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    193.152.150.114 (12:48:16.331 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->22797 (12:48:16.331 PDT)
       
    96.52.247.193 (12:46:15.826 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->15937 (12:46:15.826 PDT)
       
    166.78.158.73 (12:48:51.941 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          55245->6969 (12:48:51.941 PDT)
       
    201.243.61.64 (12:47:15.738 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->47942 (12:47:15.738 PDT)
       
    93.46.117.233 (12:45:15.116 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->25565 (12:45:15.116 PDT)
       
    121.14.98.151 (12:47:51.373 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          54707->9090 (12:47:51.373 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (12:48:41.571 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          55200->6099 (12:48:41.571 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365363915.116 1365363915.117 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 190.244.16.33, 24.89.230.155, 213.138.185.93, 121.14.98.151
Resource List:    <unobserved>
Observed Start:   04/07/2013 16:48:16.005 PDT
Gen. Time:        04/07/2013 16:50:30.974 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    190.244.16.33 (16:50:16.568 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->59605 (16:50:16.568 PDT)
       
    24.89.230.155 (16:49:16.241 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->45862 (16:49:16.241 PDT)
       
    213.138.185.93 (16:48:16.005 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->43057 (16:48:16.005 PDT)
       
    121.14.98.151 (16:49:01.372 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          61954->9090 (16:49:01.372 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (16:50:30.974 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          62655->6099 (16:50:30.974 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365378496.005 1365378496.006 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 86.18.214.169, 190.244.16.33, 24.89.230.155, 213.138.185.93, 121.14.98.151
Resource List:    <unobserved>
Observed Start:   04/07/2013 16:48:16.005 PDT
Gen. Time:        04/07/2013 16:52:12.393 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    86.18.214.169 (16:51:17.798 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->43441 (16:51:17.798 PDT)
       
    190.244.16.33 (16:50:16.568 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->59605 (16:50:16.568 PDT)
       
    24.89.230.155 (16:49:16.241 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->45862 (16:49:16.241 PDT)
       
    213.138.185.93 (16:48:16.005 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->43057 (16:48:16.005 PDT)
       
    121.14.98.151 (16:49:01.372 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          61954->9090 (16:49:01.372 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (16:50:30.974 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          62655->6099 (16:50:30.974 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365378496.005 1365378496.006 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 67.231.235.18, 41.233.20.92, 218.102.114.137, 121.14.98.151
Resource List:    <unobserved>
Observed Start:   04/07/2013 18:49:31.693 PDT
Gen. Time:        04/07/2013 18:51:30.971 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    67.231.235.18 (18:49:37.936 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->15000 (18:49:37.936 PDT)
       
    41.233.20.92 (18:50:37.847 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->29733 (18:50:37.847 PDT)
       
    218.102.114.137 (18:50:52.365 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          65167->9742 (18:50:52.365 PDT)
       
    121.14.98.151 (18:49:31.693 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          64702->9090 (18:49:31.693 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (18:51:30.971 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (18:51:30.971 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365385771.693 1365385771.694 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 80.232.243.157, 67.231.235.18, 41.233.20.92, 218.102.114.137, 121.14.98.151, 202.67.117.169
Resource List:    <unobserved>
Observed Start:   04/07/2013 18:49:31.693 PDT
Gen. Time:        04/07/2013 18:53:32.242 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    80.232.243.157 (18:51:42.552 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6881 (18:51:42.552 PDT)
       
    67.231.235.18 (18:49:37.936 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->15000 (18:49:37.936 PDT)
       
    41.233.20.92 (18:50:37.847 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->29733 (18:50:37.847 PDT)
       
    218.102.114.137 (18:50:52.365 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          65167->9742 (18:50:52.365 PDT)
       
    121.14.98.151 (18:49:31.693 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          64702->9090 (18:49:31.693 PDT)
       
    202.67.117.169 (18:52:43.125 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->45007 (18:52:43.125 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (18:51:30.971 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (18:51:30.971 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365385771.693 1365385771.694 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 50.99.101.108
Resource List:    <unobserved>
Observed Start:   04/07/2013 20:52:39.144 PDT
Gen. Time:        04/07/2013 20:53:20.844 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    50.99.101.108 (20:52:39.144 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->39495 (20:52:39.144 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (20:53:20.844 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          63664->6099 (20:53:20.844 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365393159.144 1365393159.145 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 122.148.136.127, 2.103.233.177, 212.198.85.40, 50.99.101.108
Resource List:    <unobserved>
Observed Start:   04/07/2013 20:52:39.144 PDT
Gen. Time:        04/07/2013 20:55:40.434 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    122.148.136.127 (20:53:40.503 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->38753 (20:53:40.503 PDT)
       
    2.103.233.177 (20:54:40.945 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->46048 (20:54:40.945 PDT)
       
    212.198.85.40 (20:55:40.434 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->56480 (20:55:40.434 PDT)
       
    50.99.101.108 (20:52:39.144 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->39495 (20:52:39.144 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (20:53:20.844 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          63664->6099 (20:53:20.844 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365393159.144 1365393159.145 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   04/07/2013 22:54:10.871 PDT
Gen. Time:        04/07/2013 22:54:10.871 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (22:54:10.871 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (22:54:10.871 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365400450.871 1365400450.872 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 93.70.77.160, 87.2.246.175, 98.26.19.64, 2.216.3.209, 202.67.117.169
Resource List:    <unobserved>
Observed Start:   04/07/2013 22:54:10.871 PDT
Gen. Time:        04/07/2013 22:57:15.517 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    93.70.77.160 (22:55:40.060 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          53572->6890 (22:55:40.060 PDT)
       
    87.2.246.175 (22:55:15.100 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->18135 (22:55:15.100 PDT)
       
    98.26.19.64 (22:54:15.366 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->48263 (22:54:15.366 PDT)
       
    2.216.3.209 (22:57:15.517 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->64050 (22:57:15.517 PDT)
       
    202.67.117.169 (22:56:15.070 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->45007 (22:56:15.070 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (22:54:10.871 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (22:54:10.871 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1365400450.871 1365400450.872 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================