Score:            1.0 (>= 0.8)
Infected Target:  192.168.1.102
Infector List:    89.117.248.36
Egg Source List:  <unobserved>
C & C List:       208.110.73.34
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   04/28/2013 12:19:24.234 PDT
Gen. Time:        04/28/2013 12:22:24.372 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    89.117.248.36 (12:22:24.372 PDT)
       event=1:22465 {tcp} E2[rb] GPL NETBIOS SMB-DS IPC$ share access, [] MAC_Dst: 00:21:5A:08:EC:40
          445<-4265 (12:22:24.372 PDT)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    208.110.73.34 (12:19:24.234 PDT)
       event=1:3810008 {udp} E4[nbr] ET Known Russian Business Network Monitored Domain, [] MAC_Src: 00:21:5A:08:EC:40
          44746->53 (12:19:24.234 PDT)
       
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    213.239.193.176 (12:21:35.799 PDT)
       event=1:9920020 {udp} E8[std] ET ShadowServer confirmed botnet control server on standard port, [] MAC_Src: 00:21:5A:08:EC:40
          56380->53 (12:21:35.799 PDT)
       
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1367176764.234 1367176764.235 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102'

============================== SEPARATOR ================================
Score:            1.0 (>= 0.8)
Infected Target:  192.168.1.102
Infector List:    5.0.197.224, 89.117.248.36
Egg Source List:  <unobserved>
C & C List:       208.110.73.34
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   04/28/2013 12:19:24.234 PDT
Gen. Time:        04/28/2013 12:25:54.208 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    5.0.197.224 (12:22:42.990 PDT)
       event=1:22465 {tcp} E2[rb] GPL NETBIOS SMB-DS IPC$ share access, [] MAC_Dst: 00:21:5A:08:EC:40
          445<-20877 (12:22:42.990 PDT)
       
    89.117.248.36 (12:22:24.372 PDT)
       event=1:22465 {tcp} E2[rb] GPL NETBIOS SMB-DS IPC$ share access, [] MAC_Dst: 00:21:5A:08:EC:40
          445<-4265 (12:22:24.372 PDT)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    208.110.73.34 (12:19:24.234 PDT)
       event=1:3810008 {udp} E4[nbr] ET Known Russian Business Network Monitored Domain, [] MAC_Src: 00:21:5A:08:EC:40
          44746->53 (12:19:24.234 PDT)
       
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    213.239.193.176 (12:21:35.799 PDT)
       event=1:9920020 {udp} E8[std] ET ShadowServer confirmed botnet control server on standard port, [] MAC_Src: 00:21:5A:08:EC:40
          56380->53 (12:21:35.799 PDT)
       
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1367176764.234 1367176764.235 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.102
Infector List:    201.209.200.89
Egg Source List:  201.209.200.89
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   04/28/2013 12:41:39.406 PDT
Gen. Time:        04/28/2013 12:41:43.218 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    201.209.200.89 (12:41:39.406 PDT)
       event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40
          445<-3606 (12:41:39.406 PDT)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    201.209.200.89 (12:41:43.218 PDT)
       event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00
          54877<-1334 (12:41:43.218 PDT)
       
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1367178099.406 1367178099.407 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102'

============================== SEPARATOR ================================
Score:            1.4 (>= 0.8)
Infected Target:  192.168.1.102
Infector List:    201.209.200.89
Egg Source List:  201.209.200.89
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   04/28/2013 12:41:39.406 PDT
Gen. Time:        04/28/2013 12:44:10.844 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    201.209.200.89 (12:41:39.406 PDT)
       event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40
          445<-3606 (12:41:39.406 PDT)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    201.209.200.89 (12:41:43.218 PDT)
       event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00
          54877<-1334 (12:41:43.218 PDT)
       
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    204.11.237.4 (12:43:25.947 PDT)
       event=1:9920020 {udp} E8[std] ET ShadowServer confirmed botnet control server on standard port, [] MAC_Src: 00:21:5A:08:EC:40
          54580->53 (12:43:25.947 PDT)
       
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1367178099.406 1367178099.407 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102'

============================== SEPARATOR ================================
Score:            0.9 (>= 0.8)
Infected Target:  192.168.1.102
Infector List:    5.29.53.101, 85.26.234.35
Egg Source List:  5.29.53.101
C & C List:       64.46.38.31
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   04/28/2013 13:24:06.095 PDT
Gen. Time:        04/28/2013 13:27:39.086 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    5.29.53.101 (13:27:34.974 PDT)
       event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40
          445<-1500 (13:27:34.974 PDT)
       
    85.26.234.35 (13:25:27.007 PDT)
       event=1:22465 {tcp} E2[rb] GPL NETBIOS SMB-DS IPC$ share access, [] MAC_Dst: 00:21:5A:08:EC:40
          445<-21209 (13:25:27.007 PDT)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    5.29.53.101 (13:27:39.086 PDT)
       event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00
          37979<-4834 (13:27:39.086 PDT)
       
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    64.46.38.31 (13:24:06.095 PDT)
       event=1:3810008 {udp} E4[nbr] ET Known Russian Business Network Monitored Domain, [] MAC_Src: 00:21:5A:08:EC:40
          35291->53 (13:24:06.095 PDT)
       
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1367180646.095 1367180646.096 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.102
Infector List:    189.7.2.245
Egg Source List:  189.7.2.245
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   04/28/2013 15:02:22.885 PDT
Gen. Time:        04/28/2013 15:02:25.970 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    189.7.2.245 (15:02:22.885 PDT)
       event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40
          445<-2488 (15:02:22.885 PDT)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    189.7.2.245 (15:02:25.970 PDT)
       event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00
          37450<-5090 (15:02:25.970 PDT)
       
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1367186542.885 1367186542.886 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.102
Infector List:    189.16.235.254, 85.217.187.14, 189.7.2.245
Egg Source List:  85.217.187.14, 189.7.2.245
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   04/28/2013 15:02:22.885 PDT
Gen. Time:        04/28/2013 15:10:33.512 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    189.16.235.254 (15:07:25.915 PDT)
       event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40
          445<-3680 (15:07:25.915 PDT)
       
    85.217.187.14 (15:04:04.726 PDT)
       event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40
          445<-28837 (15:04:04.726 PDT)
       
    189.7.2.245 (15:02:22.885 PDT)
       event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40
          445<-2488 (15:02:22.885 PDT)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    85.217.187.14 (15:04:10.012 PDT)
       event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00
          60116<-6387 (15:04:10.012 PDT)
       
    189.7.2.245 (15:02:25.970 PDT)
       event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00
          37450<-5090 (15:02:25.970 PDT)
       
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1367186542.885 1367186542.886 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.102
Infector List:    189.7.2.245
Egg Source List:  189.7.2.245
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   04/28/2013 15:30:30.919 PDT
Gen. Time:        04/28/2013 15:30:34.576 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    189.7.2.245 (15:30:30.919 PDT)
       event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40
          445<-4830 (15:30:30.919 PDT)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    189.7.2.245 (15:30:34.576 PDT)
       event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00
          52974<-5090 (15:30:34.576 PDT)
       
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1367188230.919 1367188230.920 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102'

============================== SEPARATOR ================================
Score:            1.4 (>= 0.8)
Infected Target:  192.168.1.102
Infector List:    189.7.2.245
Egg Source List:  189.7.2.245
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   04/28/2013 15:30:30.919 PDT
Gen. Time:        04/28/2013 15:34:42.425 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    189.7.2.245 (15:30:30.919 PDT)
       event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40
          445<-4830 (15:30:30.919 PDT)
       
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    189.7.2.245 (15:30:34.576 PDT)
       event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00
          52974<-5090 (15:30:34.576 PDT)
       
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    213.249.68.98 (15:31:38.109 PDT)
       event=1:9920020 {udp} E8[std] ET ShadowServer confirmed botnet control server on standard port, [] MAC_Src: 00:21:5A:08:EC:40
          55677->53 (15:31:38.109 PDT)
       
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1367188230.919 1367188230.920 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102'

============================== SEPARATOR ================================