Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 92.247.104.164 Egg Source List: 92.247.104.164 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 00:36:09.529 PDT Gen. Time: 05/04/2013 00:36:13.311 PDT INBOUND SCAN EXPLOIT 92.247.104.164 (00:36:09.529 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4889 (00:36:09.529 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 92.247.104.164 (00:36:13.311 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 51907<-3977 (00:36:13.311 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367652969.529 1367652969.530 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 80.66.157.34 Egg Source List: 80.66.157.34 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 00:46:44.129 PDT Gen. Time: 05/04/2013 00:46:47.923 PDT INBOUND SCAN EXPLOIT 80.66.157.34 (00:46:44.129 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3473 (00:46:44.129 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 80.66.157.34 (00:46:47.923 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 39469<-6473 (00:46:47.923 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367653604.129 1367653604.130 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 114.44.189.64 Egg Source List: 114.44.189.64 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 00:54:48.302 PDT Gen. Time: 05/04/2013 00:54:53.214 PDT INBOUND SCAN EXPLOIT 114.44.189.64 (00:54:48.302 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1857 (00:54:48.302 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 114.44.189.64 (00:54:53.214 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 41884<-3453 (00:54:53.214 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367654088.302 1367654088.303 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 184.106.144.25 Egg Source List: 184.106.144.25 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 00:59:52.518 PDT Gen. Time: 05/04/2013 00:59:55.936 PDT INBOUND SCAN EXPLOIT 184.106.144.25 (00:59:52.518 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4325 (00:59:52.518 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 184.106.144.25 (00:59:55.936 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 53947<-6133 (00:59:55.936 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367654392.518 1367654392.519 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 62.201.90.90 Egg Source List: 62.201.90.90 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 01:11:32.527 PDT Gen. Time: 05/04/2013 01:11:35.373 PDT INBOUND SCAN EXPLOIT 62.201.90.90 (01:11:32.527 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2568 (01:11:32.527 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 62.201.90.90 (01:11:35.373 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 59709<-9092 (01:11:35.373 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367655092.527 1367655092.528 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 1.3 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 62.201.90.90 Egg Source List: 62.201.90.90 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 01:11:32.527 PDT Gen. Time: 05/04/2013 03:48:33.532 PDT INBOUND SCAN EXPLOIT 62.201.90.90 (17) (01:11:32.527 PDT) event=1:22009201 (17) {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2568 (01:11:32.527 PDT) 445<-3290 (01:11:47.769 PDT) 445<-4254 (01:12:03.507 PDT) 445<-1360 (01:12:16.913 PDT) 445<-2549 (01:12:38.011 PDT) 445<-3404 (01:12:55.441 PDT) 445<-4409 (01:13:10.437 PDT) 445<-1620 (01:13:22.337 PDT) 445<-2224 (01:13:37.085 PDT) 445<-3137 (01:13:49.073 PDT) 445<-3821 (01:14:04.411 PDT) 445<-4991 (01:14:17.639 PDT) 445<-1757 (01:14:31.675 PDT) 445<-2573 (01:14:43.461 PDT) 445<-3329 (01:14:58.609 PDT) 445<-4150 (01:15:10.207 PDT) 445<-1176 (01:15:23.881 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 62.201.90.90 (17) (01:11:35.373 PDT) event=1:2001685 (17) {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 59709<-9092 (01:11:35.373 PDT) 59727<-9092 (01:11:51.185 PDT) 59735<-9092 (01:12:06.783 PDT) 59749<-9092 (01:12:21.129 PDT) 59770<-9092 (01:12:41.355 PDT) 59791<-9092 (01:12:59.857 PDT) 59807<-9092 (01:13:14.709 PDT) 59811<-9092 (01:13:26.907 PDT) 59827<-9092 (01:13:40.141 PDT) 59831<-9092 (01:13:53.321 PDT) 59843<-9092 (01:14:08.195 PDT) 59848<-9092 (01:14:21.127 PDT) 59855<-9092 (01:14:36.571 PDT) 59871<-9092 (01:14:47.411 PDT) 59880<-9092 (01:15:02.749 PDT) 59897<-9092 (01:15:14.353 PDT) 59900<-9092 (01:15:26.825 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN 109.230.220.193 (02:52:45.004 PDT) event=1:2008578 {udp} E5[rb] ET SCAN Sipvicious Scan, [] MAC_Src: 00:21:5A:08:EC:40 5060->5060 (02:52:45.004 PDT) 5.152.204.218 (02:34:32.845 PDT) event=1:2008578 {udp} E5[rb] ET SCAN Sipvicious Scan, [] MAC_Src: 00:21:5A:08:EC:40 5060->5060 (02:34:32.845 PDT) ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367655092.527 1367655092.528 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 92.36.217.11 Egg Source List: 92.36.217.11 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 03:50:57.459 PDT Gen. Time: 05/04/2013 03:51:02.836 PDT INBOUND SCAN EXPLOIT 92.36.217.11 (03:50:57.459 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3410 (03:50:57.459 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 92.36.217.11 (03:51:02.836 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 58163<-1868 (03:51:02.836 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367664657.459 1367664657.460 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 92.36.217.11 Egg Source List: 92.36.217.11, 192.168.2.2 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 03:50:57.459 PDT Gen. Time: 05/04/2013 03:55:42.197 PDT INBOUND SCAN EXPLOIT 92.36.217.11 (03:50:57.459 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3410 (03:50:57.459 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 92.36.217.11 (03:51:02.836 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 58163<-1868 (03:51:02.836 PDT) 192.168.2.2 (16) (03:51:39.690 PDT-03:52:04.896 PDT) event=1:1444 (5) {udp} E3[rb] TFTP GET from external source, [] MAC_Src: 00:21:5A:08:EC:40 5: 50965->69 (03:51:39.690 PDT-03:51:59.791 PDT) ------------------------- event=1:2008120 (5) {udp} E3[rb] ET POLICY Outbound TFTP Read Request, [] MAC_Src: 00:21:5A:08:EC:40 5: 50965->69 (03:51:39.690 PDT-03:51:59.791 PDT) ------------------------- event=1:3001441 (6) {udp} E3[rb] TFTP GET .exe from external source, [] MAC_Src: 00:21:5A:08:EC:40 6: 50965->69 (03:51:39.690 PDT-03:52:04.896 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367664657.459 1367664724.897 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 95.28.103.20 Egg Source List: 95.28.103.20 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 03:58:19.913 PDT Gen. Time: 05/04/2013 03:58:22.787 PDT INBOUND SCAN EXPLOIT 95.28.103.20 (03:58:19.913 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1036 (03:58:19.913 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 95.28.103.20 (03:58:22.787 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 45701<-8933 (03:58:22.787 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367665099.913 1367665099.914 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 95.28.103.20 Egg Source List: 95.28.103.20 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 04:11:07.178 PDT Gen. Time: 05/04/2013 04:11:13.951 PDT INBOUND SCAN EXPLOIT 95.28.103.20 (04:11:07.178 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3899 (04:11:07.178 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 95.28.103.20 (04:11:13.951 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 54974<-8933 (04:11:13.951 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367665867.178 1367665867.179 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 95.28.103.20, 31.176.160.25 Egg Source List: 95.28.103.20 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 04:29:22.397 PDT Gen. Time: 05/04/2013 04:29:30.652 PDT INBOUND SCAN EXPLOIT 95.28.103.20 (04:29:22.397 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1592 (04:29:22.397 PDT) 31.176.160.25 (04:29:25.877 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1631 (04:29:25.877 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 95.28.103.20 (04:29:30.652 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 35049<-8933 (04:29:30.652 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367666962.397 1367666962.398 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 95.28.103.20, 31.176.160.25 Egg Source List: 95.28.103.20, 31.176.160.25 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 04:29:22.397 PDT Gen. Time: 05/04/2013 04:33:32.480 PDT INBOUND SCAN EXPLOIT 95.28.103.20 (04:29:22.397 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1592 (04:29:22.397 PDT) 31.176.160.25 (04:29:25.877 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1631 (04:29:25.877 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 95.28.103.20 (04:29:30.652 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 35049<-8933 (04:29:30.652 PDT) 31.176.160.25 (04:29:30.986 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 49735<-4910 (04:29:30.986 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367666962.397 1367666962.398 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 85.117.4.111 Egg Source List: 85.117.4.111 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 04:39:22.860 PDT Gen. Time: 05/04/2013 04:39:27.642 PDT INBOUND SCAN EXPLOIT 85.117.4.111 (04:39:22.860 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4912 (04:39:22.860 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 85.117.4.111 (04:39:27.642 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 47458<-7720 (04:39:27.642 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367667562.860 1367667562.861 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 2.95.32.31, 109.228.107.76 Egg Source List: 2.95.32.31 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 04:43:09.853 PDT Gen. Time: 05/04/2013 04:44:23.981 PDT INBOUND SCAN EXPLOIT 2.95.32.31 (04:44:13.082 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4703 (04:44:13.082 PDT) 109.228.107.76 (04:43:09.853 PDT) event=1:22465 {tcp} E2[rb] GPL NETBIOS SMB-DS IPC$ share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2587 (04:43:09.853 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 2.95.32.31 (04:44:23.981 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 40739<-5588 (04:44:23.981 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367667789.853 1367667789.854 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 93.95.188.15 Egg Source List: 93.95.188.15 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 05:24:10.146 PDT Gen. Time: 05/04/2013 05:24:12.912 PDT INBOUND SCAN EXPLOIT 93.95.188.15 (05:24:10.146 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4061 (05:24:10.146 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 93.95.188.15 (05:24:12.912 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 53509<-4047 (05:24:12.912 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367670250.146 1367670250.147 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 62.201.90.90 Egg Source List: 62.201.90.90 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 05:27:53.235 PDT Gen. Time: 05/04/2013 05:27:56.364 PDT INBOUND SCAN EXPLOIT 62.201.90.90 (05:27:53.235 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1183 (05:27:53.235 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 62.201.90.90 (05:27:56.364 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 47301<-9092 (05:27:56.364 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367670473.235 1367670473.236 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 62.201.90.90 Egg Source List: 62.201.90.90 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 05:27:53.235 PDT Gen. Time: 05/04/2013 06:02:51.051 PDT INBOUND SCAN EXPLOIT 62.201.90.90 (17) (05:27:53.235 PDT) event=1:22009201 (17) {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1183 (05:27:53.235 PDT) 445<-1619 (05:28:06.861 PDT) 445<-2189 (05:28:23.475 PDT) 445<-2767 (05:28:42.191 PDT) 445<-3317 (05:28:56.301 PDT) 445<-3853 (05:29:12.297 PDT) 445<-4451 (05:29:30.913 PDT) 445<-1203 (05:29:45.009 PDT) 445<-1682 (05:29:58.415 PDT) 445<-2259 (05:30:17.423 PDT) 445<-2832 (05:30:29.427 PDT) 445<-3288 (05:30:47.077 PDT) 445<-3966 (05:31:03.287 PDT) 445<-4459 (05:31:20.167 PDT) 445<-1212 (05:31:33.553 PDT) 445<-1651 (05:31:50.249 PDT) 445<-2272 (05:32:05.487 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 62.201.90.90 (17) (05:27:56.364 PDT) event=1:2001685 (17) {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 47301<-9092 (05:27:56.364 PDT) 47311<-9092 (05:28:10.351 PDT) 47322<-9092 (05:28:26.653 PDT) 47342<-9092 (05:29:00.503 PDT) 47359<-9092 (05:29:16.165 PDT) 47373<-9092 (05:29:35.063 PDT) 47384<-9092 (05:29:49.077 PDT) 47394<-9092 (05:30:02.559 PDT) 47410<-9092 (05:30:21.279 PDT) 47416<-9092 (05:30:34.131 PDT) 47430<-9092 (05:30:51.977 PDT) 44371<-9092 (05:31:08.125 PDT) 44385<-9092 (05:31:23.927 PDT) 44391<-9092 (05:31:37.343 PDT) 44412<-9092 (05:31:55.205 PDT) 44427<-9092 (05:32:10.293 PDT) 44435<-9092 (05:32:28.849 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367670473.235 1367670473.236 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 92.247.104.130 Egg Source List: 92.247.104.130 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 06:25:22.407 PDT Gen. Time: 05/04/2013 06:25:25.971 PDT INBOUND SCAN EXPLOIT 92.247.104.130 (06:25:22.407 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3265 (06:25:22.407 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 92.247.104.130 (06:25:25.971 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 39720<-3977 (06:25:25.971 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367673922.407 1367673922.408 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 92.247.104.130 Egg Source List: 92.247.104.130 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 06:25:22.407 PDT Gen. Time: 05/04/2013 06:46:45.992 PDT INBOUND SCAN EXPLOIT 92.247.104.130 (17) (06:25:22.407 PDT) event=1:22009201 (17) {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3265 (06:25:22.407 PDT) 445<-4129 (06:25:35.530 PDT) 445<-1209 (06:25:54.292 PDT) 445<-2749 (06:26:17.574 PDT) 445<-3961 (06:26:34.676 PDT) 445<-1383 (06:26:51.642 PDT) 445<-2826 (06:28:12.939 PDT) 445<-3799 (06:28:30.839 PDT) 445<-1247 (06:28:48.409 PDT) 445<-4930 (06:29:41.032 PDT) 445<-2063 (06:30:01.368 PDT) 445<-3335 (06:30:21.597 PDT) 445<-1515 (06:30:52.033 PDT) 445<-2403 (06:31:06.795 PDT) 445<-3364 (06:31:24.563 PDT) 445<-4865 (06:31:48.837 PDT) 445<-2099 (06:32:05.314 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 92.247.104.130 (17) (06:25:25.971 PDT) event=1:2001685 (17) {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 39720<-3977 (06:25:25.971 PDT) 39733<-3977 (06:25:39.852 PDT) 55961<-3977 (06:25:59.793 PDT) 55983<-3977 (06:26:23.448 PDT) 56001<-3977 (06:26:38.771 PDT) 56029<-3977 (06:26:56.594 PDT) 56091<-3977 (06:28:16.694 PDT) 56098<-3977 (06:28:35.314 PDT) 56125<-3977 (06:28:53.130 PDT) 56203<-3977 (06:29:45.841 PDT) 56223<-3977 (06:30:06.866 PDT) 56243<-3977 (06:30:26.654 PDT) 59506<-3977 (06:30:55.196 PDT) 59527<-3977 (06:31:10.883 PDT) 59541<-3977 (06:31:28.768 PDT) 59569<-3977 (06:31:52.455 PDT) 59585<-3977 (06:32:11.052 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367673922.407 1367673922.408 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 212.117.43.184 Egg Source List: 212.117.43.184 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 07:08:50.794 PDT Gen. Time: 05/04/2013 07:08:54.615 PDT INBOUND SCAN EXPLOIT 212.117.43.184 (07:08:50.794 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3408 (07:08:50.794 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 212.117.43.184 (07:08:54.615 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 59340<-2889 (07:08:54.615 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367676530.794 1367676530.795 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 2.95.32.31 Egg Source List: 2.95.32.31 C & C List: Peer Coord. List: Resource List: Observed Start: 05/04/2013 09:00:43.205 PDT Gen. Time: 05/04/2013 09:00:46.575 PDT INBOUND SCAN EXPLOIT 2.95.32.31 (09:00:43.205 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1631 (09:00:43.205 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 2.95.32.31 (09:00:46.575 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 55509<-5588 (09:00:46.575 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1367683243.205 1367683243.206 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 94.74.160.99 Egg Source List: 94.74.160.99 C & C List: Peer Coord. List: Resource List: