Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 222.168.45.154, 217.133.61.36 Egg Source List: 186.46.43.34 C & C List: Peer Coord. List: Resource List: Observed Start: 06/04/2013 23:53:10.076 PDT Gen. Time: 06/05/2013 00:17:33.456 PDT INBOUND SCAN EXPLOIT 222.168.45.154 (7) (23:54:44.725 PDT) event=1:22469 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2880 (23:58:17.031 PDT) 445<-1205 (23:59:49.107 PDT) 445<-2999 (00:03:51.768 PDT) ------------------------- event=1:22472 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1628 (23:54:45.658 PDT) 445<-3839 (23:56:18.235 PDT) 445<-2880 (23:58:16.277 PDT) ------------------------- event=1:22475 {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1628 (23:54:44.725 PDT) 217.133.61.36 (10) (23:53:10.076 PDT) event=1:22469 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2495 (23:57:44.701 PDT) 445<-4589 (23:58:49.531 PDT) ------------------------- event=1:22472 (4) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1309 (23:54:18.894 PDT) 445<-4181 (23:56:02.288 PDT) 445<-3685 (00:03:57.967 PDT) 445<-2317 (00:05:41.521 PDT) ------------------------- event=1:22475 (4) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1086 (23:53:10.076 PDT) 445<-1290 (00:01:07.792 PDT) 445<-1489 (00:02:14.572 PDT) 445<-3011 (00:07:33.333 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 186.46.43.34 (00:17:33.456 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 50250<-8848 (00:17:33.456 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370415190.076 1370415190.077 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 222.168.45.154, 178.206.217.184, 217.133.61.36 Egg Source List: 178.206.217.184 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 00:35:13.697 PDT Gen. Time: 06/05/2013 00:38:15.475 PDT INBOUND SCAN EXPLOIT 222.168.45.154 (4) (00:35:49.326 PDT) event=1:22472 {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3362 (00:40:29.323 PDT) ------------------------- event=1:22475 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1791 (00:35:49.326 PDT) 445<-3700 (00:37:25.041 PDT) 445<-3362 (00:40:26.390 PDT) 178.206.217.184 (00:38:11.652 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3756 (00:38:11.652 PDT) 217.133.61.36 (5) (00:35:13.697 PDT) event=1:22469 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2411 (00:39:13.361 PDT) 445<-3771 (00:40:24.814 PDT) ------------------------- event=1:22472 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2110 (00:36:23.551 PDT) 445<-3025 (00:37:31.512 PDT) ------------------------- event=1:22475 {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4852 (00:35:13.697 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 178.206.217.184 (00:38:15.475 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 33667<-4688 (00:38:15.475 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370417713.697 1370417713.698 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 222.168.45.154, 178.206.217.184, 217.133.61.36 Egg Source List: 178.206.217.184 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 00:35:13.697 PDT Gen. Time: 06/05/2013 00:48:15.270 PDT INBOUND SCAN EXPLOIT 222.168.45.154 (8) (00:35:49.326 PDT) event=1:22469 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3092 (00:43:24.485 PDT) 445<-3044 (00:46:27.321 PDT) 445<-4876 (00:47:59.102 PDT) ------------------------- event=1:22472 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3362 (00:40:29.323 PDT) 445<-1333 (00:41:53.303 PDT) ------------------------- event=1:22475 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1791 (00:35:49.326 PDT) 445<-3700 (00:37:25.041 PDT) 445<-3362 (00:40:26.390 PDT) 178.206.217.184 (2) (00:38:11.652 PDT) event=1:22009201 (2) {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3756 (00:38:11.652 PDT) 445<-1748 (00:45:09.165 PDT) 217.133.61.36 (7) (00:35:13.697 PDT) event=1:22469 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2411 (00:39:13.361 PDT) 445<-3771 (00:40:24.814 PDT) ------------------------- event=1:22472 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2110 (00:36:23.551 PDT) 445<-3025 (00:37:31.512 PDT) ------------------------- event=1:22475 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4852 (00:35:13.697 PDT) 445<-3041 (00:44:58.178 PDT) 445<-4416 (00:47:10.979 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 178.206.217.184 (2) (00:38:15.475 PDT) event=1:2001685 (2) {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 33667<-4688 (00:38:15.475 PDT) 41371<-4688 (00:45:12.106 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370417713.697 1370417713.698 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 222.168.45.154, 178.206.217.184, 217.133.61.36 Egg Source List: 178.206.217.184 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 00:48:54.723 PDT Gen. Time: 06/05/2013 00:52:03.457 PDT INBOUND SCAN EXPLOIT 222.168.45.154 (4) (00:49:32.428 PDT) event=1:22472 {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2292 (00:52:33.481 PDT) ------------------------- event=1:22475 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2700 (00:49:32.428 PDT) 445<-4381 (00:51:01.284 PDT) 445<-2292 (00:52:32.719 PDT) 178.206.217.184 (00:52:00.342 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3171 (00:52:00.342 PDT) 217.133.61.36 (4) (00:48:54.723 PDT) event=1:22469 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3799 (00:51:14.442 PDT) 445<-3094 (00:52:52.150 PDT) ------------------------- event=1:22472 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1167 (00:48:54.723 PDT) 445<-2797 (00:50:02.543 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 178.206.217.184 (00:52:03.457 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 43544<-4688 (00:52:03.457 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370418534.723 1370418534.724 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 222.168.45.154, 178.206.217.184, 1.162.231.243, 217.133.61.36 Egg Source List: 178.206.217.184, 1.162.231.243, 116.1.19.183 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 00:48:54.723 PDT Gen. Time: 06/05/2013 01:09:59.667 PDT INBOUND SCAN EXPLOIT 222.168.45.154 (7) (00:49:32.428 PDT) event=1:22469 {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1957 (00:58:41.402 PDT) ------------------------- event=1:22472 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2292 (00:52:33.481 PDT) 445<-4693 (00:54:34.913 PDT) 445<-1957 (00:58:39.474 PDT) ------------------------- event=1:22475 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2700 (00:49:32.428 PDT) 445<-4381 (00:51:01.284 PDT) 445<-2292 (00:52:32.719 PDT) 178.206.217.184 (2) (00:52:00.342 PDT) event=1:22009201 (2) {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3171 (00:52:00.342 PDT) 445<-4140 (00:59:20.130 PDT) 1.162.231.243 (00:56:26.862 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3557 (00:56:26.862 PDT) 217.133.61.36 (7) (00:48:54.723 PDT) event=1:22469 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3799 (00:51:14.442 PDT) 445<-3094 (00:52:52.150 PDT) ------------------------- event=1:22472 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1167 (00:48:54.723 PDT) 445<-2797 (00:50:02.543 PDT) 445<-1858 (00:58:01.309 PDT) ------------------------- event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1159 (00:55:09.064 PDT) 445<-4921 (00:56:51.151 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 178.206.217.184 (2) (00:52:03.457 PDT) event=1:2001685 (2) {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 43544<-4688 (00:52:03.457 PDT) 60516<-4688 (00:59:23.948 PDT) 1.162.231.243 (00:56:32.205 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 45302<-4680 (00:56:32.205 PDT) 116.1.19.183 (01:06:48.408 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 45625<-6570 (01:06:48.408 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370418534.723 1370418534.724 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 82.48.225.74, 222.168.45.154, 217.133.61.36, 37.104.31.181 Egg Source List: 82.48.225.74 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 01:10:18.200 PDT Gen. Time: 06/05/2013 01:12:52.949 PDT INBOUND SCAN EXPLOIT 82.48.225.74 (01:12:50.364 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3988 (01:12:50.364 PDT) 222.168.45.154 (3) (01:10:18.200 PDT) event=1:22469 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1314 (01:10:19.207 PDT) 445<-1274 (01:13:25.599 PDT) ------------------------- event=1:22472 {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1314 (01:10:18.200 PDT) 217.133.61.36 (4) (01:11:05.786 PDT) event=1:22472 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1435 (01:13:25.158 PDT) 445<-4776 (01:15:02.627 PDT) ------------------------- event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3108 (01:11:05.786 PDT) 445<-4261 (01:12:13.366 PDT) 37.104.31.181 (2) (01:10:25.965 PDT) event=1:22469 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4945 (01:10:25.965 PDT) 445<-4542 (01:11:44.915 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 82.48.225.74 (01:12:52.949 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 47245<-1730 (01:12:52.949 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370419818.200 1370419818.201 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.9 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 82.48.225.74, 222.168.45.154, 80.88.171.4, 128.72.221.160, 217.133.61.36, 37.104.31.181 Egg Source List: 82.48.225.74, 37.208.34.60, 91.67.184.233, 128.72.221.160 C & C List: 69.64.42.226 Peer Coord. List: Resource List: Observed Start: 06/05/2013 01:10:18.200 PDT Gen. Time: 06/05/2013 01:37:25.127 PDT INBOUND SCAN EXPLOIT 82.48.225.74 (01:12:50.364 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3988 (01:12:50.364 PDT) 222.168.45.154 (4) (01:10:18.200 PDT) event=1:22469 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1314 (01:10:19.207 PDT) 445<-1274 (01:13:25.599 PDT) ------------------------- event=1:22472 {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1314 (01:10:18.200 PDT) ------------------------- event=1:22475 {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1365 (01:17:00.951 PDT) 80.88.171.4 (01:17:58.434 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3061 (01:17:58.434 PDT) 128.72.221.160 (01:17:40.074 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1847 (01:17:40.074 PDT) 217.133.61.36 (6) (01:11:05.786 PDT) event=1:22469 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1813 (01:16:13.823 PDT) 445<-1742 (01:18:02.982 PDT) ------------------------- event=1:22472 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1435 (01:13:25.158 PDT) 445<-4776 (01:15:02.627 PDT) ------------------------- event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3108 (01:11:05.786 PDT) 445<-4261 (01:12:13.366 PDT) 37.104.31.181 (4) (01:10:25.965 PDT) event=1:22469 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4945 (01:10:25.965 PDT) 445<-4542 (01:11:44.915 PDT) ------------------------- event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1043 (01:16:06.524 PDT) 445<-3302 (01:18:16.972 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 82.48.225.74 (01:12:52.949 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 47245<-1730 (01:12:52.949 PDT) 37.208.34.60 (01:24:33.369 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 55248<-6155 (01:24:33.369 PDT) 91.67.184.233 (01:24:07.345 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 50728<-3946 (01:24:07.345 PDT) 128.72.221.160 (3) (01:17:49.873 PDT) event=1:2001685 (3) {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 49951<-8933 (01:17:49.873 PDT) 33062<-8933 (01:24:33.357 PDT) 56436<-8933 (01:31:48.361 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) 69.64.42.226 (01:21:04.542 PDT) event=1:3810007 {tcp} E4[nbr] ET Known Russian Business Network Monitored Domain, [] MAC_Src: 00:21:5A:08:EC:40 4815->55311 (01:21:04.542 PDT) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370419818.200 1370419818.201 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 222.168.45.154, 128.72.221.160, 217.133.61.36, 37.104.31.181 Egg Source List: 128.72.221.160 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 01:37:40.055 PDT Gen. Time: 06/05/2013 01:38:32.725 PDT INBOUND SCAN EXPLOIT 222.168.45.154 (6) (01:37:40.055 PDT) event=1:22469 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1751 (01:42:44.079 PDT) 445<-3520 (01:44:16.847 PDT) ------------------------- event=1:22472 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1629 (01:39:43.677 PDT) 445<-3977 (01:41:14.687 PDT) ------------------------- event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3823 (01:37:40.055 PDT) 445<-1629 (01:39:35.499 PDT) 128.72.221.160 (01:38:30.162 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3073 (01:38:30.162 PDT) 217.133.61.36 (01:39:09.685 PDT) event=1:22469 {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2453 (01:39:09.685 PDT) 37.104.31.181 (3) (01:38:05.504 PDT) event=1:22469 {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4863 (01:38:05.504 PDT) ------------------------- event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4380 (01:42:17.880 PDT) 445<-2523 (01:43:23.035 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 128.72.221.160 (01:38:32.725 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 44392<-8933 (01:38:32.725 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370421460.055 1370421460.056 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 178.207.117.6, 222.168.45.154, 115.171.10.161, 128.72.221.160, 217.133.61.36, 37.104.31.181 Egg Source List: 128.72.221.160 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 01:44:28.803 PDT Gen. Time: 06/05/2013 01:45:00.395 PDT INBOUND SCAN EXPLOIT 178.207.117.6 (01:49:56.203 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2000 (01:49:56.203 PDT) 222.168.45.154 (3) (01:45:46.738 PDT) event=1:22469 {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1339 (01:45:46.738 PDT) ------------------------- event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1918 (01:49:20.792 PDT) 445<-4045 (01:47:51.557 PDT) 115.171.10.161 (01:50:36.094 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1317 (01:50:36.094 PDT) 128.72.221.160 (01:44:57.897 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1605 (01:44:57.897 PDT) 217.133.61.36 (2) (01:47:28.488 PDT) event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4043 (01:49:11.560 PDT) 445<-4049 (01:47:28.488 PDT) 37.104.31.181 (5) (01:44:28.803 PDT-01:47:49.549 PDT) event=1:22469 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 2: 445<-4830 (01:47:46.148 PDT-01:47:49.549 PDT) 445<-2507 (01:49:28.390 PDT) ------------------------- event=1:22472 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1043 (01:44:28.803 PDT) 445<-2306 (01:46:09.353 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 128.72.221.160 (01:45:00.395 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 59315<-8933 (01:45:00.395 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370421868.803 1370422069.550 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 178.207.117.6, 222.168.45.154, 115.171.10.161, 128.72.221.160, 217.133.61.36, 37.104.31.181 Egg Source List: 178.207.117.6, 128.72.221.160 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 01:44:28.803 PDT Gen. Time: 06/05/2013 01:49:59.740 PDT INBOUND SCAN EXPLOIT 178.207.117.6 (01:49:56.203 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2000 (01:49:56.203 PDT) 222.168.45.154 (6) (01:45:46.738 PDT) event=1:22469 {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1339 (01:45:46.738 PDT) ------------------------- event=1:22472 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3645 (01:50:56.647 PDT) 445<-1336 (01:52:24.405 PDT) ------------------------- event=1:22475 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1918 (01:49:20.792 PDT) 445<-4045 (01:47:51.557 PDT) 445<-3645 (01:50:54.395 PDT) 115.171.10.161 (01:50:36.094 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1317 (01:50:36.094 PDT) 128.72.221.160 (2) (01:44:57.897 PDT) event=1:22009201 (2) {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1605 (01:44:57.897 PDT) 445<-1112 (01:53:03.761 PDT) 217.133.61.36 (3) (01:47:28.488 PDT) event=1:22475 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4043 (01:49:11.560 PDT) 445<-4049 (01:47:28.488 PDT) 445<-2056 (01:51:21.368 PDT) 37.104.31.181 (5) (01:44:28.803 PDT-01:47:49.549 PDT) event=1:22469 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 2: 445<-4830 (01:47:46.148 PDT-01:47:49.549 PDT) 445<-2507 (01:49:28.390 PDT) ------------------------- event=1:22472 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1043 (01:44:28.803 PDT) 445<-2306 (01:46:09.353 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 178.207.117.6 (01:49:59.740 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 43283<-4688 (01:49:59.740 PDT) 128.72.221.160 (2) (01:45:00.395 PDT) event=1:2001685 (2) {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 59315<-8933 (01:45:00.395 PDT) 45403<-8933 (01:53:06.760 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370421868.803 1370422069.550 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 85.95.254.28 Egg Source List: 85.95.254.28 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 01:56:43.950 PDT Gen. Time: 06/05/2013 01:56:48.552 PDT INBOUND SCAN EXPLOIT 85.95.254.28 (01:56:43.950 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2173 (01:56:43.950 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 85.95.254.28 (01:56:48.552 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 57802<-8079 (01:56:48.552 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370422603.950 1370422603.951 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 62.149.73.181, 222.168.45.154, 178.207.117.6, 37.104.31.181, 85.95.254.28 Egg Source List: 178.207.117.6, 85.95.254.28 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 01:56:43.950 PDT Gen. Time: 06/05/2013 01:57:07.157 PDT INBOUND SCAN EXPLOIT 62.149.73.181 (02:02:42.625 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4841 (02:02:42.625 PDT) 222.168.45.154 (02:01:30.785 PDT) event=1:22475 {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4432 (02:01:30.785 PDT) 178.207.117.6 (01:57:00.993 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4798 (01:57:00.993 PDT) 37.104.31.181 (4) (01:57:11.174 PDT) event=1:22469 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3675 (01:59:49.966 PDT) 445<-3988 (02:01:58.621 PDT) ------------------------- event=1:22472 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4566 (01:57:11.174 PDT) 445<-1926 (01:58:42.623 PDT) 85.95.254.28 (01:56:43.950 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2173 (01:56:43.950 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 178.207.117.6 (01:57:07.157 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 43056<-4688 (01:57:07.157 PDT) 85.95.254.28 (01:56:48.552 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 57802<-8079 (01:56:48.552 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370422603.950 1370422603.951 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 178.207.117.6, 222.168.45.154, 37.104.31.181 Egg Source List: 178.207.117.6 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 02:03:00.341 PDT Gen. Time: 06/05/2013 02:04:06.958 PDT INBOUND SCAN EXPLOIT 178.207.117.6 (02:04:04.122 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2584 (02:04:04.122 PDT) 222.168.45.154 (4) (02:03:00.341 PDT) event=1:22472 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2229 (02:06:19.773 PDT) 445<-4733 (02:08:04.557 PDT) ------------------------- event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2389 (02:03:00.341 PDT) 445<-2229 (02:06:14.503 PDT) 37.104.31.181 (2) (02:05:54.543 PDT) event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2724 (02:05:54.543 PDT) 445<-4288 (02:07:26.890 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 178.207.117.6 (02:04:06.958 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 46462<-4688 (02:04:06.958 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370422980.341 1370422980.342 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 37.203.115.186, 178.207.117.6, 222.168.45.154, 93.122.136.82, 37.104.31.181 Egg Source List: 37.203.115.186, 178.207.117.6, 93.122.136.82 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 02:03:00.341 PDT Gen. Time: 06/05/2013 02:16:31.334 PDT INBOUND SCAN EXPLOIT 37.203.115.186 (02:10:15.455 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2888 (02:10:15.455 PDT) 178.207.117.6 (02:04:04.122 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2584 (02:04:04.122 PDT) 222.168.45.154 (8) (02:03:00.341 PDT) event=1:22469 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2529 (02:09:48.941 PDT) 445<-2065 (02:12:39.633 PDT) 445<-3706 (02:14:09.964 PDT) ------------------------- event=1:22472 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2229 (02:06:19.773 PDT) 445<-4733 (02:08:04.557 PDT) 445<-2529 (02:09:42.816 PDT) ------------------------- event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2389 (02:03:00.341 PDT) 445<-2229 (02:06:14.503 PDT) 93.122.136.82 (02:09:58.901 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1926 (02:09:58.901 PDT) 37.104.31.181 (6) (02:05:54.543 PDT) event=1:22469 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1089 (02:12:25.866 PDT) 445<-1617 (02:14:33.682 PDT) ------------------------- event=1:22472 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1933 (02:09:05.225 PDT) 445<-3730 (02:10:45.117 PDT) ------------------------- event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2724 (02:05:54.543 PDT) 445<-4288 (02:07:26.890 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 37.203.115.186 (02:10:19.712 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 55555<-6536 (02:10:19.712 PDT) 178.207.117.6 (02:04:06.958 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 46462<-4688 (02:04:06.958 PDT) 93.122.136.82 (02:10:07.151 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 58712<-1459 (02:10:07.151 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370422980.341 1370422980.342 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 222.168.45.154, 178.207.117.6, 37.104.31.181 Egg Source List: 178.207.117.6 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 02:17:04.495 PDT Gen. Time: 06/05/2013 02:17:07.548 PDT INBOUND SCAN EXPLOIT 222.168.45.154 (4) (02:18:45.600 PDT) event=1:22472 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2943 (02:20:17.860 PDT) 445<-4624 (02:21:46.261 PDT) ------------------------- event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1145 (02:18:45.600 PDT) 445<-2943 (02:20:16.200 PDT) 178.207.117.6 (02:17:04.495 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1407 (02:17:04.495 PDT) 37.104.31.181 (3) (02:17:50.778 PDT) event=1:22472 {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1823 (02:20:34.673 PDT) ------------------------- event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1298 (02:17:50.778 PDT) 445<-3783 (02:18:58.520 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 178.207.117.6 (02:17:07.548 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 35313<-4688 (02:17:07.548 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370423824.495 1370423824.496 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 178.207.117.6, 222.168.45.154, 37.104.31.181 Egg Source List: 178.207.117.6 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 02:22:14.167 PDT Gen. Time: 06/05/2013 02:24:05.089 PDT INBOUND SCAN EXPLOIT 178.207.117.6 (02:24:01.120 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3275 (02:24:01.120 PDT) 222.168.45.154 (4) (02:23:18.665 PDT) event=1:22469 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2730 (02:23:19.518 PDT) 445<-4649 (02:24:49.000 PDT) 445<-4415 (02:27:51.253 PDT) ------------------------- event=1:22472 {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2730 (02:23:18.665 PDT) 37.104.31.181 (4) (02:22:14.167 PDT) event=1:22469 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4917 (02:24:26.798 PDT) 445<-2118 (02:26:35.965 PDT) ------------------------- event=1:22472 {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3702 (02:22:14.167 PDT) ------------------------- event=1:22475 {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3029 (02:28:46.898 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 178.207.117.6 (02:24:05.089 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 52449<-4688 (02:24:05.089 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370424134.167 1370424134.168 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 186.93.142.70, 178.207.117.6, 222.168.45.154, 37.104.31.181 Egg Source List: 178.207.117.6 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 02:22:14.167 PDT Gen. Time: 06/05/2013 02:37:03.832 PDT INBOUND SCAN EXPLOIT 186.93.142.70 (02:33:28.389 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2141 (02:33:28.389 PDT) 178.207.117.6 (2) (02:24:01.120 PDT) event=1:22009201 (2) {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3275 (02:24:01.120 PDT) 445<-2515 (02:31:04.995 PDT) 222.168.45.154 (7) (02:23:18.665 PDT) event=1:22469 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2730 (02:23:19.518 PDT) 445<-4649 (02:24:49.000 PDT) 445<-4415 (02:27:51.253 PDT) ------------------------- event=1:22472 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2730 (02:23:18.665 PDT) 445<-1896 (02:32:25.283 PDT) ------------------------- event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2180 (02:29:22.922 PDT) 445<-4015 (02:30:57.293 PDT) 37.104.31.181 (7) (02:22:14.167 PDT) event=1:22469 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4917 (02:24:26.798 PDT) 445<-2118 (02:26:35.965 PDT) ------------------------- event=1:22472 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3702 (02:22:14.167 PDT) 445<-2896 (02:32:03.633 PDT) 445<-1746 (02:33:10.055 PDT) ------------------------- event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3029 (02:28:46.898 PDT) 445<-1051 (02:30:24.297 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 178.207.117.6 (2) (02:24:05.089 PDT) event=1:2001685 (2) {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 52449<-4688 (02:24:05.089 PDT) 37438<-4688 (02:31:07.888 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370424134.167 1370424134.168 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 178.207.117.6 Egg Source List: 178.207.117.6 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 02:38:11.076 PDT Gen. Time: 06/05/2013 02:38:15.800 PDT INBOUND SCAN EXPLOIT 178.207.117.6 (02:38:11.076 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1893 (02:38:11.076 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 178.207.117.6 (02:38:15.800 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 48206<-4688 (02:38:15.800 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370425091.076 1370425091.077 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 222.168.45.154, 178.207.117.6, 37.104.31.181 Egg Source List: 186.93.142.70, 178.207.117.6, 203.114.109.117, 88.150.178.103 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 02:33:32.800 PDT Gen. Time: 06/05/2013 03:04:47.104 PDT INBOUND SCAN EXPLOIT 222.168.45.154 (9) (02:38:32.015 PDT) event=1:22469 (4) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1438 (02:38:32.015 PDT) 445<-3545 (02:40:01.719 PDT) 445<-1316 (02:51:44.346 PDT) 445<-3757 (02:53:42.901 PDT) ------------------------- event=1:22472 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1699 (02:45:05.554 PDT) 445<-3374 (02:50:14.368 PDT) 445<-1316 (02:51:41.685 PDT) ------------------------- event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2123 (02:42:03.753 PDT) 445<-3905 (02:43:35.562 PDT) 178.207.117.6 (02:38:11.076 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-1893 (02:38:11.076 PDT) 37.104.31.181 (7) (02:42:28.568 PDT) event=1:22469 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2720 (02:48:28.162 PDT) 445<-4594 (02:50:05.785 PDT) ------------------------- event=1:22472 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2052 (02:45:43.337 PDT) 445<-4682 (02:46:52.606 PDT) ------------------------- event=1:22475 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2300 (02:42:28.568 PDT) 445<-4032 (02:44:08.039 PDT) 445<-3933 (02:54:00.034 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 186.93.142.70 (02:33:32.800 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 51576<-2800 (02:33:32.800 PDT) 178.207.117.6 (02:38:15.800 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 48206<-4688 (02:38:15.800 PDT) 203.114.109.117 (02:59:59.499 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 38735<-7971 (02:59:59.499 PDT) 88.150.178.103 (02:59:55.633 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 48649<-7034 (02:59:55.633 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370424812.800 1370424812.801 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 222.168.45.154, 193.68.59.207, 222.59.17.244, 37.104.31.181 Egg Source List: 222.59.17.244 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 03:05:00.185 PDT Gen. Time: 06/05/2013 03:06:07.416 PDT INBOUND SCAN EXPLOIT 222.168.45.154 (5) (03:05:24.252 PDT) event=1:22469 (3) {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3238 (03:05:32.424 PDT) 445<-4856 (03:06:55.641 PDT) 445<-2589 (03:08:25.437 PDT) ------------------------- event=1:22472 {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3238 (03:05:24.252 PDT) ------------------------- event=1:22475 {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4951 (03:10:28.729 PDT) 193.68.59.207 (03:09:49.707 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2599 (03:09:49.707 PDT) 222.59.17.244 (03:06:04.015 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2361 (03:06:04.015 PDT) 37.104.31.181 (5) (03:05:00.185 PDT) event=1:22469 {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2498 (03:10:53.924 PDT) ------------------------- event=1:22472 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-3442 (03:08:08.443 PDT) 445<-3044 (03:09:14.420 PDT) ------------------------- event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2329 (03:05:00.185 PDT) 445<-4624 (03:06:30.233 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 222.59.17.244 (03:06:07.416 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 46357<-2635 (03:06:07.416 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370426700.185 1370426700.186 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 222.168.45.154, 203.189.149.123, 37.104.31.181 Egg Source List: 203.189.149.123 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 03:11:59.498 PDT Gen. Time: 06/05/2013 03:13:37.153 PDT INBOUND SCAN EXPLOIT 222.168.45.154 (3) (03:11:59.498 PDT) event=1:22472 {tcp} E2[rb] GPL NETBIOS SMB-DS C$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-4257 (03:13:32.406 PDT) ------------------------- event=1:22475 (2) {tcp} E2[rb] GPL NETBIOS SMB-DS ADMIN$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2616 (03:11:59.498 PDT) 445<-4257 (03:13:30.935 PDT) 203.189.149.123 (03:13:32.052 PDT) event=1:22009201 {tcp} E2[rb] ET TROJAN Conficker.b Shellcode, [] MAC_Dst: 00:21:5A:08:EC:40 445<-39085 (03:13:32.052 PDT) 37.104.31.181 (03:12:00.057 PDT) event=1:22469 {tcp} E2[rb] GPL NETBIOS SMB-DS D$ unicode share access, [] MAC_Dst: 00:21:5A:08:EC:40 445<-2507 (03:12:00.057 PDT) EXPLOIT MALWARE DNS EGG DOWNLOAD 203.189.149.123 (03:13:37.153 PDT) event=1:2001685 {tcp} E3[rb] ET MALWARE Possible Windows executable sent when remote host claims to send an image, [] MAC_Src: 00:21:1C:EE:14:00 33561<-3141 (03:13:37.153 PDT) C and C TRAFFIC C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1370427119.498 1370427119.499 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.102' ============================== SEPARATOR ================================ Score: 0.8 (>= 0.8) Infected Target: 192.168.1.102 Infector List: 222.168.45.154, 203.189.149.123, 37.104.31.181 Egg Source List: 193.68.59.207, 203.189.149.123 C & C List: Peer Coord. List: Resource List: Observed Start: 06/05/2013 03:09:52.086 PDT Gen. Time: 06/05/2013 03:15:14.506 PDT INBOUND SCAN