Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 196.206.64.182, 91.218.38.132, 190.78.116.15
Resource List:    <unobserved>
Observed Start:   06/05/2013 01:42:01.593 PDT
Gen. Time:        06/05/2013 01:44:01.012 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    196.206.64.182 (01:43:38.774 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->58566 (01:43:38.774 PDT)
       
    91.218.38.132 (01:42:01.593 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          58707->2710 (01:42:01.593 PDT)
       
    190.78.116.15 (01:42:38.214 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->31055 (01:42:38.214 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (01:44:01.012 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          59153->6099 (01:44:01.012 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370421721.593 1370421721.594 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 196.206.64.182, 174.20.170.92, 91.218.38.132 (2), 71.187.0.178, 190.78.116.15
Resource List:    <unobserved>
Observed Start:   06/05/2013 01:42:01.593 PDT
Gen. Time:        06/05/2013 01:45:36.395 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    196.206.64.182 (01:43:38.774 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->58566 (01:43:38.774 PDT)
       
    174.20.170.92 (01:44:50.686 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->33363 (01:44:50.686 PDT)
       
    91.218.38.132 (2) (01:42:01.593 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          58707->2710 (01:42:01.593 PDT)
       -------------------------
       event=1:1100018 {tcp} E7[info] P2P torrent announce tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          59461->2710 (01:45:36.395 PDT)
       
    71.187.0.178 (01:45:11.102 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          59367->6969 (01:45:11.102 PDT)
       
    190.78.116.15 (01:42:38.214 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->31055 (01:42:38.214 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (01:44:01.012 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          59153->6099 (01:44:01.012 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370421721.593 1370421721.594 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   06/05/2013 03:45:00.712 PDT
Gen. Time:        06/05/2013 03:45:00.712 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (03:45:00.712 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (03:45:00.712 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370429100.712 1370429100.713 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 177.32.96.140, 177.102.176.212, 200.117.237.25, 71.187.0.178, 200.232.134.145
Resource List:    <unobserved>
Observed Start:   06/05/2013 03:45:00.712 PDT
Gen. Time:        06/05/2013 03:47:21.040 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    177.32.96.140 (03:45:20.549 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->51413 (03:45:20.549 PDT)
       
    177.102.176.212 (03:47:21.040 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->50237 (03:47:21.040 PDT)
       
    200.117.237.25 (03:45:58.174 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          56037->16881 (03:45:58.174 PDT)
       
    71.187.0.178 (03:45:31.104 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          55861->6969 (03:45:31.104 PDT)
       
    200.232.134.145 (03:46:20.751 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->63556 (03:46:20.751 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (03:45:00.712 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (03:45:00.712 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370429100.712 1370429100.713 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 87.121.52.175, 91.218.38.132 (3), 71.187.0.178, 89.122.142.250, 189.114.229.144, 37.1.181.24, 83.153.68.92
Resource List:    <unobserved>
Observed Start:   06/05/2013 05:43:11.011 PDT
Gen. Time:        06/05/2013 05:46:41.186 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    87.121.52.175 (05:44:12.850 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->25882 (05:44:12.850 PDT)
       
    91.218.38.132 (3) (05:43:21.179 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          52788->2710 (05:43:21.179 PDT)
       -------------------------
       event=1:1100018 {tcp} E7[info] P2P torrent announce tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          53287->2710 (05:44:48.584 PDT)
       -------------------------
       event=1:2102180 {tcp} E7[info] GPL P2P BitTorrent announce request, [] MAC_Src: 00:01:64:FF:CE:EA
          53287->2710 (05:44:48.584 PDT)
       
    71.187.0.178 (05:46:11.090 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          53749->6969 (05:46:11.090 PDT)
       
    89.122.142.250 (05:46:20.273 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->24961 (05:46:20.273 PDT)
       
    189.114.229.144 (05:45:38.996 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          53518->16884 (05:45:38.996 PDT)
       
    37.1.181.24 (05:43:11.011 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->32380 (05:43:11.011 PDT)
       
    83.153.68.92 (05:45:20.394 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->31547 (05:45:20.394 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (05:46:41.186 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          53936->6099 (05:46:41.186 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370436191.011 1370436191.012 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 91.218.38.132, 186.204.105.80, 79.41.234.101, 193.107.19.56, 213.89.147.93, 41.46.172.23
Resource List:    <unobserved>
Observed Start:   06/05/2013 07:43:25.553 PDT
Gen. Time:        06/05/2013 07:47:20.958 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    91.218.38.132 (07:44:05.692 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          64505->2710 (07:44:05.692 PDT)
       
    186.204.105.80 (07:44:26.514 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->46831 (07:44:26.514 PDT)
       
    79.41.234.101 (07:43:25.553 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->51413 (07:43:25.553 PDT)
       
    193.107.19.56 (07:46:40.189 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          65442->6969 (07:46:40.189 PDT)
       
    213.89.147.93 (07:45:27.429 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->17236 (07:45:27.429 PDT)
       
    41.46.172.23 (07:46:27.044 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->17063 (07:46:27.044 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (07:47:20.958 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (07:47:20.958 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370443405.553 1370443405.554 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 91.218.38.132, 186.204.105.80, 79.41.234.101, 193.107.19.56, 188.26.91.12, 213.89.147.93, 41.46.172.23
Resource List:    <unobserved>
Observed Start:   06/05/2013 07:43:25.553 PDT
Gen. Time:        06/05/2013 07:47:27.950 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    91.218.38.132 (07:44:05.692 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          64505->2710 (07:44:05.692 PDT)
       
    186.204.105.80 (07:44:26.514 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->46831 (07:44:26.514 PDT)
       
    79.41.234.101 (07:43:25.553 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->51413 (07:43:25.553 PDT)
       
    193.107.19.56 (07:46:40.189 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          65442->6969 (07:46:40.189 PDT)
       
    188.26.91.12 (07:47:27.950 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->16521 (07:47:27.950 PDT)
       
    213.89.147.93 (07:45:27.429 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->17236 (07:45:27.429 PDT)
       
    41.46.172.23 (07:46:27.044 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->17063 (07:46:27.044 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (07:47:20.958 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (07:47:20.958 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370443405.553 1370443405.554 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 61.91.88.110, 2.239.19.132, 78.129.56.209
Resource List:    <unobserved>
Observed Start:   06/05/2013 09:47:31.648 PDT
Gen. Time:        06/05/2013 09:49:01.222 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    61.91.88.110 (09:48:51.171 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          49382->16884 (09:48:51.171 PDT)
       
    2.239.19.132 (09:48:31.666 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->46334 (09:48:31.666 PDT)
       
    78.129.56.209 (09:47:31.648 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->11100 (09:47:31.648 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (09:49:01.222 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          49480->6099 (09:49:01.222 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370450851.648 1370450851.649 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 142.162.50.245, 2.239.19.132, 61.91.88.110, 209.240.116.235, 78.129.56.209 (2)
Resource List:    <unobserved>
Observed Start:   06/05/2013 09:47:31.648 PDT
Gen. Time:        06/05/2013 09:51:31.522 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    142.162.50.245 (09:51:31.522 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->13570 (09:51:31.522 PDT)
       
    2.239.19.132 (09:48:31.666 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->46334 (09:48:31.666 PDT)
       
    61.91.88.110 (09:48:51.171 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          49382->16884 (09:48:51.171 PDT)
       
    209.240.116.235 (09:50:31.233 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->38232 (09:50:31.233 PDT)
       
    78.129.56.209 (2) (09:47:31.648 PDT-09:49:31.651 PDT)
       event=1:1100013 (2) {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          2: 51413->11100 (09:47:31.648 PDT-09:49:31.651 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (09:49:01.222 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          49480->6099 (09:49:01.222 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370450851.648 1370450971.652 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 77.250.12.152
Resource List:    <unobserved>
Observed Start:   06/05/2013 11:49:32.276 PDT
Gen. Time:        06/05/2013 11:49:40.555 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    77.250.12.152 (11:49:32.276 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          50595->51413 (11:49:32.276 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (11:49:40.555 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (11:49:40.555 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370458172.276 1370458172.277 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 82.35.180.39, 94.54.189.166, 77.250.12.152 (2), 185.14.232.6
Resource List:    <unobserved>
Observed Start:   06/05/2013 11:49:32.276 PDT
Gen. Time:        06/05/2013 11:52:24.017 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    82.35.180.39 (11:52:24.017 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->20976 (11:52:24.017 PDT)
       
    94.54.189.166 (11:50:24.156 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->15161 (11:50:24.156 PDT)
       
    77.250.12.152 (2) (11:49:32.276 PDT)
       event=1:1100012 (2) {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          50595->51413 (11:49:32.276 PDT)
          51136->51413 (11:50:33.786 PDT)
       
    185.14.232.6 (11:51:24.631 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->40006 (11:51:24.631 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (11:49:40.555 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (11:49:40.555 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370458172.276 1370458172.277 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 67.142.227.103, 173.11.133.34, 71.187.0.178, 84.110.6.151, 77.250.12.152, 89.136.160.243
Resource List:    <unobserved>
Observed Start:   06/05/2013 13:48:34.167 PDT
Gen. Time:        06/05/2013 13:50:50.685 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    67.142.227.103 (13:49:40.498 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          54870->32431 (13:49:40.498 PDT)
       
    173.11.133.34 (13:50:38.358 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->51413 (13:50:38.358 PDT)
       
    71.187.0.178 (13:48:40.574 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          54364->6969 (13:48:40.574 PDT)
       
    84.110.6.151 (13:48:37.164 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->19761 (13:48:37.164 PDT)
       
    77.250.12.152 (13:48:34.167 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          54238->51413 (13:48:34.167 PDT)
       
    89.136.160.243 (13:49:37.643 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->14519 (13:49:37.643 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (13:50:50.685 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          55390->6099 (13:50:50.685 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370465314.167 1370465314.168 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 77.250.12.152 (2), 67.142.227.103, 89.136.160.243, 173.11.133.34, 84.110.6.151, 200.24.16.223, 71.187.0.178, 178.239.54.160, 94.209.99.57
Resource List:    <unobserved>
Observed Start:   06/05/2013 13:48:34.167 PDT
Gen. Time:        06/05/2013 13:52:39.244 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    77.250.12.152 (2) (13:48:34.167 PDT)
       event=1:1100012 (2) {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          54238->51413 (13:48:34.167 PDT)
          55623->51413 (13:51:31.704 PDT)
       
    67.142.227.103 (13:49:40.498 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          54870->32431 (13:49:40.498 PDT)
       
    89.136.160.243 (13:49:37.643 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->14519 (13:49:37.643 PDT)
       
    173.11.133.34 (13:50:38.358 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->51413 (13:50:38.358 PDT)
       
    84.110.6.151 (13:48:37.164 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->19761 (13:48:37.164 PDT)
       
    200.24.16.223 (13:51:39.892 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->16758 (13:51:39.892 PDT)
       
    71.187.0.178 (13:48:40.574 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          54364->6969 (13:48:40.574 PDT)
       
    178.239.54.160 (13:51:20.880 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          55485->3310 (13:51:20.880 PDT)
       
    94.209.99.57 (13:52:39.244 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->50054 (13:52:39.244 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (13:50:50.685 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          55390->6099 (13:50:50.685 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370465314.167 1370465314.168 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   06/05/2013 15:51:10.408 PDT
Gen. Time:        06/05/2013 15:51:10.408 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (15:51:10.408 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (15:51:10.408 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370472670.408 1370472670.409 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 178.239.54.160, 61.91.88.132, 92.44.171.196, 181.130.0.144, 24.137.77.134, 85.247.223.41
Resource List:    <unobserved>
Observed Start:   06/05/2013 15:51:10.408 PDT
Gen. Time:        06/05/2013 15:54:28.355 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    178.239.54.160 (15:51:50.847 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          54520->3310 (15:51:50.847 PDT)
       
    61.91.88.132 (15:51:28.467 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          54295->16882 (15:51:28.467 PDT)
       
    92.44.171.196 (15:53:27.503 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->37309 (15:53:27.503 PDT)
       
    181.130.0.144 (15:54:28.355 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->28753 (15:54:28.355 PDT)
       
    24.137.77.134 (15:52:27.343 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->56568 (15:52:27.343 PDT)
       
    85.247.223.41 (15:51:26.049 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->60545 (15:51:26.049 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (15:51:10.408 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (15:51:10.408 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370472670.408 1370472670.409 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 79.31.143.165, 91.218.38.132 (2), 61.91.88.132, 189.114.229.148, 175.136.166.214
Resource List:    <unobserved>
Observed Start:   06/05/2013 17:51:23.065 PDT
Gen. Time:        06/05/2013 17:53:10.784 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    79.31.143.165 (17:51:23.065 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->35978 (17:51:23.065 PDT)
       
    91.218.38.132 (2) (17:52:10.255 PDT)
       event=1:1100018 {tcp} E7[info] P2P torrent announce tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          59856->2710 (17:52:10.255 PDT)
       -------------------------
       event=1:2102180 {tcp} E7[info] GPL P2P BitTorrent announce request, [] MAC_Src: 00:01:64:FF:CE:EA
          59856->2710 (17:52:10.255 PDT)
       
    61.91.88.132 (17:51:28.852 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          59652->16882 (17:51:28.852 PDT)
       
    189.114.229.148 (17:52:35.561 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          60012->16882 (17:52:35.561 PDT)
       
    175.136.166.214 (17:52:23.734 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->64874 (17:52:23.734 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (17:53:10.784 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          60173->6099 (17:53:10.784 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370479883.065 1370479883.066 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 79.31.143.165, 41.237.241.223, 91.218.38.132 (2), 61.91.88.132, 189.114.229.148, 175.136.166.214, 70.77.199.174
Resource List:    <unobserved>
Observed Start:   06/05/2013 17:51:23.065 PDT
Gen. Time:        06/05/2013 17:54:24.732 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    79.31.143.165 (17:51:23.065 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->35978 (17:51:23.065 PDT)
       
    41.237.241.223 (17:53:23.041 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->17866 (17:53:23.041 PDT)
       
    91.218.38.132 (2) (17:52:10.255 PDT)
       event=1:1100018 {tcp} E7[info] P2P torrent announce tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          59856->2710 (17:52:10.255 PDT)
       -------------------------
       event=1:2102180 {tcp} E7[info] GPL P2P BitTorrent announce request, [] MAC_Src: 00:01:64:FF:CE:EA
          59856->2710 (17:52:10.255 PDT)
       
    61.91.88.132 (17:51:28.852 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          59652->16882 (17:51:28.852 PDT)
       
    189.114.229.148 (17:52:35.561 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          60012->16882 (17:52:35.561 PDT)
       
    175.136.166.214 (17:52:23.734 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->64874 (17:52:23.734 PDT)
       
    70.77.199.174 (17:54:24.732 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->17938 (17:54:24.732 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (17:53:10.784 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          60173->6099 (17:53:10.784 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370479883.065 1370479883.066 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 189.231.33.126
Resource List:    <unobserved>
Observed Start:   06/05/2013 19:53:07.673 PDT
Gen. Time:        06/05/2013 19:53:30.599 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    189.231.33.126 (19:53:07.673 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->38119 (19:53:07.673 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (19:53:30.599 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (19:53:30.599 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370487187.673 1370487187.674 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 190.62.26.27, 99.21.105.80, 71.187.0.178, 173.11.243.162, 77.250.12.152 (3), 177.41.3.174, 189.231.33.126
Resource List:    <unobserved>
Observed Start:   06/05/2013 19:53:07.673 PDT
Gen. Time:        06/05/2013 19:57:15.657 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    190.62.26.27 (19:54:07.818 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->62244 (19:54:07.818 PDT)
       
    99.21.105.80 (19:55:08.554 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->50677 (19:55:08.554 PDT)
       
    71.187.0.178 (19:55:40.771 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          61618->6969 (19:55:40.771 PDT)
       
    173.11.243.162 (19:57:15.657 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->51413 (19:57:15.657 PDT)
       
    77.250.12.152 (3) (19:54:14.382 PDT)
       event=1:1100012 (3) {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          61194->51413 (19:54:14.382 PDT)
          61468->51413 (19:55:16.892 PDT)
          61857->51413 (19:56:33.912 PDT)
       
    177.41.3.174 (19:56:11.820 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->17491 (19:56:11.820 PDT)
       
    189.231.33.126 (19:53:07.673 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->38119 (19:53:07.673 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (19:53:30.599 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (19:53:30.599 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370487187.673 1370487187.674 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   06/05/2013 21:55:21.297 PDT
Gen. Time:        06/05/2013 21:55:21.297 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (21:55:21.297 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          56642->6099 (21:55:21.297 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370494521.297 1370494521.298 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 200.117.237.19, 91.218.38.132 (2), 81.61.11.198, 71.187.0.178, 213.220.232.98, 77.250.12.152, 96.35.79.5, 115.186.106.48
Resource List:    <unobserved>
Observed Start:   06/05/2013 21:55:21.297 PDT
Gen. Time:        06/05/2013 21:59:23.879 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    200.117.237.19 (21:56:00.503 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          56862->16882 (21:56:00.503 PDT)
       
    91.218.38.132 (2) (21:56:44.969 PDT)
       event=1:1100018 {tcp} E7[info] P2P torrent announce tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          57068->2710 (21:56:44.969 PDT)
       -------------------------
       event=1:2102180 {tcp} E7[info] GPL P2P BitTorrent announce request, [] MAC_Src: 00:01:64:FF:CE:EA
          57068->2710 (21:56:44.969 PDT)
       
    81.61.11.198 (21:58:29.041 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          57458->51413 (21:58:29.041 PDT)
       
    71.187.0.178 (21:56:01.562 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          56863->6969 (21:56:01.562 PDT)
       
    213.220.232.98 (21:58:26.663 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->36436 (21:58:26.663 PDT)
       
    77.250.12.152 (21:57:26.718 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          57136->51413 (21:57:26.718 PDT)
       
    96.35.79.5 (21:57:24.263 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->55889 (21:57:24.263 PDT)
       
    115.186.106.48 (21:56:21.004 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->22121 (21:56:21.004 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (21:55:21.297 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          56642->6099 (21:55:21.297 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1370494521.297 1370494521.298 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================