Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 88.183.13.40, 178.239.54.153, 188.114.28.186
Resource List:    <unobserved>
Observed Start:   07/02/2013 01:36:01.165 PDT
Gen. Time:        07/02/2013 01:37:20.202 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    88.183.13.40 (01:37:11.455 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->49259 (01:37:11.455 PDT)
       
    178.239.54.153 (01:36:01.165 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          59219->3310 (01:36:01.165 PDT)
       
    188.114.28.186 (01:36:04.925 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->23817 (01:36:04.925 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (01:37:20.202 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (01:37:20.202 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372754161.165 1372754161.166 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 88.183.13.40, 178.239.54.153, 94.145.94.150, 85.17.143.16, 89.103.147.109, 96.41.67.241, 112.3.245.150, 188.114.28.186
Resource List:    <unobserved>
Observed Start:   07/02/2013 01:36:01.165 PDT
Gen. Time:        07/02/2013 01:40:24.096 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    88.183.13.40 (01:37:11.455 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->49259 (01:37:11.455 PDT)
       
    178.239.54.153 (01:36:01.165 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          59219->3310 (01:36:01.165 PDT)
       
    94.145.94.150 (01:39:23.513 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6881 (01:39:23.513 PDT)
       
    85.17.143.16 (01:38:39.164 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          59938->6969 (01:38:39.164 PDT)
       
    89.103.147.109 (01:40:24.096 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->14387 (01:40:24.096 PDT)
       
    96.41.67.241 (01:38:13.420 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->51413 (01:38:13.420 PDT)
       
    112.3.245.150 (01:37:35.146 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          59622->8634 (01:37:35.146 PDT)
       
    188.114.28.186 (01:36:04.925 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->23817 (01:36:04.925 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (01:37:20.202 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (01:37:20.202 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372754161.165 1372754161.166 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 93.4.230.210
Resource List:    <unobserved>
Observed Start:   07/02/2013 03:38:07.142 PDT
Gen. Time:        07/02/2013 03:38:40.805 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    93.4.230.210 (03:38:07.142 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->23213 (03:38:07.142 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (03:38:40.805 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          58020->6099 (03:38:40.805 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372761487.142 1372761487.143 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 91.185.54.154, 216.183.135.173, 2.226.218.19, 178.239.54.151, 173.11.243.162, 93.4.230.210, 220.89.58.61
Resource List:    <unobserved>
Observed Start:   07/02/2013 03:38:07.142 PDT
Gen. Time:        07/02/2013 03:42:16.413 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    91.185.54.154 (03:40:11.794 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6881 (03:40:11.794 PDT)
       
    216.183.135.173 (03:42:16.413 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->62886 (03:42:16.413 PDT)
       
    2.226.218.19 (03:41:12.284 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->48241 (03:41:12.284 PDT)
       
    178.239.54.151 (03:41:11.525 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          58595->2710 (03:41:11.525 PDT)
       
    173.11.243.162 (03:39:08.367 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->51413 (03:39:08.367 PDT)
       
    93.4.230.210 (03:38:07.142 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->23213 (03:38:07.142 PDT)
       
    220.89.58.61 (03:41:09.795 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          58591->21001 (03:41:09.795 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (03:38:40.805 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          58020->6099 (03:38:40.805 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372761487.142 1372761487.143 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 2.226.218.19, 91.218.38.132 (2), 197.35.14.46, 112.3.245.150, 121.14.98.151
Resource List:    <unobserved>
Observed Start:   07/02/2013 05:37:11.509 PDT
Gen. Time:        07/02/2013 05:39:20.613 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    2.226.218.19 (05:38:36.226 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->48241 (05:38:36.226 PDT)
       
    91.218.38.132 (2) (05:38:01.195 PDT)
       event=1:1100018 {tcp} E7[info] P2P torrent announce tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          57680->2710 (05:38:01.195 PDT)
       -------------------------
       event=1:2102180 {tcp} E7[info] GPL P2P BitTorrent announce request, [] MAC_Src: 00:01:64:FF:CE:EA
          57680->2710 (05:38:01.195 PDT)
       
    197.35.14.46 (05:37:36.580 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->29733 (05:37:36.580 PDT)
       
    112.3.245.150 (05:37:35.554 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          57478->8634 (05:37:35.554 PDT)
       
    121.14.98.151 (05:37:11.509 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          57397->9090 (05:37:11.509 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (05:39:20.613 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (05:39:20.613 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372768631.509 1372768631.510 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 84.111.88.8, 119.188.50.140, 2.226.218.19, 91.218.38.132 (2), 197.35.14.46, 112.3.245.150, 121.14.98.151
Resource List:    <unobserved>
Observed Start:   07/02/2013 05:37:11.509 PDT
Gen. Time:        07/02/2013 05:39:45.092 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    84.111.88.8 (05:39:36.090 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->51444 (05:39:36.090 PDT)
       
    119.188.50.140 (05:39:45.092 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          58301->8284 (05:39:45.092 PDT)
       
    2.226.218.19 (05:38:36.226 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->48241 (05:38:36.226 PDT)
       
    91.218.38.132 (2) (05:38:01.195 PDT)
       event=1:1100018 {tcp} E7[info] P2P torrent announce tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          57680->2710 (05:38:01.195 PDT)
       -------------------------
       event=1:2102180 {tcp} E7[info] GPL P2P BitTorrent announce request, [] MAC_Src: 00:01:64:FF:CE:EA
          57680->2710 (05:38:01.195 PDT)
       
    197.35.14.46 (05:37:36.580 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->29733 (05:37:36.580 PDT)
       
    112.3.245.150 (05:37:35.554 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          57478->8634 (05:37:35.554 PDT)
       
    121.14.98.151 (05:37:11.509 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          57397->9090 (05:37:11.509 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (05:39:20.613 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (05:39:20.613 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372768631.509 1372768631.510 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 99.241.94.191, 178.148.3.207, 121.14.98.151
Resource List:    <unobserved>
Observed Start:   07/02/2013 07:39:43.777 PDT
Gen. Time:        07/02/2013 07:41:10.871 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    99.241.94.191 (07:39:43.777 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          62711->6890 (07:39:43.777 PDT)
       
    178.148.3.207 (07:40:36.979 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->15422 (07:40:36.979 PDT)
       
    121.14.98.151 (07:40:41.438 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          63047->9090 (07:40:41.438 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (07:41:10.871 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          63149->6099 (07:41:10.871 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372775983.777 1372775983.778 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 99.241.94.191, 187.64.43.22, 178.148.3.207, 178.239.54.151, 77.49.110.236, 141.217.46.17, 86.159.150.238, 121.14.98.151
Resource List:    <unobserved>
Observed Start:   07/02/2013 07:39:43.777 PDT
Gen. Time:        07/02/2013 07:43:39.908 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    99.241.94.191 (07:39:43.777 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          62711->6890 (07:39:43.777 PDT)
       
    187.64.43.22 (07:42:39.285 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->10806 (07:42:39.285 PDT)
       
    178.148.3.207 (07:40:36.979 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->15422 (07:40:36.979 PDT)
       
    178.239.54.151 (07:42:21.082 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          63490->2710 (07:42:21.082 PDT)
       
    77.49.110.236 (07:41:36.024 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->58992 (07:41:36.024 PDT)
       
    141.217.46.17 (07:43:39.908 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->21085 (07:43:39.908 PDT)
       
    86.159.150.238 (07:43:37.595 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          63915->51413 (07:43:37.595 PDT)
       
    121.14.98.151 (07:40:41.438 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          63047->9090 (07:40:41.438 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (07:41:10.871 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          63149->6099 (07:41:10.871 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372775983.777 1372775983.778 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 122.193.14.71, 91.218.38.132 (2)
Resource List:    <unobserved>
Observed Start:   07/02/2013 09:40:27.779 PDT
Gen. Time:        07/02/2013 09:41:21.015 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    122.193.14.71 (09:40:43.529 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          50518->43776 (09:40:43.529 PDT)
       
    91.218.38.132 (2) (09:40:27.779 PDT)
       event=1:1100018 {tcp} E7[info] P2P torrent announce tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          50388->2710 (09:40:27.779 PDT)
       -------------------------
       event=1:2102180 {tcp} E7[info] GPL P2P BitTorrent announce request, [] MAC_Src: 00:01:64:FF:CE:EA
          50388->2710 (09:40:27.779 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (09:41:21.015 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (09:41:21.015 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372783227.779 1372783227.780 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 122.193.14.71, 94.145.94.150, 108.227.77.19, 91.218.38.132 (2), 119.46.206.72, 178.239.54.151, 217.120.135.232, 186.215.3.179
Resource List:    <unobserved>
Observed Start:   07/02/2013 09:40:27.779 PDT
Gen. Time:        07/02/2013 09:44:27.778 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    122.193.14.71 (09:40:43.529 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          50518->43776 (09:40:43.529 PDT)
       
    94.145.94.150 (09:44:27.778 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6881 (09:44:27.778 PDT)
       
    108.227.77.19 (09:41:26.134 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->53020 (09:41:26.134 PDT)
       
    91.218.38.132 (2) (09:40:27.779 PDT)
       event=1:1100018 {tcp} E7[info] P2P torrent announce tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          50388->2710 (09:40:27.779 PDT)
       -------------------------
       event=1:2102180 {tcp} E7[info] GPL P2P BitTorrent announce request, [] MAC_Src: 00:01:64:FF:CE:EA
          50388->2710 (09:40:27.779 PDT)
       
    119.46.206.72 (09:44:05.814 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          51621->16884 (09:44:05.814 PDT)
       
    178.239.54.151 (09:43:10.585 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          51204->2710 (09:43:10.585 PDT)
       
    217.120.135.232 (09:42:26.567 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->21067 (09:42:26.567 PDT)
       
    186.215.3.179 (09:43:26.138 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->17491 (09:43:26.138 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (09:41:21.015 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (09:41:21.015 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372783227.779 1372783227.780 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 187.64.43.22, 84.229.236.136, 89.103.147.109
Resource List:    <unobserved>
Observed Start:   07/02/2013 11:40:30.021 PDT
Gen. Time:        07/02/2013 11:43:00.451 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    187.64.43.22 (11:40:30.021 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->10806 (11:40:30.021 PDT)
       
    84.229.236.136 (11:42:30.375 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->14110 (11:42:30.375 PDT)
       
    89.103.147.109 (11:41:30.445 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->14387 (11:41:30.445 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (11:43:00.451 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          62018->6099 (11:43:00.451 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372790430.021 1372790430.022 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 91.218.38.132 (2), 187.64.43.22, 178.239.54.151, 84.229.236.136, 89.103.147.109 (2), 2.121.142.90, 46.129.23.173
Resource List:    <unobserved>
Observed Start:   07/02/2013 11:40:30.021 PDT
Gen. Time:        07/02/2013 11:44:30.787 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    91.218.38.132 (2) (11:44:19.160 PDT)
       event=1:1100018 {tcp} E7[info] P2P torrent announce tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          62466->2710 (11:44:19.160 PDT)
       -------------------------
       event=1:2102180 {tcp} E7[info] GPL P2P BitTorrent announce request, [] MAC_Src: 00:01:64:FF:CE:EA
          62466->2710 (11:44:19.160 PDT)
       
    187.64.43.22 (11:40:30.021 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->10806 (11:40:30.021 PDT)
       
    178.239.54.151 (11:44:02.646 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          62409->2710 (11:44:02.646 PDT)
       
    84.229.236.136 (11:42:30.375 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->14110 (11:42:30.375 PDT)
       
    89.103.147.109 (2) (11:41:30.445 PDT-11:43:30.405 PDT)
       event=1:1100013 (2) {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          2: 51413->14387 (11:41:30.445 PDT-11:43:30.405 PDT)
       
    2.121.142.90 (11:43:22.912 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          62073->51066 (11:43:22.912 PDT)
       
    46.129.23.173 (11:44:30.787 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->53898 (11:44:30.787 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (11:43:00.451 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          62018->6099 (11:43:00.451 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372790430.021 1372790610.406 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   07/02/2013 13:43:30.423 PDT
Gen. Time:        07/02/2013 13:43:30.423 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (13:43:30.423 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (13:43:30.423 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372797810.423 1372797810.424 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 108.181.26.246, 190.16.24.172, 91.218.38.132 (2), 171.7.174.103, 119.46.206.72, 213.220.232.98, 178.239.54.151, 81.96.59.119
Resource List:    <unobserved>
Observed Start:   07/02/2013 13:43:30.423 PDT
Gen. Time:        07/02/2013 13:46:34.518 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    108.181.26.246 (13:44:34.000 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->56980 (13:44:34.000 PDT)
       
    190.16.24.172 (13:45:34.086 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->47469 (13:45:34.086 PDT)
       
    91.218.38.132 (2) (13:45:56.730 PDT)
       event=1:1100018 {tcp} E7[info] P2P torrent announce tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          57018->2710 (13:45:56.730 PDT)
       -------------------------
       event=1:2102180 {tcp} E7[info] GPL P2P BitTorrent announce request, [] MAC_Src: 00:01:64:FF:CE:EA
          57018->2710 (13:45:56.730 PDT)
       
    171.7.174.103 (13:45:58.769 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          57024->7547 (13:45:58.769 PDT)
       
    119.46.206.72 (13:44:07.470 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          56254->16884 (13:44:07.470 PDT)
       
    213.220.232.98 (13:46:34.518 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->36436 (13:46:34.518 PDT)
       
    178.239.54.151 (13:44:43.248 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          56504->2710 (13:44:43.248 PDT)
       
    81.96.59.119 (13:43:34.158 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->23069 (13:43:34.158 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (13:43:30.423 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (13:43:30.423 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372797810.423 1372797810.424 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 66.186.67.122, 92.30.167.206, 86.159.150.238
Resource List:    <unobserved>
Observed Start:   07/02/2013 15:43:48.227 PDT
Gen. Time:        07/02/2013 15:45:21.421 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    66.186.67.122 (15:44:02.917 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->23306 (15:44:02.917 PDT)
       
    92.30.167.206 (15:45:02.804 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->20599 (15:45:02.804 PDT)
       
    86.159.150.238 (15:43:48.227 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          65444->51413 (15:43:48.227 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (15:45:21.421 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          49425->6099 (15:45:21.421 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372805028.227 1372805028.228 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 66.186.67.122, 181.47.89.155, 92.30.167.206, 178.239.54.151, 86.159.150.238
Resource List:    <unobserved>
Observed Start:   07/02/2013 15:43:48.227 PDT
Gen. Time:        07/02/2013 15:46:08.589 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    66.186.67.122 (15:44:02.917 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->23306 (15:44:02.917 PDT)
       
    181.47.89.155 (15:46:08.589 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->64476 (15:46:08.589 PDT)
       
    92.30.167.206 (15:45:02.804 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->20599 (15:45:02.804 PDT)
       
    178.239.54.151 (15:45:21.592 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          49424->2710 (15:45:21.592 PDT)
       
    86.159.150.238 (15:43:48.227 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          65444->51413 (15:43:48.227 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (15:45:21.421 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          49425->6099 (15:45:21.421 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372805028.227 1372805028.228 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 66.186.67.122, 91.218.38.132 (2), 189.215.133.5, 203.113.15.213, 178.239.54.151, 174.92.221.63, 189.59.8.114
Resource List:    <unobserved>
Observed Start:   07/02/2013 17:42:34.496 PDT
Gen. Time:        07/02/2013 17:46:10.573 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    66.186.67.122 (17:43:32.201 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->23306 (17:43:32.201 PDT)
       
    91.218.38.132 (2) (17:42:34.496 PDT)
       event=1:1100018 {tcp} E7[info] P2P torrent announce tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          53123->2710 (17:42:34.496 PDT)
       -------------------------
       event=1:2102180 {tcp} E7[info] GPL P2P BitTorrent announce request, [] MAC_Src: 00:01:64:FF:CE:EA
          53123->2710 (17:42:34.496 PDT)
       
    189.215.133.5 (17:44:33.255 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->22243 (17:44:33.255 PDT)
       
    203.113.15.213 (17:43:47.457 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          53559->16882 (17:43:47.457 PDT)
       
    178.239.54.151 (17:45:41.271 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          54181->2710 (17:45:41.271 PDT)
       
    174.92.221.63 (17:45:33.102 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->10101 (17:45:33.102 PDT)
       
    189.59.8.114 (17:44:48.754 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          53901->16882 (17:44:48.754 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (17:46:10.573 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (17:46:10.573 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372812154.496 1372812154.497 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 66.186.67.122, 91.218.38.132 (2), 189.215.133.5, 203.113.15.213, 178.239.54.151, 174.92.221.63, 189.59.8.114, 67.176.4.141
Resource List:    <unobserved>
Observed Start:   07/02/2013 17:42:34.496 PDT
Gen. Time:        07/02/2013 17:46:33.735 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    66.186.67.122 (17:43:32.201 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->23306 (17:43:32.201 PDT)
       
    91.218.38.132 (2) (17:42:34.496 PDT)
       event=1:1100018 {tcp} E7[info] P2P torrent announce tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          53123->2710 (17:42:34.496 PDT)
       -------------------------
       event=1:2102180 {tcp} E7[info] GPL P2P BitTorrent announce request, [] MAC_Src: 00:01:64:FF:CE:EA
          53123->2710 (17:42:34.496 PDT)
       
    189.215.133.5 (17:44:33.255 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->22243 (17:44:33.255 PDT)
       
    203.113.15.213 (17:43:47.457 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          53559->16882 (17:43:47.457 PDT)
       
    178.239.54.151 (17:45:41.271 PDT)
       event=1:1100016 {tcp} E7[info] P2P torrent scrape tracker request, [] MAC_Src: 00:01:64:FF:CE:EA
          54181->2710 (17:45:41.271 PDT)
       
    174.92.221.63 (17:45:33.102 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->10101 (17:45:33.102 PDT)
       
    189.59.8.114 (17:44:48.754 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          53901->16882 (17:44:48.754 PDT)
       
    67.176.4.141 (17:46:33.735 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->42710 (17:46:33.735 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (17:46:10.573 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (17:46:10.573 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372812154.496 1372812154.497 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 111.68.114.10
Resource List:    <unobserved>
Observed Start:   07/02/2013 19:48:10.131 PDT
Gen. Time:        07/02/2013 19:48:20.216 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    111.68.114.10 (19:48:10.131 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->56887 (19:48:10.131 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (19:48:20.216 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          57843->6099 (19:48:20.216 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372819690.131 1372819690.132 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 201.141.147.209, 111.68.114.10, 61.91.88.80, 86.19.169.39
Resource List:    <unobserved>
Observed Start:   07/02/2013 19:48:10.131 PDT
Gen. Time:        07/02/2013 19:50:11.502 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    201.141.147.209 (19:49:11.981 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->12295 (19:49:11.981 PDT)
       
    111.68.114.10 (19:48:10.131 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->56887 (19:48:10.131 PDT)
       
    61.91.88.80 (19:48:43.110 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          57999->16882 (19:48:43.110 PDT)
       
    86.19.169.39 (19:50:11.502 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6882 (19:50:11.502 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (19:48:20.216 PDT)
       event=1:9930009 {tcp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          57843->6099 (19:48:20.216 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372819690.131 1372819690.132 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 61.91.88.127, 86.19.169.39
Resource List:    <unobserved>
Observed Start:   07/02/2013 21:48:41.184 PDT
Gen. Time:        07/02/2013 21:49:10.820 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    61.91.88.127 (21:48:41.184 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          61293->16881 (21:48:41.184 PDT)
       
    86.19.169.39 (21:48:41.643 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6882 (21:48:41.643 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (21:49:10.820 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (21:49:10.820 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372826921.184 1372826921.185 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.36
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: 177.65.34.165, 178.207.16.88, 150.101.100.2, 121.97.69.210, 61.91.88.127, 86.19.169.39
Resource List:    <unobserved>
Observed Start:   07/02/2013 21:48:41.184 PDT
Gen. Time:        07/02/2013 21:52:05.614 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND SCAN
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    177.65.34.165 (21:51:45.519 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->55391 (21:51:45.519 PDT)
       
    178.207.16.88 (21:51:54.257 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          62250->16881 (21:51:54.257 PDT)
       
    150.101.100.2 (21:49:42.742 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->60053 (21:49:42.742 PDT)
       
    121.97.69.210 (21:50:43.525 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->13014 (21:50:43.525 PDT)
       
    61.91.88.127 (21:48:41.184 PDT)
       event=1:1100012 {tcp} E7[info] P2P BitTorrent handshake, [] MAC_Src: 00:01:64:FF:CE:EA
          61293->16881 (21:48:41.184 PDT)
       
    86.19.169.39 (21:48:41.643 PDT)
       event=1:1100013 {udp} E7[info] P2P torrent DHT ping, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6882 (21:48:41.643 PDT)
       
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    69.43.161.167 (21:49:10.820 PDT)
       event=1:9930020 {udp} E8[unk] ET ShadowServer confirmed botnet control server on non-standard port, [] MAC_Src: 00:01:64:FF:CE:EA
          51413->6099 (21:49:10.820 PDT)
       
DECLARE BOT Local Threat Triggered
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    <unobserved>
    
tcpslice 1372826921.184 1372826921.185 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.36'

============================== SEPARATOR ================================