Score: 1.0 (>= 0.8) Infected Target: 192.168.1.85 Infector List: Egg Source List: C & C List: 66.249.73.140 Peer Coord. List: Resource List: Observed Start: 07/29/2013 15:38:57.734 PDT Gen. Time: 07/29/2013 15:39:14.195 PDT INBOUND SCAN EXPLOIT EXPLOIT MALWARE DNS EGG DOWNLOAD C and C TRAFFIC 66.249.73.140 (15:38:57.734 PDT) event=1:2002033 {tcp} E4[rb] ET TROJAN BOT - potential response, [] MAC_Src: 00:01:64:FF:CE:EA 80->63165 (15:38:57.734 PDT) C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN 66.249.73.140 (15:39:14.195 PDT) event=1:552123 {tcp} E5[rb] REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner, [] MAC_Src: 00:01:64:FF:CE:EA 80->61767 (15:39:14.195 PDT) ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1375137537.734 1375137537.735 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.85' ============================== SEPARATOR ================================ Score: 1.0 (>= 0.8) Infected Target: 192.168.1.85 Infector List: Egg Source List: C & C List: 66.249.73.140 Peer Coord. List: Resource List: Observed Start: 07/29/2013 15:38:57.734 PDT Gen. Time: 07/29/2013 16:05:21.361 PDT INBOUND SCAN EXPLOIT EXPLOIT MALWARE DNS EGG DOWNLOAD C and C TRAFFIC 66.249.73.140 (15:38:57.734 PDT) event=1:2002033 {tcp} E4[rb] ET TROJAN BOT - potential response, [] MAC_Src: 00:01:64:FF:CE:EA 80->63165 (15:38:57.734 PDT) C and C TRAFFIC (RBN) C and C DNS CHECK-IN OUTBOUND SKYPE CANDIDATE OUTBOUND SCAN (spp) OUTBOUND SCAN 180.76.5.195 (15:42:22.314 PDT) event=1:552123 {tcp} E5[rb] REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner, [] MAC_Src: 00:01:64:FF:CE:EA 80->4688 (15:42:22.314 PDT) 66.249.73.140 (16) (15:39:14.195 PDT) event=1:552123 (16) {tcp} E5[rb] REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner, [] MAC_Src: 00:01:64:FF:CE:EA 80->61767 (15:39:14.195 PDT) 80->64216 (15:39:30.822 PDT) 80->61000 (15:39:48.387 PDT) 80->57364 (15:40:04.050 PDT) 80->35914 (15:41:48.514 PDT) 80->41841 (15:42:32.445 PDT) 80->39304 (15:42:47.093 PDT) 80->45770 (15:43:01.734 PDT) 80->57150 (15:43:16.381 PDT) 80->61200 (15:43:30.950 PDT) 80->55710 (15:43:45.673 PDT) 80->60480 (15:44:29.592 PDT) 80->34428 (15:45:28.507 PDT) 80->59498 (15:45:58.450 PDT) 80->38086 (15:46:28.417 PDT) 80->40948 (15:46:58.358 PDT) ATTACK PREP PEER COORDINATION Info PEER COORDINATION DECLARE BOT Standard Port DECLARE BOT Non-standard Port DECLARE BOT Local Threat Triggered DECLARE BOT OUTBOUND INTENSE MALWARE PORT SCAN tcpslice 1375137537.734 1375137537.735 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.85' ============================== SEPARATOR ================================