Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 14:00:07.989 PDT
Gen. Time:        09/05/2013 14:00:41.635 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    198.133.224.149 (2) (14:00:40.155 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          59604->22 (14:00:40.155 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          59604->22 (14:00:40.155 PDT)
       
    204.8.155.227 (14:00:29.583 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40000->22 (14:00:29.583 PDT)
       
    128.10.19.53 (14:00:07.989 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          33329->22 (14:00:07.989 PDT)
       
    129.82.12.188 (14:00:17.308 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          55985->22 (14:00:17.308 PDT)
       
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    198.133.224.147 (14:00:41.635 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (14 /24s) (# pkts S/M/O/I=0/21/0/0): 22:21, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (14:00:41.635 PDT)
       
tcpslice 1378414807.989 1378414807.990 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 14:00:07.989 PDT
Gen. Time:        09/05/2013 14:09:50.273 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    128.10.19.53 (2) (14:00:07.989 PDT)
       event=1:2003068 (2) {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          33329->22 (14:00:07.989 PDT)
          33951->22 (14:01:51.501 PDT)
       
    155.246.12.164 (14:02:13.918 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          55884->22 (14:02:13.918 PDT)
       
    165.91.55.9 (2) (14:02:02.595 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          57265->22 (14:02:02.595 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          57265->22 (14:02:02.595 PDT)
       
    128.42.142.45 (14:01:08.562 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          52615->22 (14:01:08.562 PDT)
       
    131.193.34.38 (14:01:00.806 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          51276->22 (14:01:00.806 PDT)
       
    158.130.6.253 (14:01:40.682 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          39998->22 (14:01:40.682 PDT)
       
    198.133.224.149 (2) (14:00:40.155 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          59604->22 (14:00:40.155 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          59604->22 (14:00:40.155 PDT)
       
    204.8.155.227 (14:00:29.583 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40000->22 (14:00:29.583 PDT)
       
    129.82.12.188 (2) (14:00:17.308 PDT)
       event=1:2003068 (2) {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          55985->22 (14:00:17.308 PDT)
          56731->22 (14:02:22.052 PDT)
       
    13.7.64.20 (2) (14:01:23.429 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          57374->22 (14:01:23.429 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          57374->22 (14:01:23.429 PDT)
       
    130.127.39.153 (14:01:14.750 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40743->22 (14:01:14.750 PDT)
       
    128.208.4.198 (14:01:30.875 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          48995->22 (14:01:30.875 PDT)
       
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    198.133.224.147 (6) (14:00:41.635 PDT-14:09:17.567 PDT)
       event=777:7777008 (6) {tcp} E8[bh] Detected intense malware port scanning of 42 IPs (25 /24s) (# pkts S/M/O/I=0/41/1/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          2: 0->0 (14:07:39.897 PDT-14:09:17.567 PDT)
          0->0 (14:00:41.635 PDT)
          3: 0->0 (14:02:13.918 PDT-14:05:19.370 PDT)
       
tcpslice 1378414807.989 1378415357.568 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 14:10:55.973 PDT
Gen. Time:        09/05/2013 14:10:55.973 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    <unobserved>
    
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    198.133.224.147 (14:10:55.973 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 42 IPs (25 /24s) (# pkts S/M/O/I=0/41/1/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (14:10:55.973 PDT)
       
tcpslice 1378415455.973 1378415455.974 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 15:06:31.041 PDT
Gen. Time:        09/05/2013 15:08:54.009 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    128.111.52.58 (2) (15:07:28.357 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          41575->22 (15:07:28.357 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          41582->22 (15:07:29.483 PDT)
       
    128.208.4.197 (15:08:07.177 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          37324->22 (15:08:07.177 PDT)
       
    128.10.19.53 (15:07:45.028 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          50375->22 (15:07:45.028 PDT)
       
    131.179.150.72 (15:06:31.041 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          37413->22 (15:06:31.041 PDT)
       
    72.36.112.79 (15:07:00.378 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          44177->22 (15:07:00.378 PDT)
       
    131.179.150.70 (15:07:48.473 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          35808->22 (15:07:48.473 PDT)
       
    13.7.64.22 (15:08:03.667 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          51661->22 (15:08:03.667 PDT)
       
    128.42.142.45 (15:06:48.626 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40898->22 (15:06:48.626 PDT)
       
    204.8.155.227 (15:07:19.944 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          56785->22 (15:07:19.944 PDT)
       
    192.91.235.230 (15:07:37.180 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          60345->22 (15:07:37.180 PDT)
       
    129.82.12.188 (2) (15:07:51.629 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          44786->22 (15:07:51.629 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          44801->22 (15:07:54.178 PDT)
       
    141.212.113.180 (15:07:26.065 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          54686->22 (15:07:26.065 PDT)
       
    141.212.113.179 (15:08:00.067 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          39720->22 (15:08:00.067 PDT)
       
    128.111.52.59 (15:08:08.962 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          36593->22 (15:08:08.962 PDT)
       
    130.127.39.152 (15:07:12.616 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          35467->22 (15:07:12.616 PDT)
       
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    141.212.113.179 (15:08:54.009 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (15 /24s) (# pkts S/M/O/I=0/21/0/0): 22:21, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (15:08:54.009 PDT)
       
tcpslice 1378418791.041 1378418791.042 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 15:06:31.041 PDT
Gen. Time:        09/05/2013 15:15:19.270 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    128.111.52.58 (2) (15:07:28.357 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          41575->22 (15:07:28.357 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          41582->22 (15:07:29.483 PDT)
       
    128.208.4.197 (15:08:07.177 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          37324->22 (15:08:07.177 PDT)
       
    128.10.19.53 (15:07:45.028 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          50375->22 (15:07:45.028 PDT)
       
    131.179.150.72 (15:06:31.041 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          37413->22 (15:06:31.041 PDT)
       
    72.36.112.79 (15:07:00.378 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          44177->22 (15:07:00.378 PDT)
       
    131.179.150.70 (15:07:48.473 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          35808->22 (15:07:48.473 PDT)
       
    13.7.64.22 (15:08:03.667 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          51661->22 (15:08:03.667 PDT)
       
    128.42.142.45 (15:06:48.626 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40898->22 (15:06:48.626 PDT)
       
    204.8.155.227 (15:07:19.944 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          56785->22 (15:07:19.944 PDT)
       
    192.91.235.230 (15:07:37.180 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          60345->22 (15:07:37.180 PDT)
       
    129.82.12.188 (2) (15:07:51.629 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          44786->22 (15:07:51.629 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          44801->22 (15:07:54.178 PDT)
       
    141.212.113.180 (15:07:26.065 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          54686->22 (15:07:26.065 PDT)
       
    141.212.113.179 (15:08:00.067 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          39720->22 (15:08:00.067 PDT)
       
    128.111.52.59 (15:08:08.962 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          36593->22 (15:08:08.962 PDT)
       
    130.127.39.152 (15:07:12.616 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          35467->22 (15:07:12.616 PDT)
       
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    141.212.113.179 (15:08:54.009 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (15 /24s) (# pkts S/M/O/I=0/21/0/0): 22:21, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (15:08:54.009 PDT)
       
    165.91.55.10 (15:10:24.292 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 34 IPs (22 /24s) (# pkts S/M/O/I=0/34/0/0): 22:34, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (15:10:24.292 PDT)
       
tcpslice 1378418791.041 1378418791.042 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 15:11:19.668 PDT
Gen. Time:        09/05/2013 15:11:19.668 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    <unobserved>
    
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    128.8.126.111 (15:11:19.668 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 41 IPs (24 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (15:11:19.668 PDT)
       
tcpslice 1378419079.668 1378419079.669 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 15:26:57.785 PDT
Gen. Time:        09/05/2013 15:29:14.051 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    128.111.52.58 (2) (15:27:47.817 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          43899->22 (15:27:47.817 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          43903->22 (15:27:49.801 PDT)
       
    128.208.4.197 (15:28:31.276 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          39477->22 (15:28:31.276 PDT)
       
    128.10.19.53 (15:28:04.479 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          52623->22 (15:28:04.479 PDT)
       
    131.179.150.72 (15:26:57.785 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          39785->22 (15:26:57.785 PDT)
       
    72.36.112.79 (15:27:25.456 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          46546->22 (15:27:25.456 PDT)
       
    131.179.150.70 (15:28:07.446 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          38039->22 (15:28:07.446 PDT)
       
    13.7.64.22 (15:28:27.756 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          53821->22 (15:28:27.756 PDT)
       
    128.42.142.45 (15:27:13.226 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          43268->22 (15:27:13.226 PDT)
       
    204.8.155.227 (15:27:40.364 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          59147->22 (15:27:40.364 PDT)
       
    192.91.235.230 (15:27:57.401 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          34390->22 (15:27:57.401 PDT)
       
    129.82.12.188 (2) (15:28:07.857 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          46996->22 (15:28:07.857 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          47000->22 (15:28:13.317 PDT)
       
    141.212.113.180 (15:27:46.671 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          57025->22 (15:27:46.671 PDT)
       
    141.212.113.179 (15:28:21.911 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          41891->22 (15:28:21.911 PDT)
       
    128.111.52.59 (15:28:31.952 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          38743->22 (15:28:31.952 PDT)
       
    130.127.39.152 (15:27:32.745 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          37833->22 (15:27:32.745 PDT)
       
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    128.111.52.58 (15:29:14.051 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (16 /24s) (# pkts S/M/O/I=0/20/1/0): 22:20, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (15:29:14.051 PDT)
       
tcpslice 1378420017.785 1378420017.786 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 15:26:57.785 PDT
Gen. Time:        09/05/2013 15:35:50.124 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    128.111.52.58 (2) (15:27:47.817 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          43899->22 (15:27:47.817 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          43903->22 (15:27:49.801 PDT)
       
    128.208.4.197 (15:28:31.276 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          39477->22 (15:28:31.276 PDT)
       
    128.10.19.53 (15:28:04.479 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          52623->22 (15:28:04.479 PDT)
       
    131.179.150.72 (15:26:57.785 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          39785->22 (15:26:57.785 PDT)
       
    72.36.112.79 (15:27:25.456 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          46546->22 (15:27:25.456 PDT)
       
    131.179.150.70 (15:28:07.446 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          38039->22 (15:28:07.446 PDT)
       
    13.7.64.22 (15:28:27.756 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          53821->22 (15:28:27.756 PDT)
       
    128.42.142.45 (15:27:13.226 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          43268->22 (15:27:13.226 PDT)
       
    204.8.155.227 (15:27:40.364 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          59147->22 (15:27:40.364 PDT)
       
    192.91.235.230 (15:27:57.401 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          34390->22 (15:27:57.401 PDT)
       
    129.82.12.188 (2) (15:28:07.857 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          46996->22 (15:28:07.857 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          47000->22 (15:28:13.317 PDT)
       
    141.212.113.180 (15:27:46.671 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          57025->22 (15:27:46.671 PDT)
       
    141.212.113.179 (15:28:21.911 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          41891->22 (15:28:21.911 PDT)
       
    128.111.52.59 (15:28:31.952 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          38743->22 (15:28:31.952 PDT)
       
    130.127.39.152 (15:27:32.745 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          37833->22 (15:27:32.745 PDT)
       
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    128.111.52.58 (15:29:14.051 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (16 /24s) (# pkts S/M/O/I=0/20/1/0): 22:20, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (15:29:14.051 PDT)
       
    131.193.34.38 (15:30:44.672 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 34 IPs (23 /24s) (# pkts S/M/O/I=0/32/2/0): 22:32, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (15:30:44.672 PDT)
       
tcpslice 1378420017.785 1378420017.786 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 15:31:50.406 PDT
Gen. Time:        09/05/2013 15:31:50.406 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    <unobserved>
    
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    128.8.126.111 (15:31:50.406 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 43 IPs (26 /24s) (# pkts S/M/O/I=0/41/2/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (15:31:50.406 PDT)
       
tcpslice 1378420310.406 1378420310.407 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 15:47:33.325 PDT
Gen. Time:        09/05/2013 15:49:53.280 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    128.111.52.58 (15:48:26.281 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          44432->22 (15:48:26.281 PDT)
       
    128.208.4.197 (2) (15:49:04.605 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          40006->22 (15:49:04.605 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40006->22 (15:49:04.605 PDT)
       
    128.10.19.53 (15:48:42.687 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          53152->22 (15:48:42.687 PDT)
       
    131.179.150.72 (15:47:33.325 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40314->22 (15:47:33.325 PDT)
       
    72.36.112.79 (15:48:02.430 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          47075->22 (15:48:02.430 PDT)
       
    131.179.150.70 (2) (15:48:45.622 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          38568->22 (15:48:45.622 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          38568->22 (15:48:45.622 PDT)
       
    13.7.64.22 (15:49:01.010 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          54350->22 (15:49:01.010 PDT)
       
    128.42.142.45 (15:47:48.506 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          43797->22 (15:47:48.506 PDT)
       
    204.8.155.227 (15:48:16.886 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          59676->22 (15:48:16.886 PDT)
       
    192.91.235.230 (15:48:34.863 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          34919->22 (15:48:34.863 PDT)
       
    129.82.12.188 (15:48:51.299 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          47529->22 (15:48:51.299 PDT)
       
    141.212.113.180 (2) (15:48:23.187 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          57554->22 (15:48:23.187 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          57554->22 (15:48:23.187 PDT)
       
    141.212.113.179 (15:48:57.287 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          42420->22 (15:48:57.287 PDT)
       
    130.127.39.152 (15:48:09.175 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          38362->22 (15:48:09.175 PDT)
       
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    131.179.150.72 (15:49:53.280 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (15 /24s) (# pkts S/M/O/I=0/21/0/0): 22:21, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (15:49:53.280 PDT)
       
tcpslice 1378421253.325 1378421253.326 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 15:47:33.325 PDT
Gen. Time:        09/05/2013 15:56:22.925 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    128.111.52.58 (15:48:26.281 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          44432->22 (15:48:26.281 PDT)
       
    128.208.4.197 (2) (15:49:04.605 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          40006->22 (15:49:04.605 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40006->22 (15:49:04.605 PDT)
       
    128.10.19.53 (15:48:42.687 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          53152->22 (15:48:42.687 PDT)
       
    131.179.150.72 (15:47:33.325 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40314->22 (15:47:33.325 PDT)
       
    72.36.112.79 (15:48:02.430 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          47075->22 (15:48:02.430 PDT)
       
    131.179.150.70 (2) (15:48:45.622 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          38568->22 (15:48:45.622 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          38568->22 (15:48:45.622 PDT)
       
    13.7.64.22 (15:49:01.010 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          54350->22 (15:49:01.010 PDT)
       
    128.42.142.45 (15:47:48.506 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          43797->22 (15:47:48.506 PDT)
       
    204.8.155.227 (15:48:16.886 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          59676->22 (15:48:16.886 PDT)
       
    192.91.235.230 (15:48:34.863 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          34919->22 (15:48:34.863 PDT)
       
    129.82.12.188 (15:48:51.299 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          47529->22 (15:48:51.299 PDT)
       
    141.212.113.180 (2) (15:48:23.187 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          57554->22 (15:48:23.187 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          57554->22 (15:48:23.187 PDT)
       
    141.212.113.179 (15:48:57.287 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          42420->22 (15:48:57.287 PDT)
       
    130.127.39.152 (15:48:09.175 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          38362->22 (15:48:09.175 PDT)
       
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    131.179.150.72 (15:49:53.280 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (15 /24s) (# pkts S/M/O/I=0/21/0/0): 22:21, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (15:49:53.280 PDT)
       
    131.193.34.38 (15:51:24.427 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 33 IPs (22 /24s) (# pkts S/M/O/I=0/33/0/0): 22:33, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (15:51:24.427 PDT)
       
tcpslice 1378421253.325 1378421253.326 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 15:52:22.962 PDT
Gen. Time:        09/05/2013 15:52:22.962 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    <unobserved>
    
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    131.193.34.38 (15:52:22.962 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 41 IPs (24 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (15:52:22.962 PDT)
       
tcpslice 1378421542.962 1378421542.963 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 16:04:49.016 PDT
Gen. Time:        09/05/2013 16:04:49.016 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    <unobserved>
    
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    72.36.112.78 (16:04:49.016 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (14 /24s) (# pkts S/M/O/I=0/21/0/0): 22:21, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (16:04:49.016 PDT)
       
tcpslice 1378422289.016 1378422289.017 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 16:04:49.016 PDT
Gen. Time:        09/05/2013 16:16:44.593 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    128.111.52.58 (16:08:42.205 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          44648->22 (16:08:42.205 PDT)
       
    128.208.4.197 (16:09:18.743 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40222->22 (16:09:18.743 PDT)
       
    128.10.19.53 (16:08:57.054 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          53368->22 (16:08:57.054 PDT)
       
    131.179.150.72 (16:07:50.824 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40530->22 (16:07:50.824 PDT)
       
    72.36.112.79 (16:08:17.085 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          47291->22 (16:08:17.085 PDT)
       
    131.179.150.70 (16:08:59.868 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          38784->22 (16:08:59.868 PDT)
       
    13.7.64.22 (16:09:15.254 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          54566->22 (16:09:15.254 PDT)
       
    128.42.142.45 (16:08:05.809 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          44013->22 (16:08:05.809 PDT)
       
    204.8.155.227 (16:08:32.998 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          59892->22 (16:08:32.998 PDT)
       
    192.91.235.230 (2) (16:08:44.649 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          35132->22 (16:08:44.649 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          35135->22 (16:08:50.168 PDT)
       
    129.82.12.188 (16:09:05.461 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          47745->22 (16:09:05.461 PDT)
       
    141.212.113.180 (16:08:39.224 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          57770->22 (16:08:39.224 PDT)
       
    141.212.113.179 (2) (16:09:07.785 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          42633->22 (16:09:07.785 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          42636->22 (16:09:11.583 PDT)
       
    128.111.52.59 (16:09:22.101 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          39492->22 (16:09:22.101 PDT)
       
    130.127.39.152 (16:08:25.417 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          38578->22 (16:08:25.417 PDT)
       
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    13.7.64.22 (6) (16:06:52.518 PDT-16:15:39.366 PDT)
       event=777:7777008 (6) {tcp} E8[bh] Detected intense malware port scanning of 41 IPs (24 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          2: 0->0 (16:13:08.838 PDT-16:15:39.366 PDT)
          0->0 (16:08:22.484 PDT)
          0->0 (16:11:23.023 PDT)
          0->0 (16:06:52.518 PDT)
          0->0 (16:09:53.655 PDT)
       
    72.36.112.78 (16:04:49.016 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (14 /24s) (# pkts S/M/O/I=0/21/0/0): 22:21, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (16:04:49.016 PDT)
       
tcpslice 1378422289.016 1378422939.367 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 16:18:13.096 PDT
Gen. Time:        09/05/2013 16:18:13.096 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    <unobserved>
    
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    13.7.64.22 (16:18:13.096 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 41 IPs (24 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (16:18:13.096 PDT)
       
tcpslice 1378423093.096 1378423093.097 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 16:23:50.778 PDT
Gen. Time:        09/05/2013 16:23:50.778 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    <unobserved>
    
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    13.7.64.22 (16:23:50.778 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 41 IPs (24 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (16:23:50.778 PDT)
       
tcpslice 1378423430.778 1378423430.779 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 16:28:29.609 PDT
Gen. Time:        09/05/2013 16:29:16.683 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    131.179.150.72 (16:28:29.609 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40745->22 (16:28:29.609 PDT)
       
    204.8.155.227 (16:29:14.036 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          60107->22 (16:29:14.036 PDT)
       
    128.42.142.45 (16:28:48.023 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          44228->22 (16:28:48.023 PDT)
       
    72.36.112.79 (16:28:59.227 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          47506->22 (16:28:59.227 PDT)
       
    130.127.39.152 (16:29:06.432 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          38793->22 (16:29:06.432 PDT)
       
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    13.7.64.22 (16:29:16.683 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 41 IPs (24 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (16:29:16.683 PDT)
       
tcpslice 1378423709.609 1378423709.610 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 16:28:29.609 PDT
Gen. Time:        09/05/2013 16:37:24.866 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    128.111.52.58 (16:29:23.490 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          44863->22 (16:29:23.490 PDT)
       
    128.208.4.197 (2) (16:30:04.807 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          40435->22 (16:30:04.807 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40437->22 (16:30:06.517 PDT)
       
    128.10.19.53 (16:29:40.706 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          53583->22 (16:29:40.706 PDT)
       
    131.179.150.72 (16:28:29.609 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40745->22 (16:28:29.609 PDT)
       
    72.36.112.79 (16:28:59.227 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          47506->22 (16:28:59.227 PDT)
       
    131.179.150.70 (2) (16:29:42.880 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          38997->22 (16:29:42.880 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          38999->22 (16:29:43.847 PDT)
       
    13.7.64.22 (16:30:01.822 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          54781->22 (16:30:01.822 PDT)
       
    128.42.142.45 (16:28:48.023 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          44228->22 (16:28:48.023 PDT)
       
    204.8.155.227 (16:29:14.036 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          60107->22 (16:29:14.036 PDT)
       
    192.91.235.230 (16:29:33.547 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          35350->22 (16:29:33.547 PDT)
       
    129.82.12.188 (16:29:49.744 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          47960->22 (16:29:49.744 PDT)
       
    141.212.113.180 (2) (16:29:17.910 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          57983->22 (16:29:17.910 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          57985->22 (16:29:20.464 PDT)
       
    141.212.113.179 (16:29:56.209 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          42851->22 (16:29:56.209 PDT)
       
    130.127.39.152 (16:29:06.432 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          38793->22 (16:29:06.432 PDT)
       
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    13.7.64.22 (5) (16:29:16.683 PDT-16:36:23.526 PDT)
       event=777:7777008 (5) {tcp} E8[bh] Detected intense malware port scanning of 41 IPs (24 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          5: 0->0 (16:29:16.683 PDT-16:36:23.526 PDT)
       
tcpslice 1378423709.609 1378424183.527 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 16:38:54.054 PDT
Gen. Time:        09/05/2013 16:38:54.054 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    <unobserved>
    
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    13.7.64.22 (16:38:54.054 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 41 IPs (24 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (16:38:54.054 PDT)
       
tcpslice 1378424334.054 1378424334.055 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 16:43:55.110 PDT
Gen. Time:        09/05/2013 16:43:55.110 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    <unobserved>
    
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    13.7.64.22 (16:43:55.110 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 41 IPs (24 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (16:43:55.110 PDT)
       
tcpslice 1378424635.110 1378424635.111 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 16:48:25.297 PDT
Gen. Time:        09/05/2013 16:48:25.297 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    <unobserved>
    
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    13.7.64.22 (16:48:25.297 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 41 IPs (24 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (16:48:25.297 PDT)
       
tcpslice 1378424905.297 1378424905.298 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 16:48:25.297 PDT
Gen. Time:        09/05/2013 17:00:04.252 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    128.111.52.58 (2) (16:49:51.813 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          45077->22 (16:49:51.813 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          45078->22 (16:49:52.288 PDT)
       
    128.208.4.197 (2) (16:51:14.278 PDT)
       event=1:2003068 (2) {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40648->22 (16:51:14.278 PDT)
          40650->22 (16:52:37.078 PDT)
       
    128.10.19.53 (16:50:07.665 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          53798->22 (16:50:07.665 PDT)
       
    131.179.150.72 (16:49:03.156 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40960->22 (16:49:03.156 PDT)
       
    72.36.112.79 (16:49:25.864 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          47721->22 (16:49:25.864 PDT)
       
    131.179.150.70 (16:50:11.224 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          39214->22 (16:50:11.224 PDT)
       
    13.7.64.22 (16:50:28.559 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          54996->22 (16:50:28.559 PDT)
       
    128.42.142.45 (16:49:14.452 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          44443->22 (16:49:14.452 PDT)
       
    204.8.155.227 (16:49:40.895 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          60322->22 (16:49:40.895 PDT)
       
    192.91.235.230 (16:49:59.935 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          35565->22 (16:49:59.935 PDT)
       
    129.82.12.188 (2) (16:50:16.595 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          48174->22 (16:50:16.595 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          48175->22 (16:50:18.050 PDT)
       
    141.212.113.180 (16:49:49.265 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          58200->22 (16:49:49.265 PDT)
       
    141.212.113.179 (16:50:24.799 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          43066->22 (16:50:24.799 PDT)
       
    130.127.39.152 (16:49:33.215 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          39008->22 (16:49:33.215 PDT)
       
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    13.7.64.22 (5) (16:48:25.297 PDT-16:55:02.638 PDT)
       event=777:7777008 (5) {tcp} E8[bh] Detected intense malware port scanning of 41 IPs (24 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          5: 0->0 (16:48:25.297 PDT-16:55:02.638 PDT)
       
tcpslice 1378424905.297 1378425302.639 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 17:01:35.974 PDT
Gen. Time:        09/05/2013 17:01:35.974 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    <unobserved>
    
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    13.7.64.22 (17:01:35.974 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 41 IPs (24 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (17:01:35.974 PDT)
       
tcpslice 1378425695.974 1378425695.975 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 17:06:37.030 PDT
Gen. Time:        09/05/2013 17:06:37.030 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    <unobserved>
    
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    13.7.64.22 (17:06:37.030 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 41 IPs (24 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (17:06:37.030 PDT)
       
tcpslice 1378425997.030 1378425997.031 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 17:11:06.266 PDT
Gen. Time:        09/05/2013 17:11:06.266 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    <unobserved>
    
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    13.7.64.22 (17:11:06.266 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 41 IPs (24 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (17:11:06.266 PDT)
       
tcpslice 1378426266.266 1378426266.267 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/05/2013 17:11:06.266 PDT
Gen. Time:        09/05/2013 17:21:43.361 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL ATK SRC)
    <unobserved>
    
EXPLOIT (ATK FROM INTERNAL SRC)
    <unobserved>
    
CLIENT-INITIATED EXPLOIT
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL SRC)
    <unobserved>
    
EGG DOWNLOAD (DL FROM INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL BOT)
    <unobserved>
    
C and C TRAFFIC (INTERNAL CnC)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    128.111.52.58 (17:12:28.945 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          45294->22 (17:12:28.945 PDT)
       
    128.208.4.197 (17:13:12.728 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40868->22 (17:13:12.728 PDT)
       
    128.10.19.53 (17:12:44.497 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          54014->22 (17:12:44.497 PDT)
       
    131.179.150.72 (17:11:29.210 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          41176->22 (17:11:29.210 PDT)
       
    72.36.112.79 (17:12:03.647 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          47937->22 (17:12:03.647 PDT)
       
    131.179.150.70 (17:12:47.997 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          39430->22 (17:12:47.997 PDT)
       
    13.7.64.22 (17:13:05.015 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          55212->22 (17:13:05.015 PDT)
       
    128.42.142.45 (17:11:44.486 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          44659->22 (17:11:44.486 PDT)
       
    204.8.155.227 (17:12:19.144 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          60538->22 (17:12:19.144 PDT)
       
    192.91.235.230 (2) (17:12:29.406 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          35777->22 (17:12:29.406 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          35781->22 (17:12:36.719 PDT)
       
    129.82.12.188 (17:12:53.601 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          48391->22 (17:12:53.601 PDT)
       
    141.212.113.180 (17:12:25.655 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          58416->22 (17:12:25.655 PDT)
       
    141.212.113.179 (2) (17:12:54.813 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          43278->22 (17:12:54.813 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          43282->22 (17:13:00.845 PDT)
       
    128.111.52.59 (17:13:15.530 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40138->22 (17:13:15.530 PDT)
       
    130.127.39.152 (17:12:11.387 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          39224->22 (17:12:11.387 PDT)
       
OUTBOUND ATTACK (ATK TO INTERNAL TARGET)
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL TARGET)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    13.7.64.22 (5) (17:11:06.266 PDT-17:17:12.219 PDT)
       event=777:7777008 (5) {tcp} E8[bh] Detected intense malware port scanning of 41 IPs (24 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          5: 0->0 (17:11:06.266 PDT-17:17:12.219 PDT)
       
tcpslice 1378426266.266 1378426632.220 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================