Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/26/2013 17:21:53.324 PDT
Gen. Time:        09/26/2013 17:25:44.538 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL)
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    198.133.224.149 (17:25:34.012 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          60529->22 (17:25:34.012 PDT)
       
    204.8.155.227 (17:24:24.202 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          42368->22 (17:24:24.202 PDT)
       
    128.10.19.53 (17:21:53.324 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          59885->22 (17:21:53.324 PDT)
       
    129.82.12.188 (17:23:11.348 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          35194->22 (17:23:11.348 PDT)
       
OUTBOUND ATTACK (INTERNAL)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    128.10.19.53 (17:25:44.538 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (14 /24s) (# pkts S/M/O/I=0/21/0/0): 22:21, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (17:25:44.538 PDT)
       
tcpslice 1380241313.324 1380241313.325 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/26/2013 17:21:53.324 PDT
Gen. Time:        09/26/2013 17:33:25.695 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL)
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    128.252.19.18 (17:27:29.639 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          55568->22 (17:27:29.639 PDT)
       
    198.133.224.149 (17:25:34.012 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          60529->22 (17:25:34.012 PDT)
       
    204.8.155.227 (17:24:24.202 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          42368->22 (17:24:24.202 PDT)
       
    128.10.19.53 (17:21:53.324 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          59885->22 (17:21:53.324 PDT)
       
    129.82.12.188 (17:23:11.348 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          35194->22 (17:23:11.348 PDT)
       
    129.63.159.101 (17:30:12.550 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          58164->22 (17:30:12.550 PDT)
       
    128.42.142.44 (17:29:14.768 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          39303->22 (17:29:14.768 PDT)
       
    139.78.141.243 (17:31:20.637 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          34194->22 (17:31:20.637 PDT)
       
OUTBOUND ATTACK (INTERNAL)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    128.10.19.53 (3) (17:25:44.538 PDT)
       event=777:7777008 (3) {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (14 /24s) (# pkts S/M/O/I=0/21/0/0): 22:21, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (17:25:44.538 PDT)
          0->0 (17:27:29.639 PDT)
          0->0 (17:29:04.600 PDT)
       
    130.127.39.152 (17:30:36.221 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 36 IPs (21 /24s) (# pkts S/M/O/I=0/36/0/0): 22:36, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (17:30:36.221 PDT)
       
tcpslice 1380241313.324 1380241313.325 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            0.8 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/26/2013 17:34:17.966 PDT
Gen. Time:        09/26/2013 17:34:17.966 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL)
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    <unobserved>
    
OUTBOUND ATTACK (INTERNAL)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    13.7.64.20 (17:34:17.966 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 41 IPs (24 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (17:34:17.966 PDT)
       
tcpslice 1380242057.966 1380242057.967 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/26/2013 17:34:17.966 PDT
Gen. Time:        09/26/2013 17:36:41.955 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL)
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    128.10.19.53 (17:34:23.178 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          59929->22 (17:34:23.178 PDT)
       
OUTBOUND ATTACK (INTERNAL)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    13.7.64.20 (2) (17:34:17.966 PDT-17:36:04.176 PDT)
       event=777:7777008 (2) {tcp} E8[bh] Detected intense malware port scanning of 41 IPs (24 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          2: 0->0 (17:34:17.966 PDT-17:36:04.176 PDT)
       
tcpslice 1380242057.966 1380242164.177 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/26/2013 17:51:16.647 PDT
Gen. Time:        09/26/2013 17:51:43.377 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL)
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    198.133.224.149 (2) (17:51:41.782 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          60582->22 (17:51:41.782 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          60582->22 (17:51:41.782 PDT)
       
    204.8.155.227 (17:51:31.828 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          42421->22 (17:51:31.828 PDT)
       
    128.10.19.53 (17:51:16.647 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          59938->22 (17:51:16.647 PDT)
       
    129.82.12.188 (17:51:22.983 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          35247->22 (17:51:22.983 PDT)
       
OUTBOUND ATTACK (INTERNAL)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    155.246.12.164 (17:51:43.377 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (14 /24s) (# pkts S/M/O/I=0/21/0/0): 22:21, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (17:51:43.377 PDT)
       
tcpslice 1380243076.647 1380243076.648 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/26/2013 17:51:16.647 PDT
Gen. Time:        09/26/2013 18:00:41.080 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL)
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    128.10.19.53 (2) (17:51:16.647 PDT)
       event=1:2003068 (2) {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          59938->22 (17:51:16.647 PDT)
          59990->22 (17:52:43.465 PDT)
       
    155.246.12.164 (17:53:04.704 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          41908->22 (17:53:04.704 PDT)
       
    165.91.55.9 (2) (17:52:53.801 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          54726->22 (17:52:53.801 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          54726->22 (17:52:53.801 PDT)
       
    128.42.142.45 (17:52:07.257 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          58022->22 (17:52:07.257 PDT)
       
    131.193.34.38 (17:51:59.670 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          47705->22 (17:51:59.670 PDT)
       
    158.130.6.253 (17:52:33.322 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          51799->22 (17:52:33.322 PDT)
       
    198.133.224.149 (2) (17:51:41.782 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          60582->22 (17:51:41.782 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          60582->22 (17:51:41.782 PDT)
       
    204.8.155.227 (17:51:31.828 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          42421->22 (17:51:31.828 PDT)
       
    129.82.12.188 (2) (17:51:22.983 PDT)
       event=1:2003068 (2) {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          35247->22 (17:51:22.983 PDT)
          35309->22 (17:53:12.153 PDT)
       
    13.7.64.20 (2) (17:52:18.479 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          40191->22 (17:52:18.479 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          40191->22 (17:52:18.479 PDT)
       
    130.127.39.153 (17:52:11.921 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          42269->22 (17:52:11.921 PDT)
       
    128.208.4.198 (17:52:24.360 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          46838->22 (17:52:24.360 PDT)
       
OUTBOUND ATTACK (INTERNAL)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    155.246.12.164 (4) (17:51:43.377 PDT-17:56:22.291 PDT)
       event=777:7777008 (4) {tcp} E8[bh] Detected intense malware port scanning of 41 IPs (24 /24s) (# pkts S/M/O/I=0/41/0/0): 22:41, [] MAC_Src: 00:01:64:FF:CE:EA
          3: 0->0 (17:53:15.163 PDT-17:56:22.291 PDT)
          0->0 (17:51:43.377 PDT)
       
tcpslice 1380243076.647 1380243382.292 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================
Score:            1.3 (>= 0.8)
Infected Target:  192.168.1.41
Infector List:    <unobserved>
Egg Source List:  <unobserved>
C & C List:       <unobserved>
Peer Coord. List: <unobserved>
Resource List:    <unobserved>
Observed Start:   09/26/2013 18:57:22.743 PDT
Gen. Time:        09/26/2013 19:02:25.556 PDT


INBOUND SCAN
    <unobserved>
    
EXPLOIT
    <unobserved>
    
EXPLOIT (INTERNAL)
    <unobserved>
    
EXPLOIT MALWARE DNS
    <unobserved>
    
EGG DOWNLOAD
    <unobserved>
    
EGG DOWNLOAD (INTERNAL)
    <unobserved>
    
C and C TRAFFIC
    <unobserved>
    
C and C TRAFFIC (INTERNAL)
    <unobserved>
    
C and C TRAFFIC (RBN)
    <unobserved>
    
C and C DNS CHECK-IN
    <unobserved>
    
OUTBOUND SKYPE CANDIDATE
    <unobserved>
    
OUTBOUND SCAN (spp)
    <unobserved>
    
OUTBOUND ATTACK
    128.111.52.58 (2) (18:58:15.102 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          35856->22 (18:58:15.102 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          35860->22 (18:58:16.990 PDT)
       
    128.208.4.197 (18:58:57.652 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          41387->22 (18:58:57.652 PDT)
       
    128.10.19.53 (18:58:32.152 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          60156->22 (18:58:32.152 PDT)
       
    131.179.150.72 (18:57:22.743 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          43568->22 (18:57:22.743 PDT)
       
    72.36.112.79 (18:57:49.661 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          38588->22 (18:57:49.661 PDT)
       
    131.179.150.70 (18:58:35.501 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          58380->22 (18:58:35.501 PDT)
       
    13.7.64.22 (18:58:53.989 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          38936->22 (18:58:53.989 PDT)
       
    128.42.142.45 (18:57:32.923 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          58173->22 (18:57:32.923 PDT)
       
    204.8.155.227 (18:58:05.545 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          42609->22 (18:58:05.545 PDT)
       
    192.91.235.230 (18:58:24.280 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          39180->22 (18:58:24.280 PDT)
       
    129.82.12.188 (2) (18:58:35.968 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          35466->22 (18:58:35.968 PDT)
       -------------------------
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          35470->22 (18:58:40.757 PDT)
       
    141.212.113.180 (18:58:13.522 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          36832->22 (18:58:13.522 PDT)
       
    141.212.113.179 (18:58:48.930 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          55017->22 (18:58:48.930 PDT)
       
    128.111.52.59 (18:58:58.382 PDT)
       event=1:2001219 {tcp} E5[rb] ET SCAN Potential SSH Scan (20 in 60 secs), [] MAC_Src: 00:01:64:FF:CE:EA
          41421->22 (18:58:58.382 PDT)
       
    130.127.39.152 (18:57:57.810 PDT)
       event=1:2003068 {tcp} E5[rb] ET SCAN Potential SSH Scan OUTBOUND, [] MAC_Src: 00:01:64:FF:CE:EA
          35424->22 (18:57:57.810 PDT)
       
OUTBOUND ATTACK (INTERNAL)
    <unobserved>
    
ATTACK PREP
    <unobserved>
    
PEER COORDINATION Info
    <unobserved>
    
PEER COORDINATION
    <unobserved>
    
DECLARE BOT Standard Port
    <unobserved>
    
DECLARE BOT Non-standard Port
    <unobserved>
    
DECLARE BOT
    <unobserved>
    
OUTBOUND INTENSE MALWARE PORT SCAN
    13.7.64.20 (19:02:25.556 PDT)
       event=777:7777008 {tcp} E8[bh] Detected intense malware port scanning of 21 IPs (17 /24s) (# pkts S/M/O/I=0/20/1/0): 22:20, [] MAC_Src: 00:01:64:FF:CE:EA
          0->0 (19:02:25.556 PDT)
       
tcpslice 1380247042.743 1380247042.744 inputFile.tcpd | tcpdump -r - -w outputFile.tcpd 'host 192.168.1.41'

============================== SEPARATOR ================================