Matt,
A bunch of info
IPs left out is the IP address not listed in the frist report but is in
the second report from the FBI
Here the stuff that I need from Hb and been asking about for a few weeks
1. Extension of hours write-up - DONE
2. Some form of update on the final. Latest working will do. IN PROGRESS
1. Soy Sauce ip, domains, profile/characterization, traffic
identification (e.g Rich gave brilliant gem the other day saying the use
pings and send out pings but I did not remember it all. But looking at
the files I do see pings!) - NOT DONE (Rich said he do this when we
had lunch and a few time when we talked) it was also listed as The
traffic characterizations, domains and ips associated with soy sauce
3.
Reports
1) Final reports of our findings, analysis and recommendations in the
form of the following:
a. Executive Risk Intelligence Report
i. Executive Summary (1-2 pages)
ii. Forensic findings and analysis details
iii. Malware inventory report and detailed description
False Positive issue:
A was described what the issue with the NTSHRUI was
A SUMMARY of flows for the addresses you have below. Keep in mind I
cant support this investigation effort as it is beyond the key
deliverables. You will need to work with Poly to address your questions.
If you recall, this was the 95MB of compressed data I was able to export
and work with eventually to provide a summary. I took the liberty of
selective fields for brevity otherwise you would have have 16mb of CSV data.
Compromised systems
Rich,
Here is information extracted from my 3:01am email to you.
/From the report 6 system are reported as compromised. Some questions
about the findings:/
/What is the level of effort to move these from preliminary findings
to hard evidence of compromise. No false positives./
/Have we collected the samples from each of these systems to perform
detailed analysis?/
/Do we know the threat that the malware poses to the organization and
the level of sophistication?/
/IF or do they match with any of the malware in HBgarys experience,
that APT threats have utilized? If so is there details like soy source
writeup about that threat?/
/Were any of these systems the ones identified with the NTShrui?/
/If each of these compromised malware has no linking thematic and no
attributable APT source. What is the reason for the malware to be on
these systems? Random browsing?/
/What is the level of effort necessary to look at /
1. /QWCRL2 needs to be looked at further. /
2. /BMURRAYLTOP2 needs to be looked at further /
3. /RWHITMANLT needs to be looked at further/
Below is an email that I sent last night to find out more about the
hosts and users in question (red is information provided by the IT staff
Questions for HB:
Do we know the dates that the malware was installed?
2 systems are identified that the systems will get exposed to
malware. How do judge the threat in relationship to that information?
2 systems are rated as not exposed to malware, so what does that mean
for the next steps?
2 systems have possible exposure to malware. Again how does that
effect the analysis.
TOP OUTBOUND for 10.20.1.200.flow
Aggregated flows 518823
Top 10 flows ordered by bytes:
Date flow start Duration Proto Src IP Addr:Port
Dst IP Addr:Port Flags Tos Packets Bytes pps bps Bpp
Flows
2010-07-24 23:10:59.326 130877.386 UDP 10.20.1.200:1733
<http://10.20.1.200:1733/> -> 255.255.255.255:20888
<http://255.255.255.255:20888/> ...... 0 611 171080
0 10 280 405
2010-07-23 16:59:09.877 16.882 TCP 10.20.1.200:2681
<http://10.20.1.200:2681/> -> 210.198.4.93:80 <http://210.198.4.93/>
.APRS. 0 510 29636 30 14043 58 1
2010-07-23 16:58:36.178 6.154 TCP 10.20.1.200:1455
<http://10.20.1.200:1455/> -> 209.16.97.200:80
<http://209.16.97.200/> .APRS. 0 460 26776 74
34807 58 1
2010-07-23 17:04:14.107 74.505 TCP 10.20.1.200:3846
<http://10.20.1.200:3846/> -> 203.115.0.23:80 <http://203.115.0.23/>
.AP.S. 0 509 25898 6 2780 50 1
2010-07-23 17:04:41.215 16.511 TCP 10.20.1.200:1363
<http://10.20.1.200:1363/> -> 58.221.42.134:80
<http://58.221.42.134/> .AP.S. 0 475 25432 28
12322 53 1
2010-07-23 16:59:31.043 4.645 TCP 10.20.1.200:3477
<http://10.20.1.200:3477/> -> 161.38.0.52:80 <http://161.38.0.52/>
.APRSF 0 420 23830 90 41041 56 1
2010-07-23 17:04:42.990 14.334 TCP 10.20.1.200:1638
<http://10.20.1.200:1638/> -> 69.89.27.233:80 <http://69.89.27.233/>
.APRS. 0 323 23046 22 12862 71 1
2010-07-23 16:58:31.737 16.867 TCP 10.20.1.200:1146
<http://10.20.1.200:1146/> -> 210.198.4.93:80 <http://210.198.4.93/>
.APRS. 0 373 22898 22 10860 61 1
2010-07-23 16:59:33.357 63997.666 TCP 10.20.1.200:3580
<http://10.20.1.200:3580/> -> 65.198.163.112:80
<http://65.198.163.112/> .APRS. 0 278 22120 0
2 79 2
2010-07-23 16:59:05.079 8.452 TCP 10.20.1.200:2518
<http://10.20.1.200:2518/> -> 174.132.158.156:80
<http://174.132.158.156/> .APRS. 0 342 21820 40
20653 63 1
Top 10 Src IP Addr ordered by flows:
Date first seen Duration Proto Src IP Addr
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-21 12:28:05.584 1130782.566 any 10.20.1.200
592232(100.0) 1.2 M(100.0) 71.9 M(100.0) 1 508 59
Top 10 IP Addr ordered by flows:
Date first seen Duration Proto IP Addr
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-21 12:28:05.584 1130782.566 any 10.20.1.200
592232(100.0) 1.2 M(100.0) 71.9 M(100.0) 1 508 59
2010-07-22 12:41:30.020 241941.479 any 74.125.93.121 8217(
1.4) 22582( 1.9) 1.2 M( 1.7) 0 39 52
2010-07-22 12:41:31.644 241947.825 any 64.95.64.197 7249(
1.2) 13706( 1.1) 871664( 1.2) 0 28 63
2010-07-22 12:41:32.021 241843.974 any 208.122.229.18 4104(
0.7) 10674( 0.9) 593512( 0.8) 0 19 55
2010-07-22 12:41:31.836 241948.617 any 205.178.145.65 2540(
0.4) 4406( 0.4) 256851( 0.4) 0 8 58
2010-07-22 12:42:23.040 241839.532 any 209.157.71.50 2153(
0.4) 3665( 0.3) 196387( 0.3) 0 6 53
2010-07-22 12:41:46.777 241094.522 any 174.129.226.78 2142(
0.4) 5471( 0.5) 447625( 0.6) 0 14 81
2010-07-22 12:50:30.640 241333.666 any 192.5.6.30 1536(
0.3) 1729( 0.1) 115253( 0.2) 0 3 66
2010-07-22 12:50:50.461 240966.918 any 192.52.178.30 1531(
0.3) 1742( 0.1) 116587( 0.2) 0 3 66
2010-07-22 12:49:59.701 241362.464 any 192.26.92.30 1525(
0.3) 1757( 0.1) 116892( 0.2) 0 3 66
Top 10 Dst Port ordered by packets:
Date first seen Duration Proto Dst Port
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-21 12:28:05.584 1130782.566 any 80
529466(89.4) 1.1 M(94.3) 67.2 M(93.4) 1 475 58
2010-07-22 12:49:56.039 241427.963 any 53
62344(10.5) 68545( 5.7) 4.6 M( 6.3) 0 150 66
2010-07-22 12:42:39.138 341377.574 any 20888 417(
0.1) 643( 0.1) 180040( 0.3) 0 4 280
2010-07-25 17:08:11.910 725583.698 any 443 4(
0.0) 27( 0.0) 29422( 0.0) 0 0 1089
2010-07-25 02:10:06.044 0.000 any 0 1(
0.0) 1( 0.0) 60( 0.0) 0 0 60
Top 10 Dst Port ordered by bytes:
Date first seen Duration Proto Dst Port
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-21 12:28:05.584 1130782.566 any 80
529466(89.4) 1.1 M(94.3) 67.2 M(93.4) 1 475 58
2010-07-22 12:49:56.039 241427.963 any 53
62344(10.5) 68545( 5.7) 4.6 M( 6.3) 0 150 66
2010-07-22 12:42:39.138 341377.574 any 20888 417(
0.1) 643( 0.1) 180040( 0.3) 0 4 280
2010-07-25 17:08:11.910 725583.698 any 443 4(
0.0) 27( 0.0) 29422( 0.0) 0 0 1089
2010-07-25 02:10:06.044 0.000 any 0 1(
0.0) 1( 0.0) 60( 0.0) 0 0 60
Top 10 Dst Port ordered by pps:
Date first seen Duration Proto Dst Port
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-21 12:28:05.584 1130782.566 any 80
529466(89.4) 1.1 M(94.3) 67.2 M(93.4) 1 475 58
Summary: total flows: 592232, total bytes: 71.9 M, total packets: 1.2 M,
avg bps: 508, avg pps: 1, avg bpp: 59
Time window: 2010-07-21 12:28:05 - 2010-08-03 14:34:28
Total flows processed: 985313, Blocks skipped: 0, Bytes read: 51237020
Sys: 0.502s flows/second: 1960626.8 Wall: 0.512s flows/second: 1922460.7
TOP OUTBOUND for 10.8.3.207.flow
Aggregated flows 32
Top 10 flows ordered by bytes:
Date flow start Duration Proto Src IP Addr:Port
Dst IP Addr:Port Flags Tos Packets Bytes pps bps Bpp
Flows
2010-07-22 09:24:11.115 57.404 TCP 10.8.3.207:21986
<http://10.8.3.207:21986/> -> 65.55.184.26:443
<http://65.55.184.26:443/> .AP.S. 0 60 69165 1
9639 1152 1
2010-07-22 04:37:05.246 91.934 TCP 10.8.3.207:21787
<http://10.8.3.207:21787/> -> 209.170.118.17:80
<http://209.170.118.17/> .AP.SF 0 829 38945 9
3388 46 1
2010-07-22 04:37:46.425 50.782 TCP 10.8.3.207:21790
<http://10.8.3.207:21790/> -> 134.65.41.40:443
<http://134.65.41.40:443/> .APRSF 0 157 8720 3
1373 55 1
2010-07-22 04:37:20.747 25.773 TCP 10.8.3.207:21788
<http://10.8.3.207:21788/> -> 134.65.41.40:443
<http://134.65.41.40:443/> .AP.SF 0 103 7693 3
2387 74 1
2010-07-22 04:37:22.170 24.350 TCP 10.8.3.207:21789
<http://10.8.3.207:21789/> -> 134.65.41.40:443
<http://134.65.41.40:443/> .AP.SF 0 67 4569 2
1501 68 1
2010-07-22 04:36:52.938 104.244 TCP 10.8.3.207:21784
<http://10.8.3.207:21784/> -> 72.14.204.97:443
<http://72.14.204.97:443/> .AP.SF 0 12 2878 0
220 239 1
2010-07-22 02:15:27.756 0.425 TCP 10.8.3.207:21623
<http://10.8.3.207:21623/> -> 65.55.25.60:443
<http://65.55.25.60:443/> .APRS. 0 9 2077 21
39096 230 1
2010-07-21 16:08:16.977 0.390 TCP 10.8.3.207:21193
<http://10.8.3.207:21193/> -> 207.46.21.124:443
<http://207.46.21.124:443/> .APRS. 0 9 2077 23
42605 230 1
2010-07-21 20:42:21.896 0.095 TCP 10.8.3.207:21411
<http://10.8.3.207:21411/> -> 65.55.200.156:443
<http://65.55.200.156:443/> .APRS. 0 9 2077 94
174905 230 1
2010-07-22 08:46:35.755 0.028 TCP 10.8.3.207:21963
<http://10.8.3.207:21963/> -> 65.55.200.139:443
<http://65.55.200.139:443/> .APRS. 0 9 2077 321
593428 230 1
Top 10 Src IP Addr ordered by flows:
Date first seen Duration Proto Src IP Addr
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-21 12:17:13.809 85164.995 any 10.8.3.207
32(100.0) 1481(100.0) 177305(100.0) 0 16 119
Top 10 IP Addr ordered by flows:
Date first seen Duration Proto IP Addr
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-21 12:17:13.809 85164.995 any 10.8.3.207
32(100.0) 1481(100.0) 177305(100.0) 0 16 119
2010-07-22 04:36:52.257 104.950 any 134.65.41.40
5(15.6) 354(23.9) 24323(13.7) 3 1854 68
2010-07-21 18:05:18.756 64280.048 any 65.55.27.220 3(
9.4) 27( 1.8) 6231( 3.5) 0 0 230
2010-07-21 23:48:24.685 34608.747 any 65.55.184.26 3(
9.4) 73( 4.9) 71594(40.4) 0 16 980
2010-07-21 14:15:15.556 66680.227 any 65.55.200.139 3(
9.4) 27( 1.8) 6231( 3.5) 0 0 230
2010-07-22 01:03:25.981 4322.200 any 65.55.25.60 2(
6.2) 18( 1.2) 4154( 2.3) 0 7 230
2010-07-22 04:36:50.997 106.184 any 209.170.118.26 2(
6.2) 15( 1.0) 1595( 0.9) 0 120 106
2010-07-22 04:52:30.848 0.433 any 65.55.25.59 1(
3.1) 9( 0.6) 2077( 1.2) 20 38374 230
2010-07-21 20:42:21.896 0.095 any 65.55.200.156 1(
3.1) 9( 0.6) 2077( 1.2) 94 174905 230
2010-07-21 12:17:13.809 0.430 any 65.55.13.86 1(
3.1) 9( 0.6) 2077( 1.2) 20 38641 230
Top 10 Dst Port ordered by packets:
Date first seen Duration Proto Dst Port
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-21 14:45:31.147 67182.285 any 80
8(25.0) 901(60.8) 46842(26.4) 0 5 51
2010-07-21 12:17:13.809 85164.995 any 443
24(75.0) 580(39.2) 130463(73.6) 0 12 224
Top 10 Dst Port ordered by bytes:
Date first seen Duration Proto Dst Port
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-21 12:17:13.809 85164.995 any 443
24(75.0) 580(39.2) 130463(73.6) 0 12 224
2010-07-21 14:45:31.147 67182.285 any 80
8(25.0) 901(60.8) 46842(26.4) 0 5 51
Top 10 Dst Port ordered by pps:
Date first seen Duration Proto Dst Port
Flows(%) Packets(%) Bytes(%) pps bps bpp
Summary: total flows: 32, total bytes: 177305, total packets: 1481, avg
bps: 16, avg pps: 0, avg bpp: 119
Time window: 2010-07-21 12:17:13 - 2010-07-22 11:56:38
Total flows processed: 15027, Blocks skipped: 0, Bytes read: 781416
Sys: 0.005s flows/second: 2985694.4 Wall: 0.009s flows/second: 1647878.1
admins-macbook-pro:flows admin$
TOP OUTBOUND for 10.8.4.181.flow
Aggregated flows 6803
Top 10 flows ordered by bytes:
Date flow start Duration Proto Src IP Addr:Port
Dst IP Addr:Port Flags Tos Packets Bytes pps bps Bpp
Flows
2010-07-21 15:59:42.002 1345.920 TCP 10.8.4.181:1210
<http://10.8.4.181:1210/> -> 24.143.196.134:1935
<http://24.143.196.134:1935/> .AP.S. 0 30926 1.4 M 22
8571 46 1
2010-07-21 17:21:45.077 3606.249 TCP 10.8.4.181:1677
<http://10.8.4.181:1677/> -> 205.203.132.65:80
<http://205.203.132.65/> .APRS. 0 5410 1.3 M 1
2921 243 1
2010-07-21 19:01:54.614 3668.631 TCP 10.8.4.181:2001
<http://10.8.4.181:2001/> -> 205.203.132.65:80
<http://205.203.132.65/> .AP.SF 0 5352 1.2 M 1
2719 233 1
2010-07-21 18:01:51.150 2467.544 TCP 10.8.4.181:1821
<http://10.8.4.181:1821/> -> 205.203.132.65:80
<http://205.203.132.65/> .AP.SF 0 3736 883866 1
2865 236 1
2010-07-21 23:02:09.325 2401.618 TCP 10.8.4.181:2744
<http://10.8.4.181:2744/> -> 205.203.132.65:80
<http://205.203.132.65/> .APRS. 0 3626 826330 1
2752 227 1
2010-07-21 18:21:52.274 2467.474 TCP 10.8.4.181:1878
<http://10.8.4.181:1878/> -> 205.203.132.65:80
<http://205.203.132.65/> .AP.SF 0 3074 812590 1
2634 264 1
2010-07-21 19:41:57.131 2401.335 TCP 10.8.4.181:2133
<http://10.8.4.181:2133/> -> 205.203.132.65:80
<http://205.203.132.65/> .APRS. 0 3076 810330 1
2699 263 1
2010-07-21 15:49:52.800 1762.851 TCP 10.8.4.181:1100
<http://10.8.4.181:1100/> -> 205.203.132.1:80 <http://205.203.132.1/>
.AP.SF 0 2426 666434 1 3024 274 1
2010-07-21 23:22:10.691 1946.226 TCP 10.8.4.181:2803
<http://10.8.4.181:2803/> -> 205.203.132.65:80
<http://205.203.132.65/> .AP.S. 0 2662 590838 1
2428 221 1
2010-07-21 16:52:20.903 1386.625 TCP 10.8.4.181:1559
<http://10.8.4.181:1559/> -> 205.203.132.1:80
<http://205.203.132.1/> .APRS. 0 1965 476076 1
2746 242 1
Top 10 Src IP Addr ordered by flows:
Date first seen Duration Proto Src IP Addr
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-21 12:10:45.876 88217.338 any 10.8.4.181
6807(100.0) 307005(100.0) 57.7 M(100.0) 3 5229 187
Top 10 IP Addr ordered by flows:
Date first seen Duration Proto IP Addr
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-21 12:10:45.876 88217.338 any 10.8.4.181
6807(100.0) 307005(100.0) 57.7 M(100.0) 3 5229 187
2010-07-22 08:33:02.102 4059.525 any 81.16.155.30 143(
2.1) 2108( 0.7) 315826( 0.5) 0 622 149
2010-07-21 12:11:27.827 80636.117 any 38.105.83.30 110(
1.6) 5234( 1.7) 2.1 M( 3.7) 0 210 405
2010-07-22 11:58:49.730 435.923 any 128.242.240.91 110(
1.6) 1438( 0.5) 389658( 0.7) 3 7150 270
2010-07-22 07:04:50.644 9.751 any 209.20.88.61 101(
1.5) 1654( 0.5) 167944( 0.3) 169 137786 101
2010-07-22 08:06:02.915 621.646 any 98.136.154.148 89(
1.3) 1772( 0.6) 906710( 1.6) 2 11668 511
2010-07-21 12:34:00.627 86423.223 any 64.88.164.170 88(
1.3) 1242( 0.4) 482292( 0.8) 0 44 388
2010-07-21 12:34:08.200 84234.109 any 64.233.169.148 87(
1.3) 1686( 0.5) 468760( 0.8) 0 44 278
2010-07-21 17:21:45.077 66042.750 any 205.203.132.65 83(
1.2) 75296(24.5) 17.2 M(29.9) 1 2085 228
2010-07-21 12:29:12.675 84529.655 any 64.233.169.149 78(
1.1) 1392( 0.5) 386682( 0.7) 0 36 277
Top 10 Dst Port ordered by packets:
Date first seen Duration Proto Dst Port
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-21 12:14:45.602 87977.375 any 80
6359(93.4) 258966(84.4) 51.1 M(88.6) 2 4648 197
2010-07-21 15:59:42.002 1345.920 any 1935 1(
0.0) 30926(10.1) 1.4 M( 2.5) 22 8571 46
2010-07-21 12:10:45.876 88217.338 any 443 440(
6.5) 17045( 5.6) 5.1 M( 8.9) 0 462 299
2010-07-22 06:06:37.343 7355.215 any 8000 3(
0.0) 38( 0.0) 7918( 0.0) 0 8 208
2010-07-21 15:09:36.884 66421.153 any 843 2(
0.0) 16( 0.0) 786( 0.0) 0 0 49
2010-07-22 09:36:38.070 0.242 any 1201 1(
0.0) 10( 0.0) 498( 0.0) 41 16462 49
2010-07-21 15:08:14.860 0.009 any 771 1(
0.0) 4( 0.0) 572( 0.0) 444 508444 143
Top 10 Dst Port ordered by bytes:
Date first seen Duration Proto Dst Port
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-21 12:14:45.602 87977.375 any 80
6359(93.4) 258966(84.4) 51.1 M(88.6) 2 4648 197
2010-07-21 12:10:45.876 88217.338 any 443 440(
6.5) 17045( 5.6) 5.1 M( 8.9) 0 462 299
2010-07-21 15:59:42.002 1345.920 any 1935 1(
0.0) 30926(10.1) 1.4 M( 2.5) 22 8571 46
2010-07-22 06:06:37.343 7355.215 any 8000 3(
0.0) 38( 0.0) 7918( 0.0) 0 8 208
2010-07-21 15:09:36.884 66421.153 any 843 2(
0.0) 16( 0.0) 786( 0.0) 0 0 49
2010-07-21 15:08:14.860 0.009 any 771 1(
0.0) 4( 0.0) 572( 0.0) 444 508444 143
2010-07-22 09:36:38.070 0.242 any 1201 1(
0.0) 10( 0.0) 498( 0.0) 41 16462 49
Top 10 Dst Port ordered by pps:
Date first seen Duration Proto Dst Port
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-21 15:08:14.860 0.009 any 771 1(
0.0) 4( 0.0) 572( 0.0) 444 508444 143
2010-07-22 09:36:38.070 0.242 any 1201 1(
0.0) 10( 0.0) 498( 0.0) 41 16462 49
2010-07-21 15:59:42.002 1345.920 any 1935 1(
0.0) 30926(10.1) 1.4 M( 2.5) 22 8571 46
2010-07-21 12:14:45.602 87977.375 any 80
6359(93.4) 258966(84.4) 51.1 M(88.6) 2 4648 197
Summary: total flows: 6807, total bytes: 57.7 M, total packets: 307005,
avg bps: 5229, avg pps: 3, avg bpp: 187
Time window: 2010-07-21 12:10:45 - 2010-07-22 12:41:03
Total flows processed: 32810, Blocks skipped: 0, Bytes read: 1706156
Sys: 0.026s flows/second: 1227597.6 Wall: 0.067s flows/second: 485225.8
TOP OUTBOUND for 10.8.55.123.flow
Aggregated flows 5802
Top 10 flows ordered by bytes:
Date flow start Duration Proto Src IP Addr:Port
Dst IP Addr:Port Flags Tos Packets Bytes pps bps Bpp
Flows
2010-07-21 13:25:16.088 4615.104 TCP 10.8.55.123:2887
<http://10.8.55.123:2887/> -> 64.124.22.148:2001
<http://64.124.22.148:2001/> .APRS. 0 43028 2.8 M 9
4858 65 1
2010-07-21 15:22:29.664 2401.062 TCP 10.8.55.123:1104
<http://10.8.55.123:1104/> -> 66.220.147.11:80
<http://66.220.147.11/> .APRS. 0 1364 1.1 M 0
3778 831 1
2010-07-22 11:44:33.624 175.790 TCP 10.8.55.123:3833
<http://10.8.55.123:3833/> -> 65.54.81.82:1935
<http://65.54.81.82:1935/> .APRS. 0 6575 322612 37
14681 49 1
2010-07-21 17:02:59.750 281.609 TCP 10.8.55.123:3341
<http://10.8.55.123:3341/> -> 64.124.22.150:2001
<http://64.124.22.150:2001/> .APRS. 0 3209 210724 11
5986 65 1
2010-07-21 14:11:34.024 598.943 TCP 10.8.55.123:3621
<http://10.8.55.123:3621/> -> 64.124.22.152:2001
<http://64.124.22.152:2001/> .APRS. 0 3297 156049 5
2084 47 1
2010-07-21 16:56:09.872 115.557 TCP 10.8.55.123:3071
<http://10.8.55.123:3071/> -> 204.8.50.18:80 <http://204.8.50.18/>
.APRS. 0 154 144900 1 10031 940 1
2010-07-21 16:56:09.850 115.579 TCP 10.8.55.123:3066
<http://10.8.55.123:3066/> -> 204.8.50.18:80 <http://204.8.50.18/>
.APRS. 0 151 139964 1 9687 926 1
2010-07-21 14:21:49.267 523.917 TCP 10.8.55.123:3685
<http://10.8.55.123:3685/> -> 64.124.22.151:2001
<http://64.124.22.151:2001/> .APRS. 0 2884 136839 5
2089 47 1
2010-07-22 11:48:45.943 87.803 TCP 10.8.55.123:3932
<http://10.8.55.123:3932/> -> 209.170.118.139:80
<http://209.170.118.139/> .APRS. 0 2282 122091 25
11124 53 1
2010-07-21 16:15:15.349 59.671 TCP 10.8.55.123:1880
<http://10.8.55.123:1880/> -> 208.111.163.35:1935
<http://208.111.163.35:1935/> .APRS. 0 2479 118382 41
15871 47 1
Top 10 Src IP Addr ordered by flows:
Date first seen Duration Proto Src IP Addr
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-16 11:01:35.127 524261.969 any 10.8.55.123
5812(100.0) 172437(100.0) 28.1 M(100.0) 0 428 162
Top 10 IP Addr ordered by flows:
Date first seen Duration Proto IP Addr
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-16 11:01:35.127 524261.969 any 10.8.55.123
5812(100.0) 172437(100.0) 28.1 M(100.0) 0 428 162
2010-07-21 12:12:47.271 86817.670 any 208.111.128.7 132(
2.3) 2657( 1.5) 371514( 1.3) 0 34 139
2010-07-21 15:00:07.445 69491.429 any 184.73.155.124 110(
1.9) 547( 0.3) 102001( 0.4) 0 11 186
2010-07-21 14:42:13.171 2.836 any 66.230.130.246 92(
1.6) 542( 0.3) 62215( 0.2) 191 175500 114
2010-07-21 12:12:45.469 87946.273 any 64.94.107.15 89(
1.5) 444( 0.3) 92229( 0.3) 0 8 207
2010-07-21 12:12:44.888 83391.883 any 72.21.91.19 75(
1.3) 882( 0.5) 163751( 0.6) 0 15 185
2010-07-21 16:31:04.088 437.143 any 208.82.236.208 64(
1.1) 369( 0.2) 49915( 0.2) 0 913 135
2010-07-21 16:20:09.309 63903.878 any 64.94.107.19 58(
1.0) 292( 0.2) 60231( 0.2) 0 7 206
2010-07-21 12:16:10.309 83772.563 any 208.111.128.6 56(
1.0) 487( 0.3) 67776( 0.2) 0 6 139
2010-07-21 13:20:30.126 80917.076 any 8.12.202.126 55(
0.9) 1900( 1.1) 325571( 1.2) 0 32 171
Top 10 Dst Port ordered by packets:
Date first seen Duration Proto Dst Port
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-21 12:10:46.725 88110.371 any 80
5564(95.7) 89747(52.0) 22.7 M(81.0) 1 2062 253
2010-07-21 13:25:16.088 13345.271 any 2001 29(
0.5) 60169(34.9) 3.8 M(13.4) 4 2253 62
2010-07-21 12:15:50.217 84699.197 any 1935 17(
0.3) 20015(11.6) 1.0 M( 3.6) 0 94 50
2010-07-21 12:24:46.487 84280.937 any 443 189(
3.3) 2457( 1.4) 572493( 2.0) 0 54 233
2010-07-16 11:01:35.127 339435.140 any 67 6(
0.1) 12( 0.0) 3936( 0.0) 0 0 328
2010-07-21 16:51:13.105 62870.971 any 81 2(
0.0) 12( 0.0) 1502( 0.0) 0 0 125
2010-07-22 09:42:32.636 0.058 any 8080 2(
0.0) 11( 0.0) 1508( 0.0) 189 208000 137
2010-07-21 13:21:34.001 32.158 any 1200 1(
0.0) 6( 0.0) 317( 0.0) 0 78 52
2010-07-21 13:21:33.860 0.192 any 1201 1(
0.0) 5( 0.0) 249( 0.0) 26 10375 49
2010-07-21 13:21:32.653 1.191 any 843 1(
0.0) 3( 0.0) 144( 0.0) 2 967 48
Top 10 Dst Port ordered by bytes:
Date first seen Duration Proto Dst Port
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-21 12:10:46.725 88110.371 any 80
5564(95.7) 89747(52.0) 22.7 M(81.0) 1 2062 253
2010-07-21 13:25:16.088 13345.271 any 2001 29(
0.5) 60169(34.9) 3.8 M(13.4) 4 2253 62
2010-07-21 12:15:50.217 84699.197 any 1935 17(
0.3) 20015(11.6) 1.0 M( 3.6) 0 94 50
2010-07-21 12:24:46.487 84280.937 any 443 189(
3.3) 2457( 1.4) 572493( 2.0) 0 54 233
2010-07-16 11:01:35.127 339435.140 any 67 6(
0.1) 12( 0.0) 3936( 0.0) 0 0 328
2010-07-22 09:42:32.636 0.058 any 8080 2(
0.0) 11( 0.0) 1508( 0.0) 189 208000 137
2010-07-21 16:51:13.105 62870.971 any 81 2(
0.0) 12( 0.0) 1502( 0.0) 0 0 125
2010-07-21 13:21:34.001 32.158 any 1200 1(
0.0) 6( 0.0) 317( 0.0) 0 78 52
2010-07-21 13:21:33.860 0.192 any 1201 1(
0.0) 5( 0.0) 249( 0.0) 26 10375 49
2010-07-21 13:21:32.653 1.191 any 843 1(
0.0) 3( 0.0) 144( 0.0) 2 967 48
Top 10 Dst Port ordered by pps:
Date first seen Duration Proto Dst Port
Flows(%) Packets(%) Bytes(%) pps bps bpp
2010-07-22 09:42:32.636 0.058 any 8080 2(
0.0) 11( 0.0) 1508( 0.0) 189 208000 137
2010-07-21 13:21:33.860 0.192 any 1201 1(
0.0) 5( 0.0) 249( 0.0) 26 10375 49
2010-07-21 13:25:16.088 13345.271 any 2001 29(
0.5) 60169(34.9) 3.8 M(13.4) 4 2253 62
2010-07-21 13:21:32.653 1.191 any 843 1(
0.0) 3( 0.0) 144( 0.0) 2 967 48
2010-07-21 12:10:46.725 88110.371 any 80
5564(95.7) 89747(52.0) 22.7 M(81.0) 1 2062 253
Summary: total flows: 5812, total bytes: 28.1 M, total packets: 172437,
avg bps: 428, avg pps: 0, avg bpp: 162
Time window: 2010-07-16 11:01:35 - 2010-07-22 12:39:17
Total flows processed: 16066, Blocks skipped: 0, Bytes read: 835444
Sys: 0.020s flows/second: 795031.7 Wall: 0.019s flows/second: 843403.9
*Matthew Anglin*
Information Security Principal, Office of the CSO**
QinetiQ North America
7918 Jones Branch Drive Suite 350
Mclean, VA 22102
703-752-9569 office, 703-967-2862 cell
*
Matt,
Can you tell me how many Windows hosts were subject to HBGary Active
Defense scanning on the Cyveillance network? In addition, are there any
non-Windows hosts that reside on that network as well? I would like to
clearly state how many hosts were scanned out of total possible hosts.
Thanks,
Matt
On Tue, Aug 17, 2010 at 1:10 PM, Anglin, Matthew
<Matthew.Anglin@qinetiq-na.com <mailto:Matthew.Anglin@qinetiq-na.com>>
wrote:
*Matthew Anglin*
Information Security Principal, Office of the CSO
QinetiQ North America
7918 Jones Branch Drive Suite 350
Mclean, VA 22102
703-752-9569 office, 703-967-2862 cell
---------- Forwarded message ----------
Mike and Rich,
Dont know if this will help but here is some info
Hashes
Known Good (see link below):
MD5: 079C4723655133D5F74A93E232A2E8A8
SHA1: 4C492825CE561FB920B3263D3C823FAB353E9BD3
Known Bad:
MD5: 0x88BAB141F706A7A50C5282775666A9E7
File SHA-1: 0xE48798A1170E8B7EC4F1505B4B8AB40F5C3FC190
QNA Variant 1 MD5: e6fdacc4f1b816a10f67dc02e8c8d15c
QNA Variant 2 MD5: bf5f84cf5877b40d6785461c0ee57b1e
The NTSHRUI.dll is a Windows DLL which is used or Network drives
From http://www.faultwire.com/file_detail/ntshrui.dll*45587.html
File description: Shell extensions for sharing
File Version: 6.0.6001.18000 (longhorn_rtm.080118-1840)
Application: Microsoft Windows Operating System
App version: 6.0.6001.18000
Type: 64-bit
Publisher: Microsoft Corporation
Copyright: (c) Microsoft Corporation. All
rights reserved.
Security Validation
Security: The two security hashes for Ntshrui.dll were created from the
original file. The security hash is created by scanning all bytes within
the file. Identical files should have the same hashes. SHA1 is
considered the more secure than the older MD5 hash.
MD5: 079C4723655133D5F74A93E232A2E8A8
SHA1: 4C492825CE561FB920B3263D3C823FAB353E9BD3
Ntshrui.dll requires a C++ library, and was likely written in
Micorsoft Visual C++. It was likely built using Visual Studio 2005.
Ntshrui.dll is a PE style file.
Our analysis shows that over 2 different files internally use Ntshrui.dll
http://social.answers.microsoft.com/Forums/en-US/w7repair/thread/30b6afd4-3117-4af3-8695-d416bc597de5
*Threat Expert:*
http://www.threatexpert.com/files/ntshrui.dll.html
*The file "ntshrui.dll" is known to be created under the following
filenames:*
%ProgramFiles%\internet explorer\ntshrui.dll
%System%\tempfiles\ntshrui.dll
%Windir%\bricopacks\sysfiles\36_ntshrui.dll
%Windir%\bricopacks\sysfiles\42_ntshrui.dll
%Windir%\ntshrui.dll
http://www.threatexpert.com/report.aspx?md5=88bab141f706a7a50c5282775666a9e7
%Windir%\ntshrui.dllhttp://www.threatexpert.com/resources/flag.gif
<http://www.threatexpert.com/files/ntshrui.dll.html> 39,936 bytes
MD5: 0xC4946314D967A5890FEDB43C4C09547B
SHA-1: 0x835198CE7DF0C03D33BAFBBA7823B24C2B15E622
Submission details:
* Submission received: 19 April 2010, 18:12:19
* Processing time: 7 min 56 sec
* Submitted sample:
o File MD5: 0x88BAB141F706A7A50C5282775666A9E7
o File SHA-1: 0xE48798A1170E8B7EC4F1505B4B8AB40F5C3FC190
o Filesize: 58,880 bytes
* The data identified by the following URL was then requested from
the remote web server:
o http://www3.bigdepression.net/index.html
*Terremark Report*
*ntshrui.dll*
This malware contacts the site at IP address 216.15.210.68, submitting
an HTTP GET request for
the 197.1.16.3_5.html file. This page is hard-coded into the malware.
The malware appears to
read in the HTML and to perform functions based on the contents of the
file. If no command is
found, it sleeps for 10 minutes and then makes additional attempts. The
malware makes use of
LZ32.dll, this allows it to "expand" compressed files, an example
being the .cab files found on
the root of the 216.15.210.68 site (the .cab files are described below),
as well as any other files
with a header of "SZDD" (Microsoft SZDD compressed (Haruhiko Okumuras
LZSS)). The
malware provides intruders with a mechanism to inject additional malware
onto the system (via
download), does not appear to provide a backdoor shell. It is possible
that additional,
downloaded malware would allow backdoor access into the infected system.
The ntshrui.dll malware employs a different persistence mechanism than
the iprinp.dll malware
variants. Rather than installing as Windows service, this malware is
simply placed into the
C:\Windows directory. There is a legitimate version of ntshrui.dll in
the C:\Windows\system32
directory, and on domain-connected systems there is also a copy in the
C:\Windows\system32\dllcache directory, indicating that this file is
protected by Windows File
Protection (WFP). The file named ntshriu.dll is an approved Windows
Explorer (not Internet
Explorer) shell extension; however, the Registry entry for the shell
extensions do not include
explicit paths to the DLLs.
When a user logs into a Windows system, the system runs the winlogon.exe
and userinit.exe
processes, and then launches the Windows shell, explorer.exe, in the
context of the logged on
user. The explorer.exe process reads the list of approved shell
extensions from the Registry, and
begins searching for the identified DLLs in the directory from which
explorer.exe was launched.
This behavior is documented at the Microsoft Developer Network site.
Under most normal
circumstances, explorer.exe would not find ntshrui.dll in the C:\Windows
directory and would then
proceed on to the C:\Windows\system32 directory. However, when the
ntshrui.dll malware file is
written to the C:\Windows directory, explorer.exe will located and
launch the malicious version of
ntshrui.dll first, and not load the legitimate version of the DLL.
The following table summarizes the malware indicators of compromise (IOCs):
*Ntshrui.dll*
*(Variant 1 MD5: e6fdacc4f1b816a10f67dc02e8c8d15c)*
*(Variant 2 MD5: bf5f84cf5877b40d6785461c0ee57b1e)*
File system IOC C:\Windows\ntrshrui.dll; when activated, query results
in 197.1.16.3_5[1].html file in the users
Temporary Internet Files directory
Event Log IOC None
Registry IOC None
Memory IOC Ntshrui.dll module loaded for Explorer.exe process
Network IOC HTTP GET request to 216.15.210.68 for 197.1.16.3_5.html
Notes Loads as part of explorer.exe process when user logs in; includes
code to expand .cab
compressed files. Variant 1 of the DLL was found on HEC_JWHITE, and
variant 2 was found
on HEC_RTIESZEN.
*Matthew Anglin*
Information Security Principal, Office of the CSO**
QinetiQ North America
7918 Jones Branch Drive Suite 350
Mclean, VA 22102
703-752-9569 office, 703-967-2862 cell
---------- Forwarded message ----------
Attached is the spreadsheet where they have gone to soysouce/comment
crew sites.
*IPs visited Comment Crew*
*In Victim List*
38.100.19.10
no
38.100.41.105
pwcrl8
38.100.41.112
plcrl5
38.100.41.113
plcrl4
38.100.41.118
plcrl6
38.100.41.119
pwcrl1
38.100.41.120
pwcrl5
38.100.41.66
plipcrl1
38.100.41.67
Stealth Route-Map Thru GRE Tunnel -HQ
38.100.41.94
pwcrl4
38.105.109.196
no
38.105.83.11
no
38.105.83.12
no
38.105.83.13
no
38.105.83.22
no
38.105.83.6
no
Known Bad NTSHRUI:
Threat Expert 1
<http://www.threatexpert.com/report.aspx?md5=88bab141f706a7a50c5282775666a9e7>
File size: 39,936 bytes
File: %Windir%\ntshrui.dll
<http://www.threatexpert.com/files/ntshrui.dll.html>
MD5: 0x88BAB141F706A7A50C5282775666A9E7
File SHA-1: 0xE48798A1170E8B7EC4F1505B4B8AB40F5C3FC190
Submission received: 19 April 2010, 18:12:19
Submitted details File MD5: 0x88BAB141F706A7A50C5282775666A9E7
Submitted details File SHA-1: 0xE48798A1170E8B7EC4F1505B4B8AB40F5C3FC190
Submitted Filesize: 58,880 bytes
Threat Expert 2
<http://www.threatexpert.com/report.aspx?md5=44ab50d65b968f88e9cfc6eb966eb70a>
File size: 10,720 bytes
File: %Temp%\1001.tmp
File: %Windir%\ntshrui.dll
<http://www.threatexpert.com/files/ntshrui.dll.html>
MD5: 0x3D08B218398F458377DE615B9855BC2F
SHA-1: 0xDA8B683F5496CA37EDF9B52F5BC94F7BAC72E2D2
Submitted details MD5: 0x44AB50D65B968F88E9CFC6EB966EB70A
Submitted details SHA-1: 0x6B2E257514849F2BAE9AFDC7C6787B971CF319E5
Submitted Filesize: 20,952 bytes
Submission received: 8 July 2010, 01:11:54
QNA Variant 1 MD5: e6fdacc4f1b816a10f67dc02e8c8d15c
QNA Variant 2 MD5: bf5f84cf5877b40d6785461c0ee57b1e
*Matthew Anglin*
Information Security Principal, Office of the CSO**
QinetiQ North America
7918 Jones Branch Drive Suite 350
Mclean, VA 22102
703-752-9569 office, 703-967-2862 cell
*
Mike and Rich,
Dont know if this will help but here is some info
Hashes
Known Good (see link below):
MD5: 079C4723655133D5F74A93E232A2E8A8
SHA1: 4C492825CE561FB920B3263D3C823FAB353E9BD3
Known Bad:
MD5: 0x88BAB141F706A7A50C5282775666A9E7
File SHA-1: 0xE48798A1170E8B7EC4F1505B4B8AB40F5C3FC190
10,720 bytes
MD5: 0x3D08B218398F458377DE615B9855BC2F
SHA-1: 0xDA8B683F5496CA37EDF9B52F5BC94F7BAC72E2D2
QNA Variant 1 MD5: e6fdacc4f1b816a10f67dc02e8c8d15c
QNA Variant 2 MD5: bf5f84cf5877b40d6785461c0ee57b1e
The NTSHRUI.dll is a Windows DLL which is used or Network drives
From http://www.faultwire.com/file_detail/ntshrui.dll*45587.html
File description: Shell extensions for sharing
File Version: 6.0.6001.18000 (longhorn_rtm.080118-1840)
Application: Microsoft Windows Operating System
App version: 6.0.6001.18000
Type: 64-bit
Publisher: Microsoft Corporation
Copyright: (c) Microsoft Corporation. All
rights reserved.
Security Validation
Security: The two security hashes for Ntshrui.dll were created from the
original file. The security hash is created by scanning all bytes within
the file. Identical files should have the same hashes. SHA1 is
considered the more secure than the older MD5 hash.
MD5: 079C4723655133D5F74A93E232A2E8A8
SHA1: 4C492825CE561FB920B3263D3C823FAB353E9BD3
Ntshrui.dll requires a C++ library, and was likely written in
Micorsoft Visual C++. It was likely built using Visual Studio 2005.
Ntshrui.dll is a PE style file.
Our analysis shows that over 2 different files internally use Ntshrui.dll
http://social.answers.microsoft.com/Forums/en-US/w7repair/thread/30b6afd4-3117-4af3-8695-d416bc597de5
*Threat Expert:*
http://www.threatexpert.com/files/ntshrui.dll.html
*The file "ntshrui.dll" is known to be created under the following
filenames:*
%ProgramFiles%\internet explorer\ntshrui.dll
%System%\tempfiles\ntshrui.dll
%Windir%\bricopacks\sysfiles\36_ntshrui.dll
%Windir%\bricopacks\sysfiles\42_ntshrui.dll
%Windir%\ntshrui.dll
http://www.threatexpert.com/report.aspx?md5=88bab141f706a7a50c5282775666a9e7
%Windir%\ntshrui.dllhttp://www.threatexpert.com/resources/flag.gif
<http://www.threatexpert.com/files/ntshrui.dll.html> 39,936 bytes
MD5: 0xC4946314D967A5890FEDB43C4C09547B
SHA-1: 0x835198CE7DF0C03D33BAFBBA7823B24C2B15E622
Submission details:
* Submission received: 19 April 2010, 18:12:19
* Processing time: 7 min 56 sec
* Submitted sample:
o File MD5: 0x88BAB141F706A7A50C5282775666A9E7
o File SHA-1: 0xE48798A1170E8B7EC4F1505B4B8AB40F5C3FC190
o Filesize: 58,880 bytes
* The data identified by the following URL was then requested from
the remote web server:
o http://www3.bigdepression.net/index.html
*Terremark Report*
*ntshrui.dll*
This malware contacts the site at IP address 216.15.210.68, submitting
an HTTP GET request for
the 197.1.16.3_5.html file. This page is hard-coded into the malware.
The malware appears to
read in the HTML and to perform functions based on the contents of the
file. If no command is
found, it sleeps for 10 minutes and then makes additional attempts. The
malware makes use of
LZ32.dll, this allows it to "expand" compressed files, an example
being the .cab files found on
the root of the 216.15.210.68 site (the .cab files are described below),
as well as any other files
with a header of "SZDD" (Microsoft SZDD compressed (Haruhiko Okumuras
LZSS)). The
malware provides intruders with a mechanism to inject additional malware
onto the system (via
download), does not appear to provide a backdoor shell. It is possible
that additional,
downloaded malware would allow backdoor access into the infected system.
The ntshrui.dll malware employs a different persistence mechanism than
the iprinp.dll malware
variants. Rather than installing as Windows service, this malware is
simply placed into the
C:\Windows directory. There is a legitimate version of ntshrui.dll in
the C:\Windows\system32
directory, and on domain-connected systems there is also a copy in the
C:\Windows\system32\dllcache directory, indicating that this file is
protected by Windows File
Protection (WFP). The file named ntshriu.dll is an approved Windows
Explorer (not Internet
Explorer) shell extension; however, the Registry entry for the shell
extensions do not include
explicit paths to the DLLs.
When a user logs into a Windows system, the system runs the winlogon.exe
and userinit.exe
processes, and then launches the Windows shell, explorer.exe, in the
context of the logged on
user. The explorer.exe process reads the list of approved shell
extensions from the Registry, and
begins searching for the identified DLLs in the directory from which
explorer.exe was launched.
This behavior is documented at the Microsoft Developer Network site.
Under most normal
circumstances, explorer.exe would not find ntshrui.dll in the C:\Windows
directory and would then
proceed on to the C:\Windows\system32 directory. However, when the
ntshrui.dll malware file is
written to the C:\Windows directory, explorer.exe will located and
launch the malicious version of
ntshrui.dll first, and not load the legitimate version of the DLL.
The following table summarizes the malware indicators of compromise (IOCs):
*Ntshrui.dll*
*(Variant 1 MD5: e6fdacc4f1b816a10f67dc02e8c8d15c)*
*(Variant 2 MD5: bf5f84cf5877b40d6785461c0ee57b1e)*
File system IOC C:\Windows\ntrshrui.dll; when activated, query results
in 197.1.16.3_5[1].html file in the users
Temporary Internet Files directory
Event Log IOC None
Registry IOC None
Memory IOC Ntshrui.dll module loaded for Explorer.exe process
Network IOC HTTP GET request to 216.15.210.68 for 197.1.16.3_5.html
Notes Loads as part of explorer.exe process when user logs in; includes
code to expand .cab
compressed files. Variant 1 of the DLL was found on HEC_JWHITE, and
variant 2 was found
on HEC_RTIESZEN.
*Matthew Anglin*
Information Security Principal, Office of the CSO**
QinetiQ North America
7918 Jones Branch Drive Suite 350
Mclean, VA 22102
703-752-9569 office, 703-967-2862 cell
---------- Forwarded message ----------
*Matthew Anglin*
Information Security Principal, Office of the CSO**
QinetiQ North America
7918 Jones Branch Drive Suite 350
Mclean, VA 22102
703-752-9569 office, 703-967-2862 cell
*
Web Downloaders
The web downloaders are responsible for retrieving documents via http
(hypertext transfer protocol). We have four different web downloaders
currently running.
Continuous Crawler
The continuous crawler is self-feeding downloader that uses the links on
the web pages it downloads to feed itself more data. Since each page
contains multiple links we quickly run into the problem of having more
links than we can reasonably download. This downloader resolves this
problem in the following ways.
1. Link history database : By keeping track of where we have been we
can eliminate links we have already crawled. Over time the
percentage of links on page that actually get downloaded will
drop. After 90 days, the database is set to timeout the link
allowing it to be re-downloaded once it is found again on the
internet.
2. Disk backed url queue : Urls that can be downloaded get queued on
disk allowing large quantities of urls to be stored for future
processing.
3. Directed crawling algorithm : The results of the prescore are used
to prioritize the links that are crawled. This algorithm is based
upon the assumption that given a page relevant to topic A the
links on that page are more likely to be relevant to topic A than
a random link.
Domain Crawler
The domain crawler uses our domain list to crawl every known domain name
up to 50 pages deep once per month. The domain list is aggregates mostly
from zone files provided by registrars although some non-authoritative
sources are also included in the crawl. The output of the domain crawler
is used by three products.
1. Core CIC backend
2. CyExpress <http://wiki/index.php?title=CyExpress>
3. Internet Profile
Requested Crawler
The requested crawler is triggered off of pages entered in the middle
layer. This application can download an individual web page or perform
small site crawls. Site crawls are limited to 100 total pages.
Anti-Phishing Downloader (also known as Stripped Links Downloader)
The anti-phishing downloader is responsible for crawling links found
within emails. Links are fed into this downloader from the following
sources.
1. AOL Links Feed
2. Yahoo Links Feed
3. Google Blacklist Feed
4. Email Downloaders
This downloader performs only limited crawling. It will follow redirects
and download frames in order to retrieve the content an end user would
get if they clicked on the email link. This downloader contains an
embedded browser container that will execute client side javascript in
order to detect script based redirects and obfuscated content commonly
employed by phishers to hide from automated detection systems.
Usenet Downloader
The usenet downloader is a custom NNTP server which receives a news feed
from our internal news servers. This feed is prescored and all
potentially relevant news articles are sent to scoring.
Metacrawler
The metacrawler is responsible for crawling known search engines and
auction sites. A metacrawl request contains a search query along with a
search engine to run the query against. It is the metacrawler's
responsibility to know how to parse the pages returned by that search
engine. Each search engine is configured individually. Each link
returned by the search engine is downloaded by the metacrawler and sent
to scoring.
Additional search engines are generally easily supported but should be
investigated by development prior to making any commitment to the client.
Email Downloaders
The email downloaders are custom SMTP servers that receive mail feeds
from our internal mail servers. The email downloader receives email from
our honeypots accounts, third party spam feeds, and customer abuse boxes.
This downloader is very similar to the usenet downloader except that it
pretends to be a SMTP server. Instead of saving the email in mailboxes
however we prescore the email and send the potentially relevant email
back to scoring. By implementing standard protocols we make it easier to
integrate our software with standard news and email services.
Web links from this downloader get sent to the anti-phishing downloader
for processing.
Message Board Downloader
The message board downloader is responsible for processing the
Boardreader XML feed. Each BoardReader article is parsed into a page,
prescored, and sent to scoring if potentially relevant.
RSS Downloader
The RSS downloader is responsible for processing common http based data
feeds using the RSS, RSS2, or Atom XML formats. The feeds being
monitored are controlled by CID using a CIC admin page.
Google Alerts Downloader
The Google Alerts downloader is responsible for processing Google Alert
emails, downloading the links received in those emails, and finally
prescoring the content of those links. Content that matches prescore
terms will get sent to scoring.
CONFIDENTIALITY NOTE: The information contained in this message, and any
attachments, may contain confidential and/or privileged material. It is
intended solely for the person or entity to which it is addressed. Any
review, retransmission, dissemination, or taking of any action in
reliance upon this information by persons or entities other than the
intended recipient is prohibited. If you received this in error, please
contact the sender and delete the material from any computer.
---------- Forwarded message ----------
Mike,
Information from Terremark
Please Remember all results of a significant nature are reported to only
me, Keith Rhodes, and Chilly Williams.
This email was sent by blackberry. Please excuse any errors.
Matt Anglin
Information Security Principal
Office of the CSO
QinetiQ North America
7918 Jones Branch Drive
McLean, VA 22102
703-967-2862 cell
------------------------------------------------------------------------
*From*: Peter Nelson <pnelson@terremark.com <mailto:pnelson@terremark.com>>
*To*: Anglin, Matthew
*Sent*: Fri Jul 23 08:42:35 2010
*Subject*: FW: [Polyhedron] 10.20.1.134
Finding 3 of 3 so far. Again, is this normal?
--
Pete
------ Forwarded Message
*
Kevin,
We have found 10.20.1.134 downloading an identified Trojan and multiple
other suspicious files. All of these downloads were disguised at images.
AVG registered ZCV.gif as "Trojan Horse Generic17.AMT". All 3 PCAPs and
the exported Trojan are attached. Further details of the suspicious
files would require in-depth file analysis. This incident has been
reported on the Polyhedron wiki under AnalyticsFindings. Let me know if
you have any questions.
*Session #1
*Timestamp: 2010-Jul-22 11:59:54
Source: 10.20.1.134
Target: 81.177.24.82:80 <http://81.177.24.82/>
GET /pic/imge.jpg HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: gelius.net <http://gelius.net/>
HTTP/1.1 200 OK
Date: Thu, 22 Jul 2010 17:00:13 GMT
Expires: Thu, 22 Jul 2010 18:00:13 GMT
Last-Modified: Mon, 08 Mar 2010 15:41:00 GMT
Accept-Ranges: bytes
Content-Length: 3010048
Content-Type: image/jpeg
MZP@!L!This program must be run under Win32
$7PEL^B*zP@O.@<0CODEp-PEC2TO .rsrc0$- QbK:
...
*Session #2 (Trojan)
*Timestamp: 2010-Jul-22 16:59:47
Source: 10.20.1.134
Target: 80.239.207.201:80 <http://80.239.207.201/>
Request:
GET /zcv.gif HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: okuyalim.net <http://okuyalim.net/>
HTTP/1.1 200 OK
Date: Thu, 22 Jul 2010 22:00:06 GMT
Last-Modified: Fri, 12 Mar 2010 20:26:40 GMT
Accept-Ranges: bytes
Content-Length: 72192
Content-Type: image/gif
MZ@!L!This program cannot be run in DOS mode.
$E%KKKKKJKcXK]KRichKPELzKi @@0P(.text6 .data @UQEEE}}h`@j@3]`Zl0i"}%S16Bf
dL!pRu@uh@jjh @h @j6th@jjh8 @j@j@3^]% @*
}ExitProcessSleepmGetTickCountJCreateThr
eadGlobalAllocKERNEL32.dllMessageBoxAUSER32.dll>URLDownloadToFileAurlmon.dllC:\1.
txthttp://aachristmas.com/images/led/hg.phpERROR
<http://aachristmas.com/images/led/hg.phpERROR>:
....
*Session #3
*2010-Jul-22 18:00:08
Source 10.20.1.134
Target 85.25.81.144:80 <http://85.25.81.144/>
HTTP/1.1 200 OK
Date: Thu, 22 Jul 2010 23:00:27 GMT
Accept-Ranges: bytes
Content-Length: 1916416
Content-Type: image/jpeg
MZP@!L!This program must be run under Win32
$7PEL^B*y@ @M-0CODEPEC2O`.rsrc0*
bcXb_J>bdIi5R-X,SoWp.eAbk7i8xjo$feXa,z!iu=QnBjW>
H. @R3X*V^M=}sx #R[:9{Rr$uv__Y<#
...
Aaron McKee, CISSP
Secure Information Services
amckee@terremark.com <http://amckee@terremark.com>
<mailto:amckee@terremark.com>
*terre**mark worldwide
24/7 Support Engineers
*1-877-663-7928
Confidentiality Notice: This e-mail message, including any attachments,
is for the sole use of the intended recipient(s) and may contain
confidential and privileged information. Any unauthorized review, use,
disclosure or distribution is prohibited. If you are not the intended
recipient and received this in error, please contact the sender by reply
e-mail and you are hereby notified that the copying, use or distribution
of any information or materials transmitted in or with this message is
strictly prohibited.
------ End of Forwarded Message
---------- Forwarded message ----------
Report Timestamp PCAP Source IP(s) Destination
IP(s) Alert Description Additional Notes
2010-Jul-22 11:59:54
attachment:10.20.1.134-2010-Jul-22_16.59.47.rar
10.20.1.134 81.177.24.82, 80.239.207.201, 85.25.81.144 We
have found 10.20.1.134 downloading an identified Trojan and multiple
other suspicious files. All of these downloads were disguised at images.
AVG registered ZCV.gif as "Trojan horse Generic17.AMT". All 3 PCAPs and
the exported Trojan are attached. Further analysis of the suspicious
files would require in-depth file analysis. Matt Anglin
reports in the daily meeting this is routine. Consider this traffic
False Positive
2010-Jul-23 01:00 attachment:Waledac_hosts.pcap
10.20.1.200, 10.20.1.139, 10.20.1.180 199.2.137.133
These internal hosts are making outbound request to known Waledac
domains are are possibly infected by the Waledac Worm. Analysis of these
hosts for known botnet artifacts is suggested. none
2010-Jul-23 04:13
attachment:10.20.1.53_downloading_report-exe_from_azurcorporation-com.pcap
10.20.1.53 91.121.96.212(azurcorporation.com
<http://azurcorporation.com/>) This host is repeatedly downloading
report.exe, a known malicious file, from azurcorporation.com
<http://azurcorporation.com/>. This host does not show other signs of
being infected by report.exe (ThreatExperts lists domains/files that the
malware attempts to retrieve, none of which have been requested.)
http://www.threatexpert.com/report.aspx?md5=ebfe91ed0e7c43005e7227c9fb0d1154
2010-Jul-23 11:59am
attachment:10.20.1.190-WALEDAC.pcap 10.1.20.199
199.2.137.133 Internal host making outbound GET / request to know
Waledac domain none
2010-Jul-26 16:03pm
attachment:POLY_10.15.3.107_possible_spam_host.rar
10.15.3.107 multiple hosts (too many to list) Looking over
the SMTP traffic for host 10.15.3.107, it appears that this host is
being used to send spam and phishing emails, along with its normal
email traffic (which appears to be automated reporting.) The mail this
host is sending is a mixture of generic spam (for medicines like
Provigil), messages claiming to be a nice girl with pictures who will
send them if you reply to her (via a different email than she used), and
other emails with links to shady looking destinations embedded in emails
that appear to be pulled directly from sites like Wikipedia. The
majority of these requests are to @imaphost.com <http://imaphost.com/>
and appear to be searching for valid users by brute forcing email
addresses. There are non imaphost.com <http://imaphost.com/> addresses
also being sent emails. The sender of each email seems to change, and
none of the @domain.com <http://domain.com/> suffixes appear to be
domains legitimately controlled by Polyhedron. Client notified by KNoble
2010-Jul-29 1240
attachment:7.29.10_POLY_77-78-239-5.rar 77.78.239.5
10.15.3.102 .5 is ftping to .102, uploading a new htaccess and
performing file listings. none
*Matthew Anglin*
Information Security Principal, Office of the CSO**
QinetiQ North America
7918 Jones Branch Drive Suite 350
Mclean, VA 22102
703-752-9569 office, 703-967-2862 cell
---------- Forwarded message ----------
Rich,
Pwback wmdrtc32.dll for the Sality Virus has the public address of
38.100.41.112.
Terremark sent a spread sheet the other day with some findings. Most
likely normal business process but Pwback was noticed.
10.20.1.200 2010-Jul-23 01:00 199.2.137.133
These internal hosts are making outbound request to known Waledac
domains are possibly infected by the Waledac Worm. Analysis of these
hosts for known botnet artifacts is suggested.
*Matthew Anglin*
Information Security Principal, Office of the CSO**
QinetiQ North America
7918 Jones Branch Drive Suite 350
Mclean, VA 22102
703-752-9569 office, 703-967-2862 cell
---------- Forwarded message ----------
*Total List***
*Host Name*
*IP in Spreadsheet*
*Orginal IP*
38.100.41.102
name not listed
x
38.100.41.105
pwcrl8
x
38.100.41.107
pwcrl1
x
38.100.41.11
zones.cyveillance.com <http://zones.cyveillance.com/>
x
38.100.41.112
pwcrl13
x
38.100.41.113
pwback13
x
38.100.41.118
plcrl5
x
38.100.41.119
plcrl4
x
38.100.41.120
plcrl6
x
38.100.41.66
pwcrl1
x
38.100.41.67
pwcrl5
x
38.100.41.78
IronPort1 (Prod)
x
38.100.41.79
IronPort2 (Prod)
x
38.100.41.80
News1
x
orginal
38.100.41.83
plinsectran1
x
38.100.41.94
plipcrl1
x
38.105.71.11
name not listed
Not provided in spreadsheet from source
orginal
38.105.71.114
name not listed
x
orginal
38.105.71.115
172.16.8.18
x
orginal
38.105.71.119
172.16.8.23
x
orginal
38.105.71.12
name not listed
Not provided in spreadsheet from source
orginal
38.105.71.120
172.16.8.28
x
orginal
38.105.71.121
172.16.8.29
x
38.105.71.122
172.16.8.12
x
38.105.71.123
172.16.8.14
x
38.105.71.14
name not listed
Not provided in spreadsheet from source
orginal
38.105.71.16
name not listed
Not provided in spreadsheet from source
orginal
38.105.71.23
172.164.12
x
38.105.71.26
172.16.8.24
x
orginal
38.105.71.72
name not listed
x
orginal
38.105.71.96
name not listed
x
orginal
*Matthew Anglin*
Information Security Principal, Office of the CSO**
QinetiQ North America
7918 Jones Branch Drive Suite 350
Mclean, VA 22102
703-752-9569 office, 703-967-2862 cell
---------- Forwarded message ----------
Rich,
About the webserver that we were talking about at lunch. The
38.100.41.11 (not in their network range) which has a PTR into
38.100.41.114. The Admin went and changed that but here is the
information about that.
Thoughts on it having been capable of being used as an attack vector?
*Matthew Anglin*
Information Security Principal, Office of the CSO**
QinetiQ North America
7918 Jones Branch Drive Suite 350
Mclean, VA 22102
703-752-9569 office, 703-967-2862 cell
*
1) These IPs were A records for DNS Zone transfers which has been
decommissioned for 4-5 years
2) Yes they were controlled by Cyveillance.
3) Due to the nature of our business IPs get recycled constantly.
4) These are reverse-lookup A records that are controlled by ISP.
65.x.x.x IPs were decommissioned with Qwest Internet Circuit. Does not
relate to Cyveillance.
5) Cyveillance does not have services with Qwest I believe since 2007.
6) Old ISP reverse-lookup A record. Not active
7) Old process. Non functioning A records.
*
Chris,
That brings up a few questions.
1. What were the IP address of zone1 and zones.cyveillance.com
<http://zones.cyveillance.com/>, which have been decommissioned for
quite some time?
2. Were the systems that were controlled by Cyveillance?
3. What was the date of decommission?
4. Zone1.cyveillance.com <http://zone1.cyveillance.com/> show up in a
robtex search
<http://www.robtex.com/dns/zone1.cyveillance.com.html#records> as having
the IP address of 65.118.41.205. What is the 65.118.41.205
<http://www.robtex.com/ip/65.118.41.205.html#ip> network and how does it
or does relate to Cyveillance?
5. 65.118.41.205 has a PTR of as 65-118-41-205.dia.static.qwest.net
<http://www.robtex.com/dns/65-118-41-205.dia.static.qwest.net.html> and
zone1.cyveillance.com
<http://www.robtex.com/dns/zone1.cyveillance.com.html#shared> Did
Cyveillance or does Cyveillance have a relationship with qwest?
6. _zones.cyveillance.com <http://zones.cyveillance.com/>_ still has a
PTR pointing to 38.100.41.114
<http://www.robtex.com/dns/zones.cyveillance.com.html#shared> listed in
a search. This PTR has not been altered as of yet.
7. What is the nature and function of 38.100.41.114 and why would it
have a PTR of zones.cyveillance.com <http://zones.cyveillance.com/>
*Matthew Anglin*
Information Security Principal, Office of the CSO
QinetiQ North America
7918 Jones Branch Drive Suite 350
Mclean, VA 22102
703-752-9569 office, 703-967-2862 cell
*
Matt,
I wanted to clarify an IP address that you presented (38.100.41.11).
This IP address does not belong to any of our IP blocks and nor has it
ever. This seems to be a typo or incorrectly entered public record. As
I mention earlier, we only route IPs on the 38.100.41.64/26
<http://38.100.41.64/26> IP block. Also, after doing further
investigation, zone1 and zones.cyveillance.com
<http://zones.cyveillance.com/> have been decommissioned for quite some
time. They have been deleted as of yesterday
Cyveillance.com 38.100.19.13 www.cyveillance.com
<http://www.cyveillance.com/> (cname)
Mail Servers used for Cyveillance
ipcorp1.cyveillance.com <http://ipcorp1.cyveillance.com/>(primary)
38.100.21.113
ipcorp2.cyveillance.com <http://ipcorp2.cyveillance.com/>(last resort)
38.100.21.114
* _zone1.cyveillance.com <http://zone1.cyveillance.com/>_
_65.118.41.205_ _65-118-41-205.dia.static.qwest.net
<http://65-118-41-205.dia.static.qwest.net/>_ ** **
* *_zones.cyveillance.com <http://zones.cyveillance.com/> 38.100.41.11
38.100.41.114_ ** ** *
*
FYI
------ Forwarded Message
*
Chris is aware of everything.
We just dont talk about stealth networks.
Obviously it is showing up in your deep dive...
Feel free to exchange emails with Chris and the list of QNA participants
on this topic.
I prefer all communication to happen through email so that we are very
clear whats requested and communicated in response. Thanks,
Manoj
On 8/2/10 4:44 PM, "Anglin, Matthew" <Matthew.Anglin@QinetiQ-NA.com
<http://Matthew.Anglin@QinetiQ-NA.com>> wrote:
Manoj,
I understand. I apologize as did not know your network topology is
considered a trade secret. I knew it was sensitive which is why we had
legal take extra steps in the contracts with them. Still, if I thought
that it had trade secret implications that would have been very different.
I will say I did notice some items that I that caught my caught my eye,
when combined with the information below, is why I attempted to call you
so we could discuss.
It seemed that Chris was not aware of 38.100.41.11
(zones.cyveillance.com <http://zones.cyveillance.com/>) association.
Cyveillance.com 38.100.19.13 www.cyveillance.com
<http://www.cyveillance.com/> (cname)
Mail Servers used for Cyveillance
ipcorp1.cyveillance.com <http://ipcorp1.cyveillance.com/>(primary)
38.100.21.113
ipcorp2.cyveillance.com <http://ipcorp2.cyveillance.com/>(last resort)
38.100.21.114
_zone1.cyveillance.com <http://zone1.cyveillance.com/>_ _65.118.41.205_
_65-118-41-205.dia.static.qwest.net
<http://65-118-41-205.dia.static.qwest.net/>_
_zones.cyveillance.com <http://zones.cyveillance.com/>_ _38.100.41.11_
_38.100.41.114_
imaphost.com <http://imaphost.com/> 128.121.217.250
Mail Servers:
ipprod1.imaphost.com <http://ipprod1.imaphost.com/>(primary)
38.100.41.78 10.15.3.107 IronPort1 (Prod)
Production email
ipprod2.imaphost.com <http://ipprod2.imaphost.com/>(primary)
38.100.41.79 10.15.3.108 IronPort2 (Prod)
Production email
That the impahst.com <http://impahst.com/> has multiple sub-domains
(about 14) that match the production systems.
*Matthew Anglin
*Information Security Principal, Office of the CSO
QinetiQ North America
7918 Jones Branch Drive Suite 350
Mclean, VA 22102
703-752-9569 office, 703-967-2862 cell
Comentários
Postar um comentário