| ADDED | TYPE | FAMILY | METHOD | URI | SAMPLE | PCAP | UA + MORE INFO |
|---|---|---|---|---|---|---|---|
| 2/8/2015 | APT | DarkKomet | 8EA4AB05FA7E D573BA5A4EFFC3FB629308will vary - encrypted keep alive or other data | Sample | pcap | Library Ssheet | |
| 2/8/2015 | APT | PlugX / Korplug / Gulpix | POST | /update?id= | Sample Sample2 | pcap | Library Ssheet |
| 2/7/2015 | APT | Windata | XYZ/WinData.DLL?HELO-STX-1*10.0.0.15*RemotePC*[MAC:00-55-28-11-21-23 XYZ/WinData.DLL?HELO-STX-1*1[IPAddress]*[ComputerName]*0605[MAC:[MacAddress]]$ | Sample | Library Ssheet | ||
| 2/4/2015 | APT | Pingbed | GET | /default.htm /default1.htm /default2.htm | Sample | pcap | Library Ssheet |
| 2/4/2015 | APT | Minaps backdoor | GET / POST | /download/device_ad.asp?device_t=8054693706&key=ptvcrcqz&device_id=ad&cv=ptvcrcqzlyepaudko /download/logo.png /download/record.asp?device_t=2415079444&key=vgrnuebv&device_id=ad&cv=vgrnuebvhauzshyue&result=%0D%0ATime%3A%09Fri%20Apr%2025%2013%3A09%3A12%202014%0AAgent%3A%09Mozilla%2F4.0%20(compatible%3B%20MSIE%206.0%3B%20Win32%3B%20Microsoft%20Windows%20XP%20Professional%20Service%20Pack%203%20(build%202600))%0D%0Aid%20error%21%0D%0Ano%20command%0D%0Arun%20http%3A%2F%2FAdobeFlash.info.tm%2Fdownload%2Flogo.png%20setup.exe%09%0D%0ANext%3AFri%20Apr%2025%2014%3A09%3A14%202014%0Adelay%3A3600%20sec%0D%0A%0D%0A POST/download/device_input.asp?device_t=2437266266&key=zqlameug&device_id=ad&cv=zqlameugaocrxjeqi | Sample | Library Ssheet | |
| 2/3/2015 | APT | njRAT / Backdoor.LV | lv|'|'|TndfQzQyNjRFQkI=|'|'|VICTIM|'|'|Examiner|'|'|2013-06-21|'|'|USA|'|'|WinXPProfessionalSP2... 171.ll|'|'|Li4uLi4uLk5FVy4uLi4uLi4uX0FFNTJDMzdE|'|'|SENTA|'|'|sentai55|'|'|15-01-29|'|'||'|'|Win8.1SP0x64|'|'|Yes|'|'|0.7d|'|'|..|'|'||'|'|b88ece4c04f706c9717bbe6fbda49ed2,132.inf|'|'|Li4uLi4uLk5FVy4uL[truncated] 251.ll|'|'|Li4uLi4uLk5FVy4uLi4uLi4uX0FFNTJDMzdE|'|'|SENTA|'|'|sentai55|'|'|15-01-29|'|'||'|'|Win8.1SP0x64|'|'|Yes|'|'|0.7d|'|'|..|'|'|QnVyd2VsbCB2LiBIb2JieSBMb2JieSBBYnJpZGdlZCBbQ29tcGF0aWJpbGl0eSBNb2RlXSAtIFdvcmQA|'|'|b88ece4c04f706c9717bbe6fbda49ed2, lv|'|'|VHJvamFuX0M0NkY2RTk=|'|'|MARK|'|'|user|'|'|2013-11-22|'|'||'|'|WinXP|'|'|No|'|'|0.6.4|'|'|..|'|'||'|'|[endof] | Sample | Library Ssheet | ||
| 2/3/2015 | APT | Protux worm | POST | http://ruthless.hobby-site.com:80/PHqgHumeay5705.mp3 http://202.71.136.14:80/ggBwkFNqDu1869.avi /newTroy.jpg /http://Microsoft.dumb1.com:80/PHqgHumeay5705.mp3 | Sample Sample2 | pcap | Library Ssheet |
| 2/3/2015 | APT | Wykcores | GET | 279843 /279859 /280015 /287171 /315171 /110937 /111968 /113000 /114031 /115062 | Sample | Library Ssheet | |
| 2/2/2015 | APT | TinyBaron / Miniduke / CosmicDuke | GET | modules/db/mgr.php? /modules/db/mgr.php?F=3? | Sample | Library Ssheet | |
| 2/1/2015 | APT | Cobra / Turla | POST | /%s/%s? uid=%d&context=%s&mode=text&data=%s | Sample | Library Ssheet | |
| 2/1/2015 | APT | Panda | POST | /forum/login.cgi | Sample | pcap | Library Ssheet |
| 2/1/2015 | APT | Panda | POST | /Photos/Query.cgi?loginid= | Sample | pcap | Library Ssheet |
| 2/1/2015 | APT | Aided Frame | GET | /img/js.php | Sample | pcap | Library Ssheet |
| 2/1/2015 | APT | Scanbox Watering hole framework | POST | /i/recv.php | Sample | pcap | Library Ssheet |
| 2/1/2015 | APT | Syria Twitter. apk | POST | /contacts | Sample | pcap | Library Ssheet |
| 1/22/2015 | APT | Gholee / Rocket Kitten | GET / POST | /index.php?c=Ud7atknq&r=17117d /index.php?c=Ud7atknq&r=1710b2 | Sample | pcap | Library Ssheet |
| 1/22/2015 | APT | Lagulon (Operation Cleaver) | POST | /contador/server.php /i/server.php /includes/server.php | Sample | pcap | Library Ssheet |
| 1/22/2015 | APT / CRIME | Scieron / Httneilc / HTClient | packet data 0000 16 03 01 00 41 01 00 00 3d 03 01 54 c1 2a fa 82 0010 a5 0b 00 4c 7b 26 c9 33 81 bd 63 34 08 ab b3 38 0020 3a de 83 db b1 9c 95 02 3e c3 34 00 00 16 00 04 0030 00 05 00 0a 00 09 00 64 00 62 00 03 00 06 00 13 0040 00 12 00 63 01 00 | Sample | pcap | Library Ssheet | |
| 1/22/2015 | APT? | Medusa | POST | %s/bbc_mirror/%s/search?id=%s /CNN_Mirror/EN/%s/search?id=%s |00|U|00|n|00|d|00|e|00|r|00 20 00|C|00|o|00|n|0 0|s|00|t|00|r|00|u|00|c|00|t|00|i|00|o|00|n|00 | Sample | pcap | Library Ssheet |
| 9/9/2013 | APT | Vidgrab | POST | (172.16.253.130)|1067|WinXP|D|L|No| 0..0....1..52..|No|V2010-v24|2184|0|3111947|0|1|. | Sample | pcap | Library Ssheet |
| 9/8/2013 | APT | Page / stscout / Elise / lStudio / Wumins | GET | /29af9cdc/page_12082223.html | Sample | pcap | Library Ssheet |
| 9/8/2013 | APT | Darkcomet | GET | /a.php?id=c2ViYWxpQGxpYmVyby5pdA== | Sample | pcap | Library Ssheet |
| 8/9/2013 | APT (IN) | Hanove / Tourist | POST | /kamp.php | Sample | pcap | Library Ssheet |
| 8/7/2013 | APT | Surtr 2nd Stage DL | 00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | Sample | pcap | Library Ssheet | |
| 8/7/2013 | APT | Surtr 2nd Stage DL | 00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | Sample | pcap | Library Ssheet | |
| 8/7/2013 | APT | Surtr Initial GET | 00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ | Sample | pcap | Library Ssheet | |
| 7/15/2013 | APT | Taleret | GET | / | Sample | pcap | Library Ssheet |
| 7/15/2013 | APT | Taleret | GET | /jw!Dyz0_2mTExQ0xbBnlp.RZcXoHmU- | Sample | pcap | Library Ssheet |
| 5/23/2013 | APT | Hangover Smackdown Minapro | GET | /flaws/snwd.php?tp=1&tg=[ID]&tv=Error[]&ts=[PLATFORM]&mt=[account]&tr=[NoFiles]&Y1Y5F2 | Sample | pcap | Library Ssheet |
| 5/15/2013 | APT | Mediana Proxy | GET | /index.htm?n763t4OPmrs6fXq7fXp7uj16e-r&Length=0 | Sample | pcap | Library Ssheet |
| 5/14/2013 | APT | Hupigon / Graybird | ........................................;...WindowsXP5.1(2600.ServicePack3)................................................................$...DELLXT...................................................................................................................4s.love.......HACK.. | Sample | pcap | Library Ssheet | |
| 5/14/2013 | APT | Variant Letsgo / TabMsgSQL downloader (comment crew) | GET | /index.htm | Sample | pcap | Library Ssheet |
| 5/14/2013 | APT | Tapaoux | GET | /ol/yahoo/banner4.php?jpg=../yahoo | Sample | pcap | Library Ssheet |
| 5/12/2013 | APT | Gh0st | Gh0st....d...x.Kc``....@....\..L@:8..,39U!1 | Sample | pcap | Library Ssheet | |
| 5/12/2013 | APT | IXESHE | GET | /AWS96.jsp?baQMyZrdI5Rojs9Khs9fhnjwj/8mIOm9jOKyjnxKjQJAx_bigfix_client_string:baQMyZrdqDAA | Sample | pcap | Library Ssheet |
| 5/8/2013 | APT2 | KoreanBanker DL | GET | /web/down/kbs.exe | Sample | pcap | Library Ssheet |
| 5/5/2013 | APT | Plugx | SSL - see http://4.bp.blogspot.com/-m2u0QTwirDk/UYO4 6Pm7OOI/AAAAAAAAAFw/SG_eKhd1-Nw/s640/Untitled.png | Sample | pcap | Library Ssheet | |
| 5/5/2013 | APT | RssFeeder (moved from TBD tab, common name still unknown) 2nd stage | POST | /orange/news.php | Sample | pcap | Library Ssheet |
| 5/5/2013 | APT | RssFeeder (moved from TBD tab, common name still unknown) initialGET | POST | /data/rss | Sample | pcap | Library Ssheet |
| 5/5/2013 | APT | Swami | GET | /im/linux.php | Sample | pcap | Library Ssheet |
| 5/1/2013 | APT | Comfoo / Vinself / Mspub | POST | /BmYBcnhwJxwk/VTlaMWlnYEw12511/18688/12AzAONjkCYw/UD1aND43a0xiWQ161/ | Sample | pcap | Library Ssheet |
| 5/1/2013 | APT | Destory Rat / Sogu / Thoper | POST | /update?id=000f72b8 | Sample | pcap | Library Ssheet |
| 5/1/2013 | APT2 | Disttrack / Shamoon | GET | /ajax_modal/modal/data.asp?mydata=AA==&uid=aaa.bbb.ccc.ddd&state=3067203 | Sample | pcap | Library Ssheet |
| 4/30/2013 | APT | 9002 | POST | 9002..................wx....9002..................wx....9002....................... | Sample | pcap | Library Ssheet |
| 4/30/2013 | APT | MSWab /Yayih | POST | /bbs/info.asp | Sample | pcap | Library Ssheet |
| 4/30/2013 | APT | 9002 | POST | /2d | Sample | pcap | Library Ssheet |
| 4/30/2013 | APT | Favorites | GET | /download731106?h1=FIFEFDAHAPGDENCMFOFFFCAGAE | Sample | pcap | Library Ssheet |
| 4/30/2013 | APT | Favorites | GET | /search?qu= | Sample | pcap | Library Ssheet |
| 4/30/2013 | APT | Favorites | GET | /search59861?h1=51&h2=1&h3=BHI06233&h4=FIFEFDAHAPGDENCMFOFFFCAGAE | Sample | pcap | Library Ssheet |
| 4/30/2013 | APT | Favorites | GET | /search613522?h1=FIFEFDAHAPGDENCMFOFFFCAGAE | Sample | pcap | Library Ssheet |
| 4/30/2013 | APT | Favorites | POST | /search25548?h1=FIFEFDAHAPGDENCMFNFFFNAGAH | Sample | pcap | Library Ssheet |
| 4/30/2013 | APT | Favorites | POST | /upload8806?h1=FIFEFDAHAPGDENCMFOFMFGAEAE | Sample | pcap | Library Ssheet |
| 4/30/2013 | APT | Gh0st | GET | /cgi/online.asp?hostname=[COMPUTERNAME]&httptype=[1][not%20httptunnel] | Sample | pcap | Library Ssheet |
| 4/30/2013 | APT | Gh0st var | GET | /h.gif?pid=113&v=130586214568HTTP/1.1 | Sample | pcap | Library Ssheet |
| 4/29/2013 | APT | Glasses | GET | /ewpindex.htm | Sample | pcap | Library Ssheet |
| 4/29/2013 | APT | IEXPLORE Rat / C0D0S0 /Briba / Cimuz / SharkyRAT | POST | /index000000001.asp | Sample | pcap | Library Ssheet |
| 4/29/2013 | APT | LURK | GET | LURK0........x.kf.e.apgpbpa0c..#........ | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | DNSWatch / Protux | GET | /dns/dnslookup?la=en&host=picture.ucparlnet.com&type=A&submit=Resolve | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | DNSWatch / Protux | GET | /news.jpg | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | DNSWatch / Protux | POST | /PHqgHumeay5705.mp3 | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | APT1 WEBC2_RAVE | GET | /comp/sem/resources.htm | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | backdoor ? | GET | /18110123/page_32262308.html | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Banechant 1 | GET | /IGKKT | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Banechant payload dl 2 | GET | /adserv/logo.jpg HTTP /1.1 | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Beebus | GET | /windosdate/v6/default.aspx?ln=en-us | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Beebus C2 checkin | GET | /s/asp?XAAAAM4w5jmIa_kMZlr67o8jettxsYA8dZgeNAHes-Nn5p-6AFUD6yncpz5AL6wAAA==p=1 | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Beebus C2 checkin | GET | /s/asp?XAAAAM4w5jmOS_kMZlr67o8jettxsYA8dZgeNAHes-Nn5p-6AFUD6yncpz5AL6wAAA==p=1 | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Beebus data send | POST | /s/asp?__uLBwO1bAMKBgG2BQAAAAEAAAACAAAAAAAAAG9zYW11AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVwBJAE4ARABPAFcAUwBNAEEAQQBOAEUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==p=2 | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Cookies /Cookiebag / Dalbot | GET | /1799.asp | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Cookies /Cookiebag / Dalbot | GET | /3961.html Cookie:Y29tbWFuZD1HZXRDb21tYW5kO2NsaWVudGtleT0zOTU0O2hvc3RuYW1lPXZpY3RpbTs= | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Cookies /Cookiebag / Dalbot | GET | /8223.asp (also can be like /2007.asp,/2013.asp etc | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Cookies /Cookiebag / Dalbot | GET | /indexs.zip | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Coswid | GET | /old/google.png | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | CVE-2012-0754 SWF in DOC | GET | /test.mp4 | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | CVE-2012-0779 | GET | /essais.swf?info=789c333230d13331d53337d633b3b432313106001afa0338&infosize=00FC0000 | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Depyot | GET | /new/3d/d/pdf.php?id=2 | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Destory Rat / Sogu / Thoper | POST | /update?id=000f6b50 | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Destory Rat / Sogu / Thoper | POST | /update?id=3109c2a2 | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Destory Rat / Sogu / Thoper | POST | /update?product=windows | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Downloader BMP | GET | /images/evil.bmp | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Einstein | GET | /gttfi.php?id=019451425260376469&ext=YmFkc3R1ZmYuZGxs | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Einstein data send | POST | /gttfi.php?id=019451425260376469&ext=ixioJXXJFCRrrDatKHhK | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Enfal / Lurid | GET | /oi2c/wlc3/ [reducted]:00-00-00-00-00-00/ij83d | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Enfal / Lurid | GET | /trandocs/nm/.[reducted] :00-00-00-00-00-00lCrrrwhite | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Enfal / Lurid | POST | /cgi-bin/CMS_SubitAll.cgi | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Enfal / Lurid | POST | /cgl-bin/Owpq4.cgi | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Enfal / Lurid | POST | /Sjwpc/odw3ux | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Foxy | POST | /404error.asp | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Foxy Checkin | GET | /images/leftnav_prog_bg.jpg | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Gh0st ASP ver | GET | /1/v2/1oginv2.asp?hi2wsdf351&x.’..[xf)..<.3XqHr....)IL{..&y192.168.0.69 | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Gh0st PHP ver | GET | /ld/queenfun/vl/login.php?cd2hpdGU&uU11TVEV&s&pMTkyLjE2OC4wljYS&hi2wsdf35l | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Gh0st v2000 var | n | v2010........f...............(......ServicePack2..?..|...|...|0.@.. | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | GoogleAdC2 | GET | /html/lost.html | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | GoogleAdC2 2nd stage | GET | /Trojan2.jpg | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Googles | GET | /sll/monica.jpg | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Greencat | GET | /<HOSTNAME>/ | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Gtalk | GET | /facebook.png | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | IXESHE | GET | /AWS26329.jsp?UrFvwIJIOKTRyfxR9KNRqhg8lcPr/CGjUwP8yJUs7RjH7OinJ/85cgrqiP8jKGjpqgb/wTrO7OIjhxoHcGaFaURqK/aHophHLd23K=NHk=a9oQhvDQaLky8qo/RnJz42A | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | IXESHE AES | GET | /AES210001129016878.jsp?UrFwUIO3h7ofgwQInYPRbkQaHVM9Bih7kZ9rO+pKUrbklllsgfOk=+LLQhpkZ9LOhGbgqvJghHci7M | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Letsgo / TabMsgSQL | GET | /indexbak.asp?rands=IXLCGIXELZ&acc=&str=select%20id%20from%20tab_online%20where%20regcode%20=%20'IXLCGIXELZ' | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Letsgo / TabMsgSQL | GET | /safe/1.asp?rands=DWLLOXLGLH&acc=vy&str=select%20top%201%20%20from%20tab_message%20where%20toid%20=%20'198'%20order%20by%20id%20asc | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Letsgo / TabMsgSQL | GET | /safe/1.asp?rands=XJOTLVALQF&acc=vy&str=insert%20into%20tab_online%20(mode,clientname,clientip,accessip,onlinetime,lasttime,regcode)%20values%20('0','victim','192.168.1.12','145.42.112.19','2011-06-08%2013:45:54','2011-06-08%2013:45:54','NMQVPTXFBH') | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Letsgo / TabMsgSQL downloader | GET | /new/iistart.html | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Likseput | GET | /index.html | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Lingbo (?) | POST | /windowsupdatev7/search%3Fhl%3cWABQAFMAUAAzACOAUgA5ADMALQBPAEYAQwAyADAA%26q%3DMQA3ADIALgAyADkALgAwAC4AM>QAxADYA%26meta%3DMDAwMGhIÆÑuMDk%3D%26id%3Dlfdxfircvscxggb | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Luckycat - WIMMIE | POST | /count/count.php?m=c&n=[HOSTNAME]_ | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | MiniASP | GET | /device_<decoded ID string>asp?device_t=<random 10 digits>&key=<random 8 lowercaseletters>&device_id=<decoded ID string>&cv=<random 17 lowercase letters> | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | MiniASP | GET | /record.asp?device_t=<random10digits>&key=<random8lowercaseletters>&device_id=<decodedIDstring>&cv=<random17lowercaseletters>&result=<URLencodedresultdata> | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Miniduke | POST | /index.php | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Mirage | POST | /resuIt?hl=en&meta=mdlyorvkildpiicqqownoatgvow | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Mirage - later var | GET | /search?hl=en&q=(RemovedBase64string)&meta=acbazuxmhecthlegrepunkkdmpweqtg | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Mongal | GET | /3010850A0000F0FD0F00323137443744324536313634333833380044454C4C58540000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000007014C61757261000000000000000000000000000000000000000000000000000000000000000000000000 | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Murcy | GET | /150828 | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Netravler | GET | /fly/2013/2011/nettraveler.asp?action=getcmd&hostid=E81B9088&hostname=DellXT | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Netravler | GET | /fly/2013/2011/nettraveler.asp?hostid=E81B9088&hostname= DellXT&hostip=172.16.253.130&filename=travlerbackinfo-2013-1-14-0-29.dll&filestart=0&filetext=begin::tCvUBC2vGMy3Gu300GKz1EXQa CuRHQgIhFJhMLBUmNNhrtTsN9yhTLJTKhFJs4STgtWw1lvSDEbjIX <very long string> UjfNI0fBFg3GI2GWcB8EVKIPlGwrkknFPSsHigx-LIIiZKrqD0pqgt | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Netravler | GET | /nt2011/zy/nettraveler.asp?hostid=E81B9088&hostname=DellXT&hostip=172.16.253.130&filename=FileList-1006-233757.ini&filestart=0&filetext=begin::OgA1AC2QzebTgdToZTkXQaCicYTaZR6RDKbDYWCpKKBhM88YjIajKXLfKOEmQ0nIxm86m46D0YVg::end /nt2012/asp/nettraveler.asp?hostid=411CD510&hostname=mikepc&hostip=10.12.0.23&filename=travlerbackinfo-2012-1- | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | NfLog | GET | /IElog/TestURL.aspHTTP/1.0 | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | NfLog | POST | /NfLog/Nfile.asp | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | NTESSESS | GET | /6K8gL8.html | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | PNG trojan | GET | /index.htm | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Poison Ivy | GET | 256 bytes of seemingly random data after a successful TCP handshake, then 48 byte “keep-alive†requests | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | RedOctober AuthInfo | POST | http://%s:%s%s | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | RedOctober Sysinfo | POST | /cgi-bin/nt/sk | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | RegSubDat | POST | /5501000000/log | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Sanny / Win32.Daws | POST | /write.php | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Seasalt | GET | /postinfo.html | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Sofacy | POST | /~wong/cgi-bin/brvc.cgi?DELLXT88901be8-05_01 | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Sofacy | POST | /~bars/cgi-bin/qfa.cgi?20120311_06:44:06.bin.FFFFFFFFFS | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Sykipot / Wyksol | GET | /kys_allowget.asp?namegetkys.kys | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Taidoor | GET | /apzsr.php?id=021793111D309GE67E | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Tarsip Eclipse | GET | /blg7_8newtpl/image/7/7_12/images/redir?di=130b51e7dc7&prd=bEFU&pver=131&j=1&ck=0 | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Tarsip Moon | GET | /images/icons/2055?meth=gc&tid=2011506&cqe=3878658&inif=qKero9uLh4iCj4eIksvQ1ILS0IfAp6itNvX0dTI19DI19HWyNfU38Crp7St26ClvsiFiYvAqbW229PI18CuorWo29SF0d8=&syun=230 | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Vinself | POST | /w880/T19R17Q16/12010L11014 | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | WEBC2-Bolid | GET | /firefox.html | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | WEBC2-Clover | GET | /Default.asp | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | WEBC2-CSON | GET | /Default.aspx?INDEX=<10_random_characters> | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | WEBC2-CSON Response to commands | POST | /Default.aspx?ID=IMNQRSSRXK | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | WEBC2-HEAD | GET | / | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | WEBC2-Table | GET | /order.htm | Sample | pcap | Library Ssheet |
| 4/28/2013 | APT | Xtreme Rat | GET | /1234567890.functions | Sample | pcap | Library Ssheet |
↧
test apt
↧