CastleCops® eCard Malware

MIRT^(TM)

Malware Incident Reporting and Termination^(TM) Squad

How-To / FAQ

MIRT

Confirmed Malware

Terminated Malware

status: confirmed malware

HTTP Response 18 Nov, 2008 22:34:38	HTTP/1.1 404 Not Found
ID	597 (termination link)
Title	eCard
Entry	http://211.62.119.15/?0229e368412571d7d41977bc649ea955238937
MIRT Squad Reporter	Paul
Timestamp	10 Aug, 2007 @ 13:44:11
Topic ID	198758 - Read/respond to MIRT commentary.
Handler Note: 19 Aug, 2007 20:56:29	tetak: View CIDR AS9695 Report: http://www.cidr-report.org/cgi-bin/as-report?as=9695 "9695 \| KR \| apnic \| 1999-10-05 \| KITINET-AS KT Solutions Coprporation"
Handler Note: 19 Aug, 2007 20:56:29	tetak: Extended information for AS9695: State/Province: Country: kr Responsible Domain: kitinet.co.kr Abuse Email: abuse@kitinet.co.kr
Handler Note: 19 Aug, 2007 20:56:29	tetak: msdataaccess.exe at this location is a W32/Nuwar@MM virus as seen by McAfee
Handler Note: 19 Aug, 2007 20:57:34	tetak: Generated and sent email malware alert to respective parties.
Fetched URLs	http://211.62.119.15/?0229e368412571d7d41977bc649ea955238937

Report for at 10 Aug, 2007 @ 13:50:30

whois

at 20 Oct, 2007 @ 03:03:58

GeekTools Whois Proxy v5.0.4 Ready.
Checking access for 204.152.186.155... ok.
Final results obtained from whois.apnic.net.
Results:
% [whois.apnic.net node-2]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

inetnum:      211.61.0.0 - 211.62.127.255
netname:      KRNIC-KR
descr:        KRNIC
descr:        Korea Network Information Center
country:      KR
admin-c:      HM127-AP
tech-c:       HM127-AP
remarks:      ******************************************
remarks:      KRNIC is the National Internet Registry
remarks:      in Korea under APNIC. If you would like to
remarks:      find assignment information in detail
remarks:      please refer to the KRNIC Whois DB
remarks:      http://whois.nic.or.kr/english/index.html
remarks:      ******************************************
mnt-by:       APNIC-HM
mnt-lower:    MNT-KRNIC-AP
changed:      hm-changed@apnic.net 20000216
changed:      hm-changed@apnic.net 20010606
changed:      hm-changed@apnic.net 20040323
status:       ALLOCATED PORTABLE
source:       APNIC

person:       Host Master
address:      11F, KTF B/D, 1321-11, Seocho2-Dong, Seocho-Gu,
address:      Seoul, Korea, 137-857
country:      KR
phone:        +82-2-2186-4500
fax-no:       +82-2-2186-4496
e-mail:       hostmaster@nic.or.kr
nic-hdl:      HM127-AP
mnt-by:       MNT-KRNIC-AP
changed:      hostmaster@nic.or.kr 20020507
source:       APNIC

inetnum:      211.62.64.0 - 211.62.127.255
netname:      KITINET-KR
descr:        KT Solutions Corporation
country:      KR
admin-c:      JH79-KR
tech-c:       KH79-KR
status:       ALLOCATED PORTABLE
mnt-by:       MNT-KRNIC-AP
remarks:      This information has been partially mirrored by APNIC from
remarks:      KRNIC. To obtain more specific information, please use the
remarks:      KRNIC whois server at whois.krnic.net.
changed:      hostmaster@nic.or.kr
source:       KRNIC

Results brought to you by the GeekTools WHOIS Proxy
Server results may be copyrighted and are used with permission.
Your host (204.152.186.155) has visited 50010 times today.

fetched page

at 10 Aug, 2007 @ 13:50:32
MD5 Fingerprint: d41d8cd98f00b204e9800998ecf8427e
SHA1 Fingerprint: da39a3ee5e6b4b0d3255bfef95601890afd80709

MIRT^(TM)

Malware Incident Reporting and Termination^(TM) Squad

status: confirmed malware

Report for at 10 Aug, 2007 @ 13:50:30

whois

host

fetched page

Corresponding BGP Origin ASN

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

AS Description of a given BGP ASN


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 159ppm 0.149s (0.082s) Making cybercriminals unhappy since 2002*

MIRT(TM)

Malware Incident Reporting and Termination(TM) Squad

status: confirmed malware

Report for at 10 Aug, 2007 @ 13:50:30

whois

host

fetched page

Corresponding BGP Origin ASN

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

AS Description of a given BGP ASN

MIRT^(TM)

Malware Incident Reporting and Termination^(TM) Squad