CastleCops® eCard Malware

MIRT^(TM)

Malware Incident Reporting and Termination^(TM) Squad

How-To / FAQ

MIRT

Confirmed Malware

Terminated Malware

status: confirmed malware

HTTP Response 18 Nov, 2008 22:39:41	408 - SIRT Operation Timed Out
ID	679 (termination link)
Title	eCard
Entry	http://88.203.56.4/?b5cc61301cba46921636c804814655dc21c
MIRT Squad Reporter	tetak
Timestamp	11 Aug, 2007 @ 01:30:08
Topic ID	199123 - Read/respond to MIRT commentary.
Handler Note: 24 Aug, 2007 04:37:19	tetak: View CIDR AS12709 Report: http://www.cidr-report.org/cgi-bin/as-report?as=12709 "12709 \| MT \| ripencc \| 1999-10-06 \| MELITACABLE Melita Cable plc"
Handler Note: 24 Aug, 2007 04:37:20	tetak: Extended information for AS12709: State/Province: Country: Responsible Domain: melitacable.com Abuse Email: security@melitacable.com
Handler Note: 24 Aug, 2007 04:37:20	tetak: ecard.exe at this location is a Trojan:Win32/Tibs.gen!B trojan as seen by Microsoft
Handler Note: 24 Aug, 2007 04:39:15	tetak: Generated and sent email malware alert to respective parties.
Fetched URLs	http://88.203.56.4/?b5cc61301cba46921636c804814655dc21c

Report for at 11 Aug, 2007 @ 01:50:04

whois

at 20 Oct, 2007 @ 03:09:30

GeekTools Whois Proxy v5.0.4 Ready.
Checking access for 204.152.186.155... ok.
Final results obtained from whois.ripe.net.
Results:
% This is the RIPE Whois query server #2.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html

% Note: This output has been filtered.
%       To receive output for a database update, use the "-B" flag

% Information related to '88.203.32.0 - 88.203.63.255'

inetnum:        88.203.32.0 - 88.203.63.255
netname:        MELITACABLE
descr:          on-vol Cable Internet
country:        MT
remarks:        ---------------------------------
remarks:        SPAM/ABUSE: abuse@melitacable.com
remarks:        ---------------------------------
admin-c:        MC2549-RIPE
tech-c:         MC2549-RIPE
status:         ASSIGNED PA
mnt-by:         MELITACABLE-MNT
mnt-lower:      MELITACABLE-MNT
mnt-routes:     MELITACABLE-MNT
source:         RIPE # Filtered

role:           MELITACABLE Hostmaster
address:        Melita Cable plc
address:        Gasan Centre
address:        Mriehel By-Pass
address:        Mriehel BKR 3000
address:        MALTA
remarks:        ---------------------------------
remarks:        SPAM/ABUSE: abuse@melitacable.com
remarks:        ---------------------------------
phone:          +356 2727 0000
fax-no:         +356 2727 5040
abuse-mailbox:  abuse@melitacable.com
admin-c:        NC501-RIPE
tech-c:         MPB5-RIPE
tech-c:         TE949-RIPE
nic-hdl:        MC2549-RIPE
mnt-by:         MELITACABLE-MNT
source:         RIPE # Filtered

% Information related to '88.203.0.0/17AS12709'

route:          88.203.0.0/17
descr:          Melita Cable plc
origin:         AS12709
mnt-by:         MELITACABLE-MNT
mnt-lower:      MELITACABLE-MNT
mnt-routes:     MELITACABLE-MNT
source:         RIPE # Filtered

% Information related to '88.203.0.0/18AS12709'

route:          88.203.0.0/18
descr:          Melita Cable plc
origin:         AS12709
mnt-by:         MELITACABLE-MNT
mnt-lower:      MELITACABLE-MNT
mnt-routes:     MELITACABLE-MNT
source:         RIPE # Filtered

Results brought to you by the GeekTools WHOIS Proxy
Server results may be copyrighted and are used with permission.
Your host (204.152.186.155) has visited 50273 times today.

fetched page

at 11 Aug, 2007 @ 01:50:20
MD5 Fingerprint: 3d0143c094b98dcfd55772429f82f53c
SHA1 Fingerprint: 68673e1d96191a00e6614d7c2151dd643d10659d

MIRT^(TM)

Malware Incident Reporting and Termination^(TM) Squad

status: confirmed malware

Report for at 11 Aug, 2007 @ 01:50:04

whois

host

fetched page

Corresponding BGP Origin ASN

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

AS Description of a given BGP ASN


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 146ppm 0.212s (0.142s) Making cybercriminals unhappy since 2002*

MIRT(TM)

Malware Incident Reporting and Termination(TM) Squad

status: confirmed malware

Report for at 11 Aug, 2007 @ 01:50:04

whois

host

fetched page

Corresponding BGP Origin ASN

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

AS Description of a given BGP ASN

MIRT^(TM)

Malware Incident Reporting and Termination^(TM) Squad