CastleCops® eCard Malware

MIRT^(TM)

Malware Incident Reporting and Termination^(TM) Squad

How-To / FAQ

MIRT

Confirmed Malware

Terminated Malware

status: confirmed malware

HTTP Response 18 Nov, 2008 22:44:27	408 - SIRT Operation Timed Out
ID	792 (termination link)
Title	eCard
Entry	http://81.229.191.182/?8e6c33d5eb0269ad4eac804814655dc2
MIRT Squad Reporter	Huldin-the-Goth
Timestamp	12 Aug, 2007 @ 10:57:33
Topic ID	199251 - Read/respond to MIRT commentary.
Handler Note: 25 Aug, 2007 22:19:31	tetak: View CIDR AS3301 Report: http://www.cidr-report.org/cgi-bin/as-report?as=3301 "3301 \| EU \| ripencc \| 1994-10-28 \| TELIANET-SWEDEN TeliaNet Sweden"
Handler Note: 25 Aug, 2007 22:19:32	tetak: Extended information for AS3301: State/Province: Country: se Responsible Domain: telia.com Abuse Email: abuse@telia.com
Handler Note: 25 Aug, 2007 22:19:32	tetak: video.exe at this location is a Trojan:Win32/Tibs.gen!B Trojan as seen by Microsoft
Handler Note: 25 Aug, 2007 22:20:47	tetak: Generated and sent email malware alert to respective parties.
Fetched URLs	http://81.229.191.182/?8e6c33d5eb0269ad4eac804814655dc2

Report for at 12 Aug, 2007 @ 11:10:04

whois

at 20 Oct, 2007 @ 03:12:56

GeekTools Whois Proxy v5.0.4 Ready.
Checking access for 204.152.186.155... ok.
Final results obtained from whois.ripe.net.
Results:
% This is the RIPE Whois query server #1.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/db/copyright.html

% Note: This output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '81.224.0.0 - 81.236.255.255'

inetnum:      81.224.0.0 - 81.236.255.255
netname:      TELIANET
descr:        Telia Network Services
descr:        ISP
country:      SE
admin-c:      TR889-RIPE
tech-c:       TR889-RIPE
status:       ASSIGNED PA
mnt-domains:  TELIANET-LIR
mnt-by:       TELIANET-LIR
mnt-lower:    TELIANET-LIR
mnt-routes:   TELIANET-RR
source:       RIPE # Filtered

role:           TeliaNet Registry
address:        TeliaSonera AB Networks
address:        Marbackagatan 11
address:        SE-123 86 Farsta
address:        Sweden
address:        ********************************
address:        Abuse and intrusion reports should
address:        be sent to: abuse@telia.com
address:        ********************************
fax-no:         +46 8 6047006
e-mail:         registry@telia.net
e-mail:         dns@telia.net
e-mail:         backbone@telia.net
admin-c:        AA90-RIPE
admin-c:        EVAO
tech-c:         AA90-RIPE
tech-c:         YL39-RIPE
tech-c:         IC106-RIPE
tech-c:         ACA-RIPE
tech-c:         JS7984-RIPE
tech-c:         OE207-RIPE
tech-c:         EVAO
tech-c:         PJ2540-RIPE
tech-c:         IF264-RIPE
tech-c:         LS483-RIPE
tech-c:         KO551-RIPE
tech-c:         OA667-RIPE
tech-c:         PB8229-RIPE
tech-c:         SV2344-RIPE
nic-hdl:        TR889-RIPE
mnt-by:         TELIANET-LIR
source:         RIPE # Filtered

% Information related to '81.224.0.0/12AS3301'

route:        81.224.0.0/12
descr:        TELIANET-BLK
origin:       AS3301
mnt-by:       TELIANET-RR
source:       RIPE # Filtered

Results brought to you by the GeekTools WHOIS Proxy
Server results may be copyrighted and are used with permission.
Your host (204.152.186.155) has visited 50376 times today.

fetched page

at 12 Aug, 2007 @ 11:10:06
MD5 Fingerprint: d41d8cd98f00b204e9800998ecf8427e
SHA1 Fingerprint: da39a3ee5e6b4b0d3255bfef95601890afd80709

MIRT^(TM)

Malware Incident Reporting and Termination^(TM) Squad

status: confirmed malware

Report for at 12 Aug, 2007 @ 11:10:04

whois

host

fetched page

Corresponding BGP Origin ASN

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

AS Description of a given BGP ASN


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 148ppm 0.178s (0.113s) Making cybercriminals unhappy since 2002*

MIRT(TM)

Malware Incident Reporting and Termination(TM) Squad

status: confirmed malware

Report for at 12 Aug, 2007 @ 11:10:04

whois

host

fetched page

Corresponding BGP Origin ASN

Possible BGP peer ASNs one AS hop away from BGP Origin ASN

AS Description of a given BGP ASN

MIRT^(TM)

Malware Incident Reporting and Termination^(TM) Squad