[nsp-sec] Win32:Cycbot-CL, Win32/Kryptik.MPX
Smith, Donald
Donald.Smith at qwest.com
Thu Jul 21 18:58:00 EDT 2011
These were seen beconing packets that match this pattern.
http://research.zscaler.com/2011/04/30-days-of-cycbot.html?m=1
https://asn.cymru.com/nsp-sec/upload/1311287900.whois.txt
If your asn appears in this count/asn list you may want to get your customer ips from the cymru link above.
Count ASN
536 7132
280 19262
219 10507
176 6389
158 22773
130 22394
110 20115
106 7018
63 6128
58 7029
56 11427
56 11426
49 11351
47 33363
44 20001
40 5650
37 12271
33 33651
32 33491
29 10796
28 7015
24 33287
24 16586
21 22561
21 19108
20 6079
19 8151
19 7011
19 701
19 4323
19 33657
17 7725
17 36727
16 9121
16 11955
15 5778
15 33650
15 20214
15 20057
14 7016
14 6478
14 4181
14 3356
13 33668
13 18566
12 3215
12 25019
12 1785
12 12262
12 11060
11 33662
11 2828
11 2379
11 20231
11 1239
11 11492
10 5089
10 33588
10 33490
10 1668
9 6181
9 3737
9 3593
9 2386
9 174
9 13367
8 7017
8 33652
8 3352
8 33489
8 12083
7 6327
7 6300
7 2856
7 19029
7 11398
6 8047
6 7385
6 6983
6 4565
6 40285
6 3320
6 30036
6 22258
6 21508
6 14654
6 11456
5 81
5 7843
5 7459
5 6621
5 6614
5 5742
5 5483
5 33661
5 33660
5 32448
5 29737
5 28573
5 2634
5 16810
5 12322
5 11232
4 852
4 7782
4 6461
4 6197
4 577
4 5384
4 4713
4 3549
4 3479
4 3462
4 27699
4 237
4 16817
4 14265
4 13489
4 12035
4 11992
4 10838
3 8551
3 812
3 8103
3 6805
3 6400
3 6367
3 6332
3 5769
3 5607
3 5056
3 4780
3 4775
3 3801
3 3663
3 36149
3 3505
3 33654
3 29895
3 29859
3 27364
3 26554
3 23314
3 23100
3 22759
3 226
3 22318
3 2152
3 21502
3 17184
3 1680
3 16718
3 14051
3 13999
3 13675
3 13490
2 9824
2 9674
2 8422
2 8167
2 7738
2 7377
2 7265
2 7065
2 6830
2 6713
2 6503
2 5723
2 5617
2 5410
2 52
2 4922
2 4837
2 4812
2 46144
2 45758
2 4134
2 40749
2 40700
2 3909
2 37127
2 3561
2 3447
2 33666
2 33655
2 3269
2 32107
2 3209
2 31549
2 29933
2 28661
2 27202
2 27171
2 26827
2 2609
2 24560
2 22995
2 22709
2 22186
2 22047
2 21797
2 217
2 21615
2 21565
2 20357
2 19817
2 18881
2 18712
2 17421
2 17310
2 17232
2 17229
2 16811
2 16527
2 16135
2 15897
2 15162
2 14989
2 14133
2 13672
2 13576
2 13536
2 13407
2 13333
2 12223
2 1221
2 12156
2 12066
2 11776
2 11550
2 11530
2 11486
2 11139
2 11078
2 10620
2 10474
1 9919
1 9829
1 9737
1 9416
1 9304
1 9299
1 9269
1 9229
1 9158
1 9155
1 9116
1 9
1 8612
1 8585
1 855
1 8447
1 8228
1 8190
1 8092
1 8057
1 8048
1 8025
1 7973
1 797
1 7949
1 7941
1 7896
1 7893
1 7829
1 7795
1 7784
1 7774
1 7772
1 7770
1 7600
1 7552
1 7332
1 7303
1 7281
1 7276
1 7250
1 7212
1 72
1 71
1 7068
1 7066
1 7058
1 7046
1 6848
1 6821
1 6799
1 6785
1 668
1 6648
1 6639
1 6536
1 6534
1 6458
1 6386
1 6368
1 6360
1 6298
1 6263
1 6222
1 6203
1 6198
1 6192
1 6167
1 6112
1 6102
1 6059
1 5760
1 5758
1 5739
1 5738
1 5683
1 5668
1 5639
1 5432
1 5391
1 53726
1 53435
1 53250
1 51377
1 51052
1 5009
1 5006
1 50030
1 49218
1 48161
1 47869
1 4771
1 4768
1 4760
1 47580
1 4755
1 47524
1 4739
1 47095
1 47018
1 46925
1 46887
1 46755
1 46692
1 46512
1 46475
1 46353
1 46310
1 46150
1 46145
1 45951
1 45899
1 45629
1 4515
1 4459
1 4436
1 44217
1 44208
1 44002
1 43234
1 4237
1 42163
1 41947
1 41881
1 41334
1 40939
1 40722
1 40703
1 40555
1 40459
1 40328
1 40316
1 40315
1 40314
1 40312
1 40310
1 40309
1 40308
1 40307
1 40306
1 40127
1 40078
1 39970
1 39852
1 39706
1 39349
1 393238
1 3851
1 3794
1 3776
1 37140
1 36991
1 36850
1 36846
1 36831
1 36524
1 36522
1 36515
1 36502
1 36498
1 36492
1 36488
1 36327
1 36295
1 36243
1 36201
1 36049
1 36032
1 3602
1 36012
1 35985
1 3598
1 35971
1 35958
1 35819
1 3527
1 35228
1 35207
1 34984
1 34769
1 3408
1 34
1 3390
1 33665
1 33647
1 33606
1 33548
1 33544
1 33461
1 33370
1 33334
1 33247
1 33187
1 33132
1 3292
1 32890
1 32855
1 32824
1 32808
1 32706
1 32703
1 32682
1 32645
1 32480
1 3243
1 32234
1 32229
1 32020
1 31985
1 31801
1 31769
1 30722
1 30710
1 30689
1 30688
1 30628
1 30606
1 30444
1 30211
1 30165
1 30110
1 30094
1 299
1 29863
1 29780
1 29766
1 29761
1 29556
1 29357
1 29259
1 2914
1 2900
1 28615
1 28512
1 28506
1 28126
1 27947
1 27921
1 27839
1 27822
1 27774
1 27767
1 27759
1 27738
1 27665
1 2764
1 27609
1 27501
1 27336
1 27294
1 27264
1 27262
1 27192
1 2711
1 2701
1 27
1 26981
1 26909
1 26842
1 26809
1 26760
1 26615
1 26599
1 26485
1 2647
1 26446
1 2637
1 26223
1 26166
1 26164
1 26133
1 26
1 25994
1 25973
1 25959
1 25853
1 25776
1 25691
1 25637
1 25611
1 25472
1 25
1 24863
1 24608
1 24093
1 24086
1 2381
1 23541
1 23383
1 23332
1 23292
1 23205
1 23173
1 23024
1 22993
1 22932
1 22927
1 22925
1 22855
1 22834
1 22833
1 22820
1 22646
1 22637
1 22584
1 22363
1 22323
1 22299
1 22220
1 22218
1 22192
1 22140
1 22093
1 21948
1 21947
1 21928
1 21890
1 21844
1 21823
1 21747
1 21686
1 21327
1 21321
1 21263
1 20978
1 20960
1 20825
1 20807
1 20676
1 2055
1 20456
1 20436
1 20426
1 2042
1 20412
1 20313
1 20257
1 20175
1 20135
1 20101
1 20085
1 1998
1 19977
1 19855
1 19828
1 1970
1 19653
1 19516
1 19443
1 19430
1 19271
1 19236
1 19170
1 19158
1 18859
1 18812
1 18809
1 18779
1 18757
1 18564
1 18474
1 18291
1 18101
1 17974
1 17813
1 17547
1 17488
1 17379
1 17324
1 17253
1 17226
1 17161
1 17153
1 17143
1 17089
1 17054
1 16889
1 16880
1 16875
1 16835
1 16667
1 16604
1 16559
1 16526
1 16509
1 16495
1 16461
1 16430
1 1640
1 16322
1 16276
1 16265
1 16232
1 15699
1 156
1 15598
1 15557
1 15320
1 15267
1 15227
1 15108
1 15105
1 15083
1 14985
1 14981
1 14955
1 14921
1 14910
1 14905
1 14860
1 14832
1 14828
1 14762
1 14758
1 14751
1 14742
1 14710
1 14677
1 14638
1 14615
1 14486
1 14468
1 14434
1 14371
1 14369
1 14348
1 14299
1 14288
1 14155
1 14154
1 14090
1 14045
1 14000
1 14
1 13977
1 13927
1 13790
1 13778
1 13760
1 13753
1 13693
1 13510
1 13370
1 13368
1 13326
1 13285
1 1312
1 131
1 13097
1 12978
1 12874
1 12764
1 12741
1 12716
1 12653
1 125
1 12479
1 1246
1 12430
1 12392
1 12357
1 12338
1 12301
1 12257
1 12182
1 12175
1 12119
1 12112
1 12105
1 12067
1 12064
1 12036
1 1201
1 12006
1 12
1 11979
1 11976
1 11915
1 11891
1 11888
1 11830
1 11816
1 11796
1 11788
1 11722
1 11650
1 11619
1 11596
1 11474
1 11417
1 11404
1 11354
1 11343
1 11279
1 11188
1 11130
1 111
1 11090
1 11067
1 10984
1 10973
1 10967
1 10947
1 10933
1 10912
1 109
1 10879
1 10835
1 10674
1 10532
1 10508
1 10448
1 10425
1 10421
1 10316
1 10271
1 10201
1 10139
1 10091
1 10030
1 10013
(coffee != sleep) & (!coffee == sleep)
Donald.Smith at qwest.com
________________________________________
This communication is the property of Qwest and may contain confidential or
privileged information. Unauthorized use of this communication is strictly
prohibited and may be unlawful. If you have received this communication
in error, please immediately notify the sender by reply e-mail and destroy
all copies of the communication and any attachments.
More information about the nsp-security
mailing list