FD: Wireshark Plugin for Mariposa Botnet

by scooba on Oct.29, 2009, under Uncategorized

Yamata Li from the Palo Alto Networks threat research team has developed a plugin for wireshark that allows you to view the obfuscated traffic generated by a Mariposa (Botnet) infected client.
This info was published on Full Disclosure today. The website mariposa-tool shows the detailed usage of this tool.

No comments for this entry yet...

Howdy. Welcome to spamversand!
Thanks for dropping by! Feel free to join the discussion by leaving comments, and stay updated by subscribing to the RSS feed. See ya around!
Recent Posts
Browse by tags
Add new tag

Categories
- botnet
- exploits
- Honeypots
- Spamtraps
- Uncategorized

Meta

Latest attacks on my honeypot:
status of the NetCologne Honeypot-systems Current time: September 8, 2010, 4:43 am

Current results of the NetCologne honeypot-systems:

Number of attacks in the last hour: 52
Current 10 most sent complaint addresses (last hour):

13 : abuse@proxad.net
5 : abuse@jump.ro
2 : abuse@zebra.lt
2 : abuse@tvalmansa.es
2 : security@verizon.net
2 : pmagill@opaltelecom.co.uk,pthexton@opaltelecom.co.uk
1 : ripe@powernet.bg
1 : abuse@starnet.md
1 : registry@netissat.bg
1 : abuse@poda.cz

Current 10 most sent complaint addresses (total):

249740 : abuse@proxad.net
77145 : abuse@jump.ro
75371 : radoslaw.zdunek@dialog.pl
69826 : abuse@zebra.lt
67024 : abuse@hansenet.com
48788 : abuse@kabelbw.com
35113 : pmagill@opaltelecom.co.uk,pthexton@opaltelecom.co.uk
30169 : abuse@t-online.hu
29735 : ripe@orange-ftgroup.com,joao.gomes@orange.co.uk
29591 : armands.valdmanis@verdi.lv,john@is.lv,janis.jansons@lattelekom.lv

latest 5 complaints sent:
abuse-addr Source-ip internal ID AS-Nr. date
lir@nts.su 92.243.102.15 1936819 31036 2010-09-08 04:43:13
abuse@jump.ro 89.45.29.123 1936809 34711 2010-09-08 04:39:33
abuse@proxad.net 78.243.223.114 1936806 12322 2010-09-08 04:38:13
registry@netissat.bg 213.130.82.81 1936805 35621 2010-09-08 04:38:01
abuse@zebra.lt 78.62.106.53 1936802 8764 2010-09-08 04:37:13

spamversand

FD: Wireshark Plugin for Mariposa Botnet

Leave a Reply

Howdy. Welcome to spamversand!

Recent Posts

Browse by tags

Categories

Meta

Current results of the NetCologne honeypot-systems:

Current 10 most sent complaint addresses (last hour):

Current 10 most sent complaint addresses (total):

latest 5 complaints sent:

Looking for something?

Visit our friends!

Archives

abuse-addr	Source-ip	internal ID	AS-Nr.	date
lir@nts.su	92.243.102.15	1936819	31036	2010-09-08 04:43:13
abuse@jump.ro	89.45.29.123	1936809	34711	2010-09-08 04:39:33
abuse@proxad.net	78.243.223.114	1936806	12322	2010-09-08 04:38:13
registry@netissat.bg	213.130.82.81	1936805	35621	2010-09-08 04:38:01
abuse@zebra.lt	78.62.106.53	1936802	8764	2010-09-08 04:37:13