SGNET Query Results

Query summary

Selected options: date, avsig

Grouped options: avsig, path

Rate threshold: 1

---

SELECT count(distinct(injection_attack.injection_id)) AS nbs, vt_report_result.signature AS Signature, path.name AS Path FROM source,tiny_session,injection_attack,vt_report_result,scriptgen_session,path WHERE source.source_id=tiny_session.source_id AND tiny_session.tiny_session_id=injection_attack.tiny_session_id AND tiny_session.begin_at>to_date('1-MAR-8') AND tiny_session.begin_at<to_date('31-MAR-8') AND injection_attack.md5=vt_report_result.md5 AND vt_report_result.antivirus='Symantec' AND scriptgen_session.tiny_session_id=tiny_session.tiny_session_id AND scriptgen_session.path_id=path.path_id GROUP BY vt_report_result.signature, path.name ORDER BY vt_report_result.signature, count(distinct(injection_attack.injection_id)) DESC

found [Backdoor.Graybird!Gen]

Path	Number of code injections
win2krich:135T:473:21	4
Others

found [Backdoor.Trojan]

Path	Number of code injections
win2krich:135T:473:21	11
win2krich:139T:965:111211	111
win2krich:139T:458:12111	105
win2krich:139T:1069:11211	72
win2krich:139T:964:1121	39
win2krich:445T:966:3111	14
win2krich:445T:152:121	13
win2krich:445T:472:111	13
win2krich:139T:435:1211	4
win2krich:139T:437:1	3
win2krich:135T:1070:311	2
win2krich:135T:1050:16	2
win2krich:135T:380:11	2
win2krich:139T:459:1112	1
Others

found [Trojan Horse]

Path	Number of code injections
win2krich:135T:473:21	4
win2krich:139T:965:111211	27
win2krich:139T:458:12111	25
win2krich:139T:1069:11211	17
win2krich:139T:964:1121	10
win2krich:445T:966:3111	1
win2krich:445T:152:121	1
win2krich:445T:472:111	1
win2krich:139T:435:1211	2
Others	1

found [W32.IRCBot.Gen]

Path	Number of code injections
win2krich:135T:473:21	1
win2krich:135T:1070:311	1
win2krich:135T:1050:16	1
Others

found [W32.IRCbot]

Path	Number of code injections
win2krich:135T:473:21	43
win2krich:139T:965:111211	4
win2krich:139T:458:12111	2
win2krich:139T:1069:11211	2
win2krich:139T:964:1121	2
win2krich:139T:435:1211	1
win2krich:135T:1070:311	2
win2krich:135T:380:11	1
win2krich:135T:341:13	3
Others	3

found [W32.Pinfi]

Path	Number of code injections
win2krich:135T:473:21	2
Others

found [W32.Rahack.H]

Path	Number of code injections
win2krich:135T:473:21	4
win2krich:139T:965:111211	124
win2krich:139T:458:12111	120
win2krich:139T:1069:11211	81
win2krich:139T:964:1121	43
win2krich:445T:966:3111	8
win2krich:445T:152:121	9
win2krich:445T:472:111	12
win2krich:139T:435:1211	2
win2krich:139T:437:1	3
win2krich:135T:1070:311	1
win2krich:135T:1050:16	1
win2krich:139T:438:11	4
win2krich:139T:455:111	2
Others	3

found [W32.Rahack.W]

Path	Number of code injections
win2krich:135T:473:21	3
win2krich:139T:965:111211	123
win2krich:139T:458:12111	121
win2krich:139T:1069:11211	74
win2krich:139T:964:1121	49
win2krich:445T:966:3111	8
win2krich:445T:152:121	11
win2krich:445T:472:111	9
win2krich:139T:435:1211	1
win2krich:139T:437:1	1
win2krich:135T:1070:311	2
win2krich:135T:1050:16	2
win2krich:135T:380:11	3
win2krich:139T:438:11	1
win2krich:139T:459:1112	2
Others	1

found [W32.Spybot.Worm]

Path	Number of code injections
win2krich:135T:473:21	24
Others

found [W32.Virut.B]

Path	Number of code injections
win2krich:135T:473:21	4
Others

found [W32.Virut.U]

Path	Number of code injections
win2krich:135T:473:21	1
Others

found nothing

Path	Number of code injections
win2krich:135T:473:21	24
win2krich:139T:965:111211	16
win2krich:139T:458:12111	16
win2krich:139T:1069:11211	11
win2krich:139T:964:1121	5
win2krich:445T:966:3111	2
win2krich:445T:152:121	3
win2krich:445T:472:111	2
win2krich:139T:455:111	1
Others	1