#pirpi

Exploit delivery as seen on http://www.symantec.com/connect/blogs/new-ie-zero-day-used-targeted-attacks

if (os=="WINXP" && ie=="IE7") window.location = '<URL>; else if (os=="WINXP" && ie=="IE6") window.location = '<URL>'; else window.location = '<URL>';</script>

Exploit as seen on http://www.symantec.com/connect/blogs/new-ie-zero-day-used-targeted-attacks

if (os=="WINXP" && ie=="IE7") window.location = '<URL>; else if (os=="WINXP" && ie=="IE6") window.location = '<URL>'; else window.location = '<URL>';</script>

There was an outbound traffic produced on port 443:

There was an outbound traffic produced on port 21:

There was an outbound traffic produced on port 22:

There was an outbound traffic produced on port 23:

There was an outbound traffic produced on port 1433:

There was an outbound traffic produced on port 110:

There was an outbound traffic produced on port 42:

There was an outbound traffic produced on port 389:

http://69[.]60.106.176/pic/HtE52RxxCtEDAAAAFB_mDVnQUazKSrfNUVvSW7y5HnyA.gif

http://69[.]60.106.176/pic/EduS57PqBduEAAAAGRLzAFF3XqJHRb3AXFN5VnISE7IA.gif

http://69[.]60.106.176/picture/CAiICmcBHAiFAAAAAm9dGajHRV73XEr0RabFTQ6ICA6A.gif

http://69[.]60.106.176/binary/75-F-3w72GAAAAz5uRxLsniwwhghkiiL-pk_x-_luA.bmp

http://69[.]60.106.176/image/i9GoM1HzlpEHAAAA63YWLaqQyqtRlM0NwmAA.rar

http://69[.]60.106.176/binary/1aVkRWs60aUIAAAARRo2SAAA.gif

http://69[.]60.106.176/picture/-bTwVPdl_VQJAAAA4N1T81s0lmAA.gif

http://69[.]60.106.176/pic/7W0FZe1i6cYKAAAAKsbp-w3h86AA.jpg

http://69[.]60.106.176/picture/uHP62-OIvXMLAAAAlxHZWKMA.gif

http://69[.]60.106.176/news/OmExAT8RPAEMAAAA1_Kr4-1ckAAA.gif

http://69[.]60.106.176/binary/Y6v8DcGRZ6uNAAAApdpU-mAA.jpg

http://69[.]60.106.176/images/lRkzGxwMkRiOAAAAHXBTPQAA.gif

http://69[.]60.106.176/pic/3pBtMHTS49APAAAA-v5S2t8TQhOqW7nF-mAA.rar

http://69[.]60.106.176/images/6roDXICz7VmQAAAADmsOi2cU.rar

http://69[.]60.106.176/picture/fskd0wT4gWiRAAAA4l1LBDPXJ_rGqH8xaHaA.gif

http://69[.]60.106.176/image/qd9S4NPond6SAAAAs3IzmJG3duKH7f4AdJO5bzLSqjIA.gif

http://69[.]60.106.176/pic/-AXuB5cPxAUTAAAAy_6Xwhktj08jhLsgjhcrl59u-P6A.jpg

http://69[.]60.106.176/images/HnM5EnwZCnMUAAAAFB_mDVnQUazKSrfNUVvSW7y5HnyA.jpg

http://www[.]grayflag.net/images/-cpw1PlcxcmDAAAAz_eVwLcrjwglhh-ejLktl_hw-leA.bmp

http://www[.]grayflag.net/pic/xXdj44pp-XaEAAAAuOqC_ww8eLsuk08_ewo6gOtjx4qA.gif

http://www[.]grayflag.net/picture/u618BkOMz6YFAAAAx-INyKGjhxKtjg4mhKOlf-L8ukIA.gif

http://www[.]grayflag.net/picture/rRPVEzSZmRMGAAAAsNUwnv00cIWA6ZCHcvSYaNXVr3UA.gif

http://www[.]grayflag.net/image/9CsMLY-7dSqHAAAAo4fkoMAUNoDqfescsaQovPQA.gif

http://www[.]grayflag.net/picture/69gCOeGh89eIAAAAYzwFIwzjhUaA.gif

http://www[.]grayflag.net/bbs/3U3rRt1i4a2JAAAAcCCpFf9eI19GCorpDGJx.bmp

http://www[.]grayflag.net/news/0rRhVG8QYbQKAAAATiU6Ehi_zY2Z.gif

http://www[.]grayflag.net/pic/YGF6YWO-1GELAAAAG8M4dEJ2dO1XS6_T.gif

http://www[.]grayflag.net/pic/UsvT1bCpVWuMAAAAVG7Q5tJs.gif

http://www[.]grayflag.net/picture/SXjJ4qgEQHiNAAAA02Po9xSNamv7.rar

http://www[.]grayflag.net/bbs/Om6xCD9INQ6OAAAARDuOicb8NlJBX0FywBuA.jpg

Intrigued with news of cyberattacks. I've been researching to find similarities in malware strains that others refer to as Advanced Persistent Threats or APTs.

These two names (sykipot and pirpi) will quickly lead one on a hunt for simple details in online AV analysis sites and news of targeted malware.