NAME ==== Sasser.C + WORM_SASSER.U (TrendMicro) + W32.Sasser.C.Worm (Symantec) EXPERIMENTAL TYPE ================= Retrieval Behavior - includes retrieval packets only. EXPERIMENTAL ENVIRONMENT ======================== 131.113.1.1 131.113.1.2 +-----------+ +-----+-----+ | Infected | | Targeted | | PC | | PC | | (*1)(*2) | | | +-----+-----+ +-----+-----+ | | ------+----------------------------+------ 131.113.1.0/31 (*1) Windows XP on VMware (*2) Default Route = 131.113.1.2 PCAP SUMMARY ============ Total: 24974 START: 1 0.000000 ----------------- 445/TCP;: 8615 1 0.000000 131.113.1.1 39.83.237.64 TCP 1039 > 445 [SYN] Seq=0 Ack=0 Win=16384 Len=0 MSS=1460