Report - CrySyS Lab

Table stat_TV_log has essentially the same content. Most of the Russian IP addresses seem to
located in Ingushethia (e.g., 212.94.14.XXX from ingushsvyaz network). Note, that this map was
created by the IP addresses only, so it is possible that some victims with dynamic IP addresses are
shown multiple times.
While stat_TV table is the most interesting, as “TV” refers to the TeamViewer campaign, the victim IP
information stored in different tables among different C&C servers are also revealing.
Here, we show distribution of IP addresses on heat maps for each information source. One can
clearly see how different campaigns focus on different geographic regions.
Figure 20 – Distribution of IP address used to upload files into the bannetwork.org FTP server,
2010-02-01 – 2013-02-25
16