Possible alternative is that a third party wrote the malware and decided to put an NSA/SAIC IP address in the code to scare people
For any given series of boring events, the most fantastical explanation that ties them all together must obviously be true.
http://www.teslasociety.com/tunguska.htm
ps: I don't care if it is correct, it is still an interesting read.
GET /05cea4de-951d-4037-bf8f-f69055b279bb HTTP/1.1
Don't you think if it was another party they would just have encoded the IP and/or MAC into the URL to of a GET from some scary IP instead of using a cookie to a resource that is actually there on listening on the server.