Description

• Probable name: Kazy
• This is a capture made in a home environment using two VirtualBox Windows
• Infected VMs:
  • First VM
    • Name: Tiny71
    • IP: 192.168.0.150
  • Second VM
    • Name: Tiny72
    • IP: 192.168.0.151
• MD5: 8df6603d7cbc2fd5862b14377582d46a
  
• SHA1: 816a5736e2809a403724bce17c3fc0e607719d5f
  
• SHA256: 936c0358df132965439ee9314f4ed59b3795f2a62dc4c588564bdfce969639a7
  
• Filename: 948549816.111111.exe
• VirusTotal
• HybridAnalysis
• RobotHash

Timeline

Fri May 25 19:02:19 ART 2012

Started the capture

Fri May 25 19:10:23 ART 2012

Started first VM Tiny71, 192.168.0.150

Fri May 25 19:12:31 ART 2012

Infect the first VM

Fri May 25 19:13:19 ART 2012

Started the second VM Tiny72

Fri May 25 19:16:43 ART 2012

Infected the second VM

Fri May 25 23:38:06 ART 2012

Power off both vms