Index of /publicDatasets/CTU-Malware-Capture-Botnet-118-1

	Name	Last modified	Size	Description
	Parent Directory		-
	fast-flux-dga-first-analysis.txt	2017-01-15 13:04	5.8K
	bro/	2017-08-31 09:45	-
	README.md	2016-05-28 12:45	835
	README.html	2017-01-15 13:04	1.1K
	6093329dbda17782bb8dc31cf223a188.exe.zip	2015-12-16 10:26	15K
	2015-04-20_capture-win5.weblogng	2016-06-15 17:53	1.2K
	2015-04-20_capture-win5.tcpdstat	2016-12-05 22:30	1.8K
	2015-04-20_capture-win5.rrd	2015-04-20 11:32	8.0M
	2015-04-20_capture-win5.pcap	2015-04-20 11:29	2.1M
	2015-04-20_capture-win5.passivedns	2016-05-28 12:43	2.0K
	2015-04-20_capture-win5.json	2015-04-20 11:33	1.5M
	2015-04-20_capture-win5.html	2015-04-20 11:33	1.0M
	2015-04-20_capture-win5.dnstop	2016-05-28 12:43	3.0K
	2015-04-20_capture-win5.capinfos	2016-05-28 12:43	762
	2015-04-20_capture-win5.binetflow	2015-09-17 16:22	124K
	2015-04-20_capture-win5.biargus	2015-04-20 11:43	109K

Description

• Probable name: Trojan Upatre
• MD5: 6093329dbda17782bb8dc31cf223a188
• SHA1: c53fae731bacd41c4cef008fa700723f1bd228b6

• SHA256: a4bf3abaca49ac63c0b5849cd0bc2fed5a1ae63d6bb8205a76a8d8ebe5d3fd6d

• VirusTotal
• HybridAnalysis

• RobotHash

Timeline

Mon Apr 13 13:45:48 CEST 2015

start win5

Mon Apr 13 13:47:27 CEST 2015

infected with 6093329dbda17782bb8dc31cf223a188.exe

It worked perfectly.

After the first downloades it did nothing else

Mon Apr 20 11:29:35 CEST 2015

Power off win 5