Timeline

• Probable name: Bunitu botnet (stripped)
• Binary extracted, shared and stripped by @hasherezade. This version is the original proxy code of the botnet.
• MD5: 5aeb4b21066217ea08f77ba9390f31b5
  
• SHA1: eafe116a5f97ad366fae48c8b22025b7dccd5e82
  

• SHA256: 002e9d6217b17923b69710792fd85765c41a0fc5406ce6e1dbee3cc2ad82eca6

• VirusTotal
• HybridAnalysis

• RobotHash

Wed Oct 7 09:31:34 CEST 2015

started win11

Wed Oct 7 09:34:38 CEST 2015

infected

Successfully connected

Fri Oct 22 06:50:00 CEST 2015 approx

The machine was stopped