Index of /publicDatasets/CTU-Malware-Capture-Botnet-144-1

	Name	Last modified	Size	Description
	Parent Directory		-
	2015-10-23_win5.biargus	2016-12-05 22:28	49M
	2015-10-23_win5.binetflow	2016-12-05 22:28	24M
	2015-10-23_win5.capinfos	2015-10-23 12:14	758
	2015-10-23_win5.dnstop	2015-10-23 12:11	18K
	2015-10-23_win5.html	2015-10-23 13:02	38M
	2015-10-23_win5.json	2015-10-23 13:02	64M
	2015-10-23_win5.passivedns	2015-10-23 12:11	428K
	2015-10-23_win5.pcap	2015-10-23 12:10	283M
	2015-10-23_win5.rrd	2015-10-23 12:10	8.0M
	2015-10-23_win5.tcpdstat	2016-12-05 22:28	2.3K
	2015-10-23_win5.weblogng	2016-06-15 17:41	13M
	README.html	2017-01-14 17:01	1.8K
	README.md	2015-10-23 12:11	1.2K
	bro/	2017-08-31 09:45	-
	fast-flux-dga-first-analysis.txt	2017-01-14 17:01	95K
	uTorrent.exe.zip	2015-12-16 10:26	1.7M

Description

• For sure real name: uTorrent
• A normal capture of the download and execution the utorrent program from www.utorrent.com
• MD5: 14ee6c0e28d6e407db35f7b12e3fac03
  
• SHA1: 9ad3ff714d627fff64a4a0ae28dd0873b41fd67a
  
• SHA256: 64d7da86d5fee292b2186c3f6ce59c88ed42725427c48a7d3384e4e5679b20b3
  
• VirusTotal
• HybridAnalysis
• RobotHash

Timeline

Wed Sep 23 17:56:41 CEST 2015

started win5

Wed Sep 23 17:57:56 CEST 2015

google.com

Wed Sep 23 17:58:21 CEST 2015

search for "utorrent"

Wed Sep 23 17:59:06 CEST 2015

access www.utorrent.com

Wed Sep 23 17:59:38 CEST 2015

download utorrent for windows

Wed Sep 23 18:01:29 CEST 2015

Executed the file utorrent.exe

Wed Sep 23 18:04:02 CEST 2015

Continue with the install, clicking all yes.

It opened the utorrent program I can see requests in the traffic to api.opencandy.com!

Thu Oct 22 18:50:00 CEST 2015 approx

Vm was stopped