Index of /publicDatasets/CTU-Malware-Capture-Botnet-151-1

	Name	Last modified	Size	Description
	Parent Directory		-
	bro/	2017-08-31 09:45	-
	files/	2018-04-26 15:50	-
	suricata/	2019-03-23 14:42	-
	tools/	2018-04-26 15:29	-
	2016-01-12-capture_win7.weblogng	2016-06-15 19:07	232
	README.md	2016-02-12 01:38	756
	2016-01-12-capture_win7.capinfos	2016-02-12 01:42	762
	README.html	2018-04-26 14:10	1.0K
	2016-01-12-capture_win7.tcpdstat	2016-09-03 16:54	1.7K
	2016-01-12-capture_win7.passivedns	2016-02-12 01:42	1.8K
	2016-01-12-capture_win7.dnstop	2016-02-12 01:42	2.7K
	fast-flux-dga-first-analysis.txt	2017-01-13 22:18	3.9K
	2016-01-12-capture_win7.binetflow	2016-12-05 22:26	128K
	2016-01-12-capture_win7.netflow5	2016-11-04 18:51	161K
	2016-01-12-capture_win7.biargus	2016-12-05 22:26	346K
	2016-01-12-capture_win7.html	2016-02-12 01:46	915K
	2016-01-12-capture_win7.pcap	2016-02-12 01:38	6.4M
	2016-01-12-capture_win7.rrd	2016-02-12 01:40	8.0M

Timeline

• Probable name: Gh0st RAT
• Downloadef from: http://englishniux.eatuo.com/toor.exe
• MD5: 38c7274b4d97ee02151294c36fc85423
• SHA1: 70952404a7726a908b6111b134619f7c41e95bc3
  

• SHA256: 441dd8a9a7931145604dbf596d76eb92bb04c15a3919cbb91e1c92c21c290e8e

• VirusTotal
• HybridAnalysis

• RobotHash

Mon Jan 25 19:55:23 CET 2016

Started win7

Mon Jan 25 20:01:14 CET 2016

Infected

Fri Feb 12 01:38:25 CET 2016

poweroff