Index of /publicDatasets/CTU-Malware-Capture-Botnet-152-1

	Name	Last modified	Size	Description
	Parent Directory		-
	2016-02-12-capture_win9.biargus	2016-07-11 17:14	1.1M
	2016-02-12-capture_win9.binetflow	2016-07-11 17:14	1.1M
	2016-02-12-capture_win9.capinfos	2016-02-12 02:11	763
	2016-02-12-capture_win9.dnstop	2016-02-12 02:11	3.0K
	2016-02-12-capture_win9.html	2016-02-12 02:13	686K
	2016-02-12-capture_win9.json	2016-02-12 02:13	182K
	2016-02-12-capture_win9.passivedns	2016-02-12 02:11	15K
	2016-02-12-capture_win9.pcap	2016-02-12 02:07	8.8M
	2016-02-12-capture_win9.rrd	2016-02-12 02:10	8.0M
	2016-02-12-capture_win9.tcpdstat	2016-09-03 16:54	1.7K
	2016-02-12-capture_win9.weblogng	2016-06-15 18:21	141K
	README.html	2017-01-13 22:18	1.2K
	README.md	2016-02-12 02:08	891
	a066f97be73f86b01ce60df2968adb631ad89e9e1e1380f6fecfabf898830cbf.exe.zip	2016-05-28 12:49	480K
	bro/	2017-08-31 09:45	-
	fast-flux-dga-first-analysis.txt	2017-01-13 22:18	6.7K

Description

• Probable Name: HW32.Packed?
• MD5: e23f78cd1367646b783ba5c6fc4a6459
• SHA1: 46867b88a7ca9555586d6e2339bb716b8596febc
  

• SHA256: a066f97be73f86b01ce60df2968adb631ad89e9e1e1380f6fecfabf898830cbf

• VirusTotal
• HybridAnalysis

• RobotHash

Timeline

Mon Jan 25 21:49:23 CET 2016

Started win9

Mon Jan 25 21:51:01 CET 2016

infected

On Tue Jan 26 13:20:00 CET 2016 approximately, the malware stop sending WEB requests.

Since it didn't recover, I will reboot it.

Tue Jan 26 19:56:51 CET 2016

Restart

Fri Feb 12 02:08:11 CET 2016

Poweroff