Description

• Probable Name: Linux Botnet (Unknown)
• Script to infect: http://222.179.116.23:8080/theme/1/pys.py
• MD5: 0544317e48d4a773a3e4a6faa028ff1b
  
• SHA1: 6f08134e0f0dcd9e2c06529e89a4f6f20e1b6c3c
  
• SHA256: d201228c36cb9e93ec3bb1e37d932e8050c6b22b2c887500b521be81856760ca
  

• Zip Password: infected

• VirusTotal
• HybridAnalysis

• RobotHash

Timeline

Sun Mar 6 15:03:17 CET 2016

Started linux kali

Sun Mar 6 15:10:41 CET 2016

Infected

18 hours later the traffic stopped.