Index of /publicDatasets/CTU-Malware-Capture-Botnet-161-1

	Name	Last modified	Size	Description
	Parent Directory		-
	090606f10673b06e86070dfe97a085daeb03dae406021cb42387b19c063d119b.exe.zip	2016-05-01 18:04	149K
	2015-12-09_capture-win5.biargus	2016-12-05 22:25	19K
	2015-12-09_capture-win5.binetflow	2016-12-05 22:25	12K
	2015-12-09_capture-win5.capinfos	2016-05-01 18:04	761
	2015-12-09_capture-win5.dnstop	2016-05-01 18:04	2.2K
	2015-12-09_capture-win5.html	2016-07-01 20:12	356K
	2015-12-09_capture-win5.json	2016-07-01 20:12	4.2K
	2015-12-09_capture-win5.passivedns	2016-05-01 18:04	1.9K
	2015-12-09_capture-win5.pcap	2015-12-09 12:42	903K
	2015-12-09_capture-win5.rrd	2016-01-06 09:27	8.0M
	2015-12-09_capture-win5.tcpdstat	2016-09-03 16:52	1.7K
	2015-12-09_capture-win5.weblogng	2016-06-15 18:04	779
	README.html	2017-01-13 22:08	1.2K
	README.md	2016-05-01 18:04	866
	bro/	2017-08-31 09:45	-
	fast-flux-dga-first-analysis.txt	2017-01-13 22:08	3.8K

Description

• Probable Name: Trojan Backdoor Artemis? MSIL?
• MD5: 9a6e37a8a1a18798226060f860cd7902
  
• SHA1: d463c1c8f407da8250e589a7c6706ee759cf8be6
  
• SHA256: 090606f10673b06e86070dfe97a085daeb03dae406021cb42387b19c063d119b
  

• zip password: infected

• VirusTotal
• HybridAnalysis

• RobotHash

Timeline

Sat Dec 5 12:56:03 CET 2015

started win5

Sat Dec 5 12:57:24 CET 2015

Uninstalled virtualbox guess additions

Sat Dec 5 12:59:38 CET 2015

Infected Comunicates with south africa host.

Dec 9 12:59:38 CET 2015

poweroff