Description

• Probable Name: Kazy
• MD5: 9a2f8cbc8b1e583391a7c056efc76f1b
  
• SHA1: 88d7a4f46b834e2dbcc7f2a8583f91dee8149db4
  
• SHA256: 79acc1b8aaac2d3837e2f16e7a58ed658dbeb8802b6a32db85c0644ccc9039fa
  
• Zip password: infected

• IP of infected machine: 10.0.2.106

• VirusTotal
• HybridAnalysis

• RobotHash

Timeline

Mon May 30 13:47:37 CEST 2016

started win 6

Mon May 30 13:51:38 CEST 2016

infected succesful

At 04:11:46.102078 (capture time) there was no more connections to the CC. I will try to reboot it.

Mon May 30 16:58:48 CEST 2016

restarted, keep the same pcap

The malware is running again.

mon May 30 20:25:07 CEST 2016

restarted because it was not sending

Fri Jun 3 14:13:43 CEST 2016

Poweroff because it stop sending again and it did not recover.