Description

• Probable Name: Trojan.Rasftuby?
• MD5: 48616dd47e12e369feef53a57830158a
  
• SHA1: e411689b8c9192b421b9864087f8b7bf91491465
  
• SHA256: eb57bcc950cdbfe87743a6335a19aeced27cd9b800da01cd5cf899c7881d6af6
  
• Password of zip file: infected
• Duration:

• Capture generated with a transparent mitmproxy

• VirusTotal
• HybridAnalysis

• RobotHash

Files

• .capinfos
  • Capinfos file
• .dnstop
  • DNS top file
• .mitm
  • Mitm proxy interception file of http and https
• .passivedns
  • Passive DNS file
• .pcap
  • Original pcap file
• .rrd
  • RRD file for graphs
• .weblogng
  • WEB log of http traffic
• .exe.zip
  • Original malware file
• bro
  • Folder with all the bro output files
• .biargus
  • Argus binary file with all the flows
• .binetflow
  • Argus text file with bidirectional flows. Report time 3600 secs.

IP Addresses

- Infected host: 192.168.1.112
- Default GW: 192.168.1.2

Timeline

Fri Sep 9 10:12:47 CEST 2016

started win2

Fri Sep 9 10:13:50 CEST 2016

infected

Clicked on the Finish button

I think it had some issues with the mitmproxy, maybe some of the connections were not SSL?

Some of the packets were like this: 1970/01/01 01:02:05.190926,1.811655,tcp,192.168.1.112,49201, ->,76.72.165.63,80,FSRPA_FSPA,0,0,15,1267,575,s[185]=HTTP/1.1 005..VERSION: 4.0..PLATFORM: 10..IPADDRESS: 192.168.1.112....HTTP/1.1 051..VER: 7.1.0.0..OBJ: 1..FUNC: 1..NAME: WIN1..ACC: dgardonio@mail.com..SRV: 76.72.165.63..PRODUCT: 0....,d[224]=HTTP/1.1 005..VERSION: 4.0..PLATFORM: 9..IPADDRESS: 76.72.165.63....HTTP/1.1 052..SERVER_NUM: 0..PROXY_IP: 76.72.165.119..PORT: 443..NEXTTIME: 12....HTTP/1.1 003..ERRORLOCATION: TacsCustomProtocol.ReceiveAndProcessData:1....,,s[185]=HTTP/1.1 005..VERSION: 4.0..PLATFORM: 10..IPADDRESS: 192.168.1.112....HTTP/1.1 051..VER: 7.1.0.0..OBJ: 1..FUNC: 1..NAME: WIN1..ACC: dgardonio@mail.com..SRV: 76.72.165.63..PRODUCT: 0....,d[224]=HTTP/1.1 005..VERSION: 4.0..PLATFORM: 9..IPADDRESS: 76.72.165.63....HTTP/1.1 052..SERVER_NUM: 0..PROXY_IP: 76.72.165.119..PORT: 443..NEXTTIME: 12....HTTP/1.1 003..ERRORLOCATION: TacsCustomProtocol.ReceiveAndProcessDa

Fri Sep 9 10:58:29 CEST 2016

power off