Index of /publicDatasets/CTU-Malware-Capture-Botnet-36

	Name	Last modified	Size	Description
	Parent Directory		-
	capture-win2.weblogng	2016-06-15 17:43	1.1M
	capture-win2.pcap	2014-01-31 17:38	347M
	capture-win2.passivedns	2014-09-17 15:03	68K
	capture-win2.dnstop	2015-08-28 21:47	18K
	capture-win2.biargus	2014-01-21 12:28	16M
	bro/	2017-08-31 09:45	-
	b42b0ba6257f247fcedfaf9f89437615.exe.zip	2015-12-16 10:26	101K
	Win2-test.rrd	2014-01-31 17:38	181K
	README.md	2015-08-28 21:55	793
	README.html	2015-08-28 22:19	1.0K

Timeline

• Duration: 17.32 days
• MD5: b42b0ba6257f247fcedfaf9f89437615
• SHA256: d3d13c5c7bc0e8707a699e25190a24c845b5057066309e2c1e0e9b0943fced98
• SHA1: 2fdd370a5864f840897bb8afb63dcea87773685d
• Probable name: Hicrazyk.A
• VirusTotal

Tue Jan 14 09:48:22 CET 2014

started

Tue Jan 14 09:52:17 CET 2014

infected

Accessing the C&C channel http://i1.ajk123.com/GetVersion.html , we get [def]E126F519FD54EC6F9266B29380869EBC9AA1A077926CF41BF4050B0407025FB45DA6[def] [setup]A562B95DB99FA1A379C69B8F8D94AAAF96A863A17BC655C94AC55DBF53ED39DE38[setup] [inst]5CA8729572C080DC320859C940C797BA99AB60BC5EE13AEC1518EB28FB46C145C6[inst]

Sat Feb 1 0?:52:17 CET 2014

stopped win2