Rozena/Ramnit Malware Backdoor Traffic Analysis PCAP file download Sample 176.9.99.134.443

SHA256: 2fc93e30f8823f82a598cfcb4997bfc897d0d7d30e49d329dcb4338a73a86771
File name: 1111.exe
Detection ratio: 36 / 61
Analysis date: 2017-05-21 21:07:01 UTC ( 0 minutes ago )
ESET-NOD32 Win32/Rozena.PP 20170521
F-Secure Trojan.GenericKD.5100665 20170521
Fortinet W32/Rozena.PP!tr 20170521
GData Trojan.GenericKD.5100665 20170521
Invincea virus.win32.ramnit.j 20170519
K7GW Trojan ( 004d3c641 ) 20170521
Kaspersky Trojan.Win32.Yakes.thje 20170521
Malwarebytes Backdoor.Bot 20170521
McAfee RDN/Generic.dx 20170521
McAfee-GW-Edition BehavesLike.Win32.Ransom.dh 20170521
eScan Trojan.GenericKD.5100665 20170521
Rising Trojan.Rozena!8.6D (cloud:syeYjLJw0hG) 20170518

 

2017-05-21 15:53:58.721512 IP 192.168.1.102.55365 > 178.20.153.65.80: Flags [P.], seq 0:396, ack 1, win 256, length 396: HTTP: GET /1111.exe HTTP/1.1
E….*@……..f…A.E.P…Z.;..P…1…GET /1111.exe HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, */*
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)
Accept-Encoding: gzip, deflate
Host: sa-turn.com.ua
Connection: Keep-Alive

2017-05-21 15:54:12.656746 IP 192.168.1.102.55366 > 176.9.99.134.443: Flags [S], seq 1219284507, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
E..4,.@……..f.       c..F..H……… ……………..
2017-05-21 15:54:12.774548 IP 192.168.1.102.55366 > 176.9.99.134.443: Flags [.], ack 1661757760, win 256, length 0
E..(,.@……..f.       c..F..H…c.i@P………….
2017-05-21 15:54:12.790360 IP 192.168.1.102.55366 > 176.9.99.134.443: Flags [P.], seq 0:104, ack 1, win 256, length 104
E…,.@….?…f.       c..F..H…c.i@P………..c…_..Y!..#…….v.._….e…6~………./.5…
…..   .
.2.8…………………..
…………..
2017-05-21 15:54:12.907617 IP 192.168.1.102.55366 > 176.9.99.134.443: Flags [P.], seq 104:430, ack 908, win 253, length 326
E..n,.@….`…f.       c..F..H…c.l.P………………/.4….>G)\.W+…8t………..P=.Y.    ………..7….WD.>.TJ.<.W..!…9`?h…….@..c<4.`.C.k.1s….^..a..]………yN….s….3.Fv.^….J..i…..=.l.8.
.Trf….5$..+~”!$..ANx…..8″>…B.&.kj.G..X.~……w…..TotkG……|I..,….#:…S40..E.{.r<.S_;…;}…………0.]……..Ex&|…v……Fc”1B…6x……=V..}.|.
2017-05-21 15:54:13.091714 IP 192.168.1.102.55366 > 176.9.99.134.443: Flags [.], ack 914, win 253, length 0
E..(,.@……..f.       c..F..H…c.l.P………….
2017-05-21 15:54:13.254552 IP 192.168.1.102.55366 > 176.9.99.134.443: Flags [.], ack 967, win 252, length 0
E..(,.@……..f.       c..F..H…c.m.P………….
2017-05-21 15:54:13.273997 IP 192.168.1.102.55366 > 176.9.99.134.443: Flags [P.], seq 430:627, ack 967, win 252, length 197
E…,.@……..f.       c..F..H…c.m.P…b……….y…j…}2…..\;O!..l.M…………..n.”.wX. “.E.<..a+..q 0t……….D..>..z.aP….N..Q*…j<T…-..Y….>..G8q…..$\.2….O…..RA..6P….9….8…..TIS.{“……..B…..y…’..e.e..]T.I.
2017-05-21 15:54:13.381337 IP 192.168.1.102.55366 > 176.9.99.134.443: Flags [.], ack 2576, win 256, length 0
E..(,.@……..f.       c..F..H…c.sOP………….
2017-05-21 15:54:13.382188 IP 192.168.1.102.55366 > 176.9.99.134.443: Flags [.], ack 5496, win 256, length 0
E..(,.@……..f.       c..F..H…c.~.P….5……..