Index of /publicDatasets/CTU-Malware-Capture-Botnet-110-2

	Name	Last modified	Size	Description
	Parent Directory		-
	2014-03-09_capture-win9.json	2015-04-09 13:35	38M
	2014-03-09_capture-win9.html	2015-04-09 13:35	21M
	README.md	2015-06-12 14:32	476
	e515267ba19417974a63b51e4f7dd9e9.exe.zip	2015-12-16 10:26	39K
	2014-03-09_capture-win9.weblogng	2016-06-15 19:03	377K
	2014-03-09_capture-win9.dnstop	2016-12-06 08:09	17K
	2014-03-09_capture-win9.passivedns	2016-12-06 08:09	30K
	2014-03-09_capture-win9.capinfos	2016-12-06 08:09	1.1K
	2014-03-09_capture-win9.tcpdstat	2016-12-06 08:09	1.9K
	2014-03-09_capture-win9.biargus	2016-12-06 08:09	279K
	2014-03-09_capture-win9.binetflow	2016-12-06 08:09	114K
	fast-flux-dga-first-analysis.txt	2017-01-15 16:34	196
	2014-03-09_capture-win9.pcap	2017-04-25 09:39	24M
	bro/	2017-04-25 09:39	-
	README.html	2017-04-25 09:39	701

Timeline

• Infected with htbot
• MD5: e515267ba19417974a63b51e4f7dd9e9

Wed Mar 4 15:12:11 CET 2015

started win9

Wed Mar 4 15:14:18 CET 2015

infected

Correctly infected

Mon Mar 9 11:40:09 CET 2015

Some days ago win9 stop sending packets, so I'm rebooting it. Strangely, the vm was stopped!!!! So I have to start it again. Weird. Now we made a new pcap file.

It is still infected.

Mon Mar 9 15:06:07 CET 2015

The server froze. A new capture was started