Index of /publicDatasets/CTU-Malware-Capture-Botnet-120-2

	Name	Last modified	Size	Description
	Parent Directory		-
	2015-06-07_capture-win4.pcap	2015-06-07 20:02	305M
	2015-06-07_capture-win4.rrd	2015-06-07 20:02	8.0M
	2015-06-07_capture-win4.json	2015-06-07 20:05	2.1K
	2015-06-07_capture-win4.html	2015-06-07 20:05	352K
	2015-06-07_capture-win4.biargus	2015-06-11 16:18	1.8M
	README.md	2015-06-15 15:47	691
	2015-06-07_capture-win4.capinfos	2015-06-15 15:48	764
	2015-06-07_capture-win4.binetflow	2015-09-17 17:06	1.6M
	d1e1acd259b5548c2f09906dc3efa7df.exe.zip	2015-12-16 10:26	11K
	mss3.exe.zip	2015-12-16 10:26	1.3M
	2015-06-07_capture-win4.weblogng	2016-06-15 18:05	418
	2015-06-07_capture-win4.dnstop	2016-12-06 08:07	1.8K
	2015-06-07_capture-win4.passivedns	2016-12-06 08:07	1.8K
	2015-06-07_capture-win4.tcpdstat	2016-12-06 08:07	1.8K
	fast-flux-dga-first-analysis.txt	2017-01-15 16:34	2.5K
	README.html	2017-01-15 16:34	962
	bro/	2017-08-31 09:45	-

Timeline

• njRat v 0.7
• Infected with the client generated from this version
• Client MD5 is d1e1acd259b5548c2f09906dc3efa7df
• Warning: This malware was connected to our server and NOT to a real njRat server on internet.
• RobotHash

Wed Apr 22 11:15:05 CEST 2015

started win4 already infected

Wed Apr 22 11:23:22 CEST 2015

It got connected to the server because I started the server

Wed Apr 29 09:49:11 CEST 2015

I stopped the njrat server and started it again. Because the traffic looks like something strange was happening. Now is working again.

Sun Jun 7 20:02:32 CEST 2015

poweroff