Index of /publicDatasets/CTU-Malware-Capture-Botnet-122-1

	Name	Last modified	Size	Description
	Parent Directory		-
	7cd95f1500289d4ba938169610060de0.exe.zip	2015-12-16 10:26	165K
	2015-04-22_capture-win6.biargus	2016-05-29 13:40	3.0M
	2015-04-22_capture-win6.binetflow	2016-05-29 13:40	1.3M
	2015-04-22_capture-win6.capinfos	2016-05-29 13:36	761
	2015-04-22_capture-win6.dnstop	2016-05-29 13:36	1.6K
	2015-04-22_capture-win6.html	2015-04-22 11:32	506K
	2015-04-22_capture-win6.json	2015-04-22 11:32	329K
	2015-04-22_capture-win6.passivedns	2016-05-29 13:36	1.3K
	2015-04-22_capture-win6.pcap	2015-04-22 09:23	5.0M
	2015-04-22_capture-win6.rrd	2015-04-22 09:29	8.0M
	2015-04-22_capture-win6.tcpdstat	2016-12-05 22:30	1.7K
	2015-04-22_capture-win6.weblogng	2016-06-15 19:07	2.5K
	README.html	2017-01-15 13:04	1.2K
	README.md	2016-05-29 13:47	926
	bro/	2017-08-31 09:45	-
	fast-flux-dga-first-analysis.txt	2017-01-15 13:04	1.6K

Description

• Probable Name: Geodo
• MD5: 7cd95f1500289d4ba938169610060de0
• SHA1: 593c9024c87508392ec07ffe33821c2dc876c17c
  
• SHA256: 299a7f138b03d5cc958584885048e03b2756b4dc70870507811ed2df26c1c8c5
  
• Zip password: infected

• IP of infected host: 10.0.2.106

• VirusTotal
• HybridAnalysis

• RobotHash

Timeline

Wed Apr 15 14:34:25 CEST 2015

started win6

Wed Apr 15 14:35:14 CEST 2015

Perfectly infected (there was some fake error on adobe not reading something). Contacted ips on port 8080. so far non answering

At some point it start answering

Wed Apr 22 09:25:43 CEST 2015

poweroff