Index of /publicDatasets/CTU-Malware-Capture-Botnet-122-1

	Name	Last modified	Size	Description
	Parent Directory		-
	fast-flux-dga-first-analysis.txt	2017-01-15 13:04	1.6K
	bro/	2017-08-31 09:45	-
	README.md	2016-05-29 13:47	926
	README.html	2017-01-15 13:04	1.2K
	2015-04-22_capture-win6.weblogng	2016-06-15 19:07	2.5K
	2015-04-22_capture-win6.tcpdstat	2016-12-05 22:30	1.7K
	2015-04-22_capture-win6.rrd	2015-04-22 09:29	8.0M
	2015-04-22_capture-win6.pcap	2015-04-22 09:23	5.0M
	2015-04-22_capture-win6.passivedns	2016-05-29 13:36	1.3K
	2015-04-22_capture-win6.json	2015-04-22 11:32	329K
	2015-04-22_capture-win6.html	2015-04-22 11:32	506K
	2015-04-22_capture-win6.dnstop	2016-05-29 13:36	1.6K
	2015-04-22_capture-win6.capinfos	2016-05-29 13:36	761
	2015-04-22_capture-win6.binetflow	2016-05-29 13:40	1.3M
	2015-04-22_capture-win6.biargus	2016-05-29 13:40	3.0M
	7cd95f1500289d4ba938169610060de0.exe.zip	2015-12-16 10:26	165K

Description

• Probable Name: Geodo
• MD5: 7cd95f1500289d4ba938169610060de0
• SHA1: 593c9024c87508392ec07ffe33821c2dc876c17c
  
• SHA256: 299a7f138b03d5cc958584885048e03b2756b4dc70870507811ed2df26c1c8c5
  
• Zip password: infected

• IP of infected host: 10.0.2.106

• VirusTotal
• HybridAnalysis

• RobotHash

Timeline

Wed Apr 15 14:34:25 CEST 2015

started win6

Wed Apr 15 14:35:14 CEST 2015

Perfectly infected (there was some fake error on adobe not reading something). Contacted ips on port 8080. so far non answering

At some point it start answering

Wed Apr 22 09:25:43 CEST 2015

poweroff