Index of /publicDatasets/CTU-Malware-Capture-Botnet-123-1

	Name	Last modified	Size	Description
	Parent Directory		-
	bro/	2024-01-26 13:30	-
	README.md	2015-04-22 11:39	332
	README.html	2017-01-15 13:04	512
	2015-04-22_capture-win8.capinfos	2016-04-19 11:07	763
	2015-04-22_capture-win8.tcpdstat	2016-12-05 22:30	1.8K
	2015-04-22_capture-win8.passivedns	2016-04-19 11:07	2.1K
	2015-04-22_capture-win8.dnstop	2016-04-19 11:07	2.8K
	fast-flux-dga-first-analysis.txt	2017-01-15 13:04	4.5K
	2015-04-22_capture-win8.weblogng	2016-06-15 18:04	6.8K
	2015-04-22_capture-win8.binetflow	2016-12-05 22:30	8.4K
	2015-04-22_capture-win8.biargus	2016-12-05 22:30	16K
	2015-04-22_capture-win8.pcap	2015-04-22 09:21	1.1M
	2015-04-22_capture-win8.html	2015-04-22 11:39	1.2M
	2015-04-22_capture-win8.json	2015-04-22 11:39	1.8M
	2015-04-22_capture-win8.rrd	2015-04-22 09:29	8.0M

Timeline

• Infected by accessing: http://sansarall.ru/
• This link was found in the http code of the SPAM sent by win9 (e515267ba19417974a63b51e4f7dd9e9)

Mon Apr 20 14:31:32 CEST 2015

Start win8

Mon Apr 20 14:33:30 CEST 2015

Infected Did some connections and then nothing more.

Wed Apr 22 09:26:00 CEST 2015

poweroff