Index of /publicDatasets/CTU-Malware-Capture-Botnet-128-2

[ICO]NameLast modifiedSizeDescription

[PARENTDIR]Parent Directory  -  
[   ]2015-06-19_capture-win12.biargus2015-06-19 09:28 8.6M 
[   ]2015-06-19_capture-win12.binetflow2015-09-17 17:14 7.7M 
[   ]2015-06-19_capture-win12.capinfos2015-06-19 09:26 766  
[   ]2015-06-19_capture-win12.dnstop2016-12-06 08:07 2.0K 
[TXT]2015-06-19_capture-win12.html2015-06-19 10:06 7.0M 
[   ]2015-06-19_capture-win12.json2015-06-19 10:06 6.2M 
[   ]2015-06-19_capture-win12.passivedns2016-12-06 08:07 5.6K 
[   ]2015-06-19_capture-win12.pcap2015-06-18 19:13 1.1G 
[   ]2015-06-19_capture-win12.rrd2015-06-19 09:22 8.0M 
[   ]2015-06-19_capture-win12.tcpdstat2016-12-06 08:07 1.8K 
[   ]2015-06-19_capture-win12.uniargus2016-12-06 08:07 16M 
[   ]2015-06-19_capture-win12.uninetflow2016-12-06 08:07 6.2M 
[   ]2015-06-19_capture-win12.weblogng2016-06-15 17:43 15M 
[TXT]README.html2017-01-15 16:34 1.5K 
[TXT]README.md2015-06-19 11:54 1.1K 
[DIR]bro/2017-08-31 09:45 -  
[TXT]fast-flux-dga-first-analysis.txt2017-01-15 16:34 3.4K 

Timeline

Tue Jun 9 11:09:27 CEST 2015

started already infected

Fri Jun 11 15:00:00 CEST 2015 (approx)

The bot stop sending packets from the malware. There are only packets from the windows.... Don't know what happened. The vm is running perfectly, and there were no errors.

Fri Jun 12 10:00:32 CEST 2015

To see what happens I restarted the Windows (not the vm).

Fri Jun 12 10:03:24 CEST 2015

The bot started again to do stuff with the Microsoft domain, so it was infected. I wonder what happened.

Tue Jun 14 ~12:00 CEST 2015

The bot stop sending packests again. We figure it out that the malware works for 2 days and then stops.

Tue Jun 16 13:37:14 CEST 2015

We are restarting it again and keeping the same pcap

Fri Jun 19 09:23:04 CEST 2015

poweroff