Index of /publicDatasets/CTU-Malware-Capture-Botnet-129-1

	Name	Last modified	Size	Description
	Parent Directory		-
	fast-flux-dga-first-analysis.txt	2017-01-14 17:09	3.8K
	fa19abacc73cc09ae00ae234ed6189ed72db64b187664484637f139964cb58b9.exe.zip	2015-12-16 10:26	19K
	bro/	2017-08-31 09:45	-
	README.md	2015-07-07 21:25	559
	README.html	2017-01-14 17:09	746
	2015-06-30_capture-win20.weblogng	2016-06-15 19:06	792
	2015-06-30_capture-win20.tcpdstat	2016-12-05 22:29	1.9K
	2015-06-30_capture-win20.rrd	2015-07-07 15:16	8.0M
	2015-06-30_capture-win20.pcap	2015-07-07 15:07	2.3M
	2015-06-30_capture-win20.passivedns	2015-08-28 21:10	2.5K
	2015-06-30_capture-win20.json	2015-07-07 21:45	153K
	2015-06-30_capture-win20.html	2015-07-07 21:45	433K
	2015-06-30_capture-win20.dnstop	2015-08-28 21:10	2.4K
	2015-06-30_capture-win20.capinfos	2015-07-07 21:25	763
	2015-06-30_capture-win20.binetflow	2015-10-15 16:14	128K
	2015-06-30_capture-win20.biargus	2015-10-15 16:14	113K

Timeline

• Probably Upatre
• MD5: dce559be94540048148cd6a7dd742dee
• VirusTotal

Tue Jun 30 15:29:29 CEST 2015

started win20

Tue Jun 30 15:46:39 CEST 2015 infected

It was infected successfully and it connected to some TLS ports and non known ports.

For 7 days it did nothing more. We are not sure why not.

Tue Jul 7 15:11:49 CEST 2015

poweroff