Index of /publicDatasets/CTU-Malware-Capture-Botnet-137-1

	Name	Last modified	Size	Description
	Parent Directory		-
	BAB0/	2015-10-04 13:36	-
	2015-10-04.win.biargus	2015-10-04 15:12	219K
	2015-10-04.win.binetflow	2015-10-04 15:12	234K
	2015-10-04.win.pcap	2015-10-04 16:03	54M
	2015-10-04.win.rrd	2015-10-04 16:03	8.0M
	2015-10-04.win.dnstop	2015-10-04 16:07	13K
	2015-10-04.win.passivedns	2015-10-04 16:07	21K
	2015-10-04.win.capinfos	2015-10-04 16:07	742
	2015-10-04.win.weblog	2015-10-04 16:07	2.0M
	2015-10-04.win.json	2015-10-04 16:26	122M
	2015-10-04.win.html	2015-10-04 16:26	57M
	README.md	2015-10-04 17:11	2.4K
	babo.exe.zip	2015-12-16 10:26	117K
	2015-10-04.win.tcpdstat	2016-12-05 22:29	2.0K
	2015-10-04.weblogng	2017-01-14 17:09	2.3M
	fast-flux-dga-first-analysis.txt	2017-01-14 17:09	38K
	README.html	2017-01-14 17:09	3.1K
	bro/	2017-08-31 09:45	-

Description

• Name: BAB0
  • It is a testing APT malware.
• Original test web page: bab0.zip
  • Md5: b692439b68ec49d6005dc0992ae4c329
    
• Downloaded file: babo.exe
  • MD5: 67883bdcf39bb375b37224f70e7f1c05
  • SHA1: c296ad7f51ccff453a11b726e3f4234f9fa09414
  • SHA256: d6161a92ddbd9764de9a7787d926adf7985dcb4a3cfde825f11d1bf6843382a0
• VirusTotal
• HybridAnalysis
• RobotHash

• Duration: 2 hs and 32 mins approx

In this capture, be careful to what you consider malicious traffic from the malware. All the traffic BEFORE the infection with the exe file is not generated by the downloaded malicious exe file. The traffic going to the following hosts is not malicious:

• Host: 147.32.80.7
• Host: 239.255.255.250:1900
• Host: crl.godaddy.com
• Host: crl.microsoft.com
• Host: crl.verisign.com
• Host: gtssl-ocsp.geotrust.com
• Host: ocsp.digicert.com
• Host: ocsp.geotrust.com
• Host: ocsp.godaddy.com
• Host: ocsp.verisign.com
• Host: r18---sn-25g7sm7k.gvt1.com
• Host: r1---sn-jxnoxu-2gbe.gvt1.com
• Host: r2---sn-5hn7su7e.gvt1.com
• Host: r2---sn-p5qlsu7z.gvt1.com
• Host: r3---sn-jxnoxu-2gbe.gvt1.com
• Host: redirector.gvt1.com
• Host: relay.felk.cvut.cz
• Host: rps-svcs.sun.com
• Host: sf.symcd.com
• Host: s.symcd.com
• Host: wpad
• Host: www.download.windowsupdate.com
• Host: www.gstatic.com

The malicious traffic starts on the tcpdump time 02:07:14.952174 to the domain crysys.hu

Timeline

Sun Oct 4 13:44:53 CEST 2015

started winnormal

Sun Oct 4 13:46:26 CEST 2015

started chrome browser It did a lot of communications to ports 443 both TCP and UDP of the IPs - 173.194.122.15 - 173.194.122.24 But these are normal

Sun Oct 4 13:51:28 CEST 2015

Access to the web site were the infected web page is infected https://mcfp.felk.cvut.cz/publicDatasets/BAB0/

Sun Oct 4 13:52:15 CEST 2015

Click on the bab0 image

Sun Oct 4 13:52:59 CEST 2015

It asked to save a binary file on disk. I agree to store it and then execute it. Binary MD5 is d92344249e2b9d340a8127b480d32574

Upon execution, it connected to crysys.hu forum which is the company C&C server.

Sun Oct 4 16:03:39 CEST 2015

poweroff