Index of /publicDatasets/CTU-Malware-Capture-Botnet-140-1

	Name	Last modified	Size	Description
	Parent Directory		-
	002e9d6217b17923b69710792fd85765c41a0fc5406ce6e1dbee3cc2ad82eca6.exe.zip	2015-12-16 10:26	8.1K
	2015-10-23_win11.biargus	2016-12-05 22:28	4.3M
	2015-10-23_win11.binetflow	2016-12-05 22:28	1.9M
	2015-10-23_win11.capinfos	2015-10-23 09:39	759
	2015-10-23_win11.dnstop	2015-10-23 09:39	21K
	2015-10-23_win11.html	2015-10-23 09:43	50M
	2015-10-23_win11.json	2015-10-23 09:43	84M
	2015-10-23_win11.passivedns	2015-10-23 09:39	585K
	2015-10-23_win11.pcap	2015-10-23 09:28	222M
	2015-10-23_win11.rrd	2015-10-23 09:29	8.0M
	2015-10-23_win11.tcpdstat	2016-12-05 22:28	2.1K
	2015-10-23_win11.weblogng	2016-06-15 19:03	1.2M
	README.html	2017-01-14 17:09	1.2K
	README.md	2015-10-23 09:30	879
	bro/	2017-08-31 09:45	-
	fast-flux-dga-first-analysis.txt	2017-01-14 17:09	617K
	training-capture-011.jpg	2022-08-07 23:49	3.4M

Timeline

• Probable name: Bunitu botnet (stripped)
• Binary extracted, shared and stripped by @hasherezade. This version is the original proxy code of the botnet.
• MD5: 5aeb4b21066217ea08f77ba9390f31b5
  
• SHA1: eafe116a5f97ad366fae48c8b22025b7dccd5e82
  

• SHA256: 002e9d6217b17923b69710792fd85765c41a0fc5406ce6e1dbee3cc2ad82eca6

• VirusTotal
• HybridAnalysis

• RobotHash

Wed Oct 7 09:31:34 CEST 2015

started win11

Wed Oct 7 09:34:38 CEST 2015

infected

Successfully connected

Fri Oct 22 06:50:00 CEST 2015 approx

The machine was stopped