Index of /publicDatasets/CTU-Malware-Capture-Botnet-149-1

[ICO]NameLast modifiedSizeDescription

[PARENTDIR]Parent Directory  -  
[   ]2015-12-09_capture-win4.biargus2015-12-12 18:51 105M 
[   ]2015-12-09_capture-win4.binetflow2015-12-12 18:51 93M 
[   ]2015-12-09_capture-win4.capinfos2015-12-09 12:06 765  
[   ]2015-12-09_capture-win4.dnstop2015-12-09 12:04 23K 
[TXT]2015-12-09_capture-win4.html2015-12-09 12:07 887K 
[   ]2015-12-09_capture-win4.json2015-12-09 12:07 391K 
[   ]2015-12-09_capture-win4.netflow52016-11-04 19:10 35M 
[   ]2015-12-09_capture-win4.passivedns2015-12-09 12:04 2.2M 
[   ]2015-12-09_capture-win4.pcap2015-12-08 08:17 201M 
[   ]2015-12-09_capture-win4.rrd2015-12-09 12:03 8.0M 
[   ]2015-12-09_capture-win4.tcpdstat2016-10-11 20:10 1.8K 
[   ]2015-12-09_capture-win4.uniargus2016-10-11 20:10 176M 
[   ]2015-12-09_capture-win4.uninetflow2016-10-11 20:11 86M 
[   ]2015-12-09_capture-win4.weblogng2016-06-15 17:53 111K 
[TXT]README.html2017-01-14 17:00 1.2K 
[TXT]README.md2015-12-09 12:04 881  
[DIR]bro/2017-08-31 09:45 -  
[   ]e4f7fa6a0846e4649cc41d116c40f97835d3bb7d3d0391d3540482f077aa4493.exe.zip2015-12-16 10:26 1.0M 
[TXT]fast-flux-dga-first-analysis.txt2017-01-14 17:00 39M 

Description

Timeline

Sat Dec 5 12:31:18 CET 2015

started win4

Sat Dec 5 12:33:32 CET 2015

Infected sucessfully.

Wed Dec 7 08:20:00 CET 2015 (approx)

Something happened because the bot stop sending traffic. Completely. I don't know why it happened.

Wed Dec 9 11:27:11 CET 2015

I'm stopping the vm