Index of /publicDatasets/CTU-Malware-Capture-Botnet-157-1

	Name	Last modified	Size	Description
	Parent Directory		-
	2015-05-01_linux-1.biargus	2016-12-05 22:26	13K
	2015-05-01_linux-1.binetflow	2016-12-05 22:26	5.5K
	2015-05-01_linux-1.capinfos	2016-05-01 12:27	757
	2015-05-01_linux-1.dnstop	2016-05-01 12:27	1.9K
	2015-05-01_linux-1.passivedns	2016-05-01 12:27	945
	2015-05-01_linux-1.pcap	2016-03-07 10:39	70M
	2015-05-01_linux-1.rrd	2016-03-19 12:30	8.0M
	2015-05-01_linux-1.tcpdstat	2016-09-03 16:53	1.8K
	2015-05-01_linux-1.weblogng	2016-06-15 18:21	232
	README.html	2017-01-13 22:18	1.1K
	README.md	2016-05-01 12:29	819
	bro/	2017-08-31 09:45	-
	fast-flux-dga-first-analysis.txt	2017-01-13 22:18	1.6K
	pys.py.zip	2016-05-01 12:29	1.4K

Description

• Probable Name: Linux Botnet (Unknown)
• Script to infect: http://222.179.116.23:8080/theme/1/pys.py
• MD5: 0544317e48d4a773a3e4a6faa028ff1b
  
• SHA1: 6f08134e0f0dcd9e2c06529e89a4f6f20e1b6c3c
  
• SHA256: d201228c36cb9e93ec3bb1e37d932e8050c6b22b2c887500b521be81856760ca
  

• Zip Password: infected

• VirusTotal
• HybridAnalysis

• RobotHash

Timeline

Sun Mar 6 15:03:17 CET 2016

Started linux kali

Sun Mar 6 15:10:41 CET 2016

Infected

18 hours later the traffic stopped.