Index of /publicDatasets/CTU-Malware-Capture-Botnet-164-1

	Name	Last modified	Size	Description
	Parent Directory		-
	fast-flux-dga-first-analysis.txt	2017-01-13 22:08	16M
	c5d81a096cbc34edd0046e33cffbe070.exe.zip	2016-07-01 20:05	157K
	bro/	2022-01-30 11:48	-
	README.md	2016-07-01 21:04	1.2K
	README.html	2017-01-13 22:08	1.8K
	2015-07-01_winnormal2.tcpdstat	2016-09-03 16:50	2.1K
	2015-07-01_winnormal2.rrd	2016-07-01 20:06	8.0M
	2015-07-01_winnormal2.pcap	2016-06-22 22:04	12G
	2015-07-01_winnormal2.passivedns	2016-07-01 20:11	2.1M
	2015-07-01_winnormal2.json	2016-07-04 07:18	585M
	2015-07-01_winnormal2.html	2016-07-04 07:18	283M
	2015-07-01_winnormal2.dnstop	2016-07-01 20:09	22K
	2015-07-01_winnormal2.capinfos	2016-07-01 20:44	0
	2015-07-01_winnormal2.biargus	2016-12-05 22:20	2.7G

Description

• Probable Name: Vawtrak (at the begging there is some normal traffic)
• MD5: c5d81a096cbc34edd0046e33cffbe070
• SH1: 950f56462ac46d1e698bae4b62bb82f3a5c385b1
• SHA256: 34d8dc64e8e425b5a78799ee124f43c8b4045f611e5187d8266abda6dfb50e45
• Zip password: infected

• Infected IP: 10.0.2.200

• VirusTotal
• HybridAnalysis

• RobotHash

Timeline

Sat Mar 19 18:56:07 CET 2016

Started win normal 2

Sat Mar 19 18:57:11 CET 2016

Open googlechrome

Sat Mar 19 19:00:32 CET 2016

search "test page for me" in google

Sat Mar 19 19:01:11 CET 2016

Accessed normally a link in www.linkedin.com

Sat Mar 19 19:02:03 CET 2016

infected

Sat Mar 19 19:05:14 CET 2016

I reopened the chrome browser because it was closed

Tue Mar 22 15:47:21 CET 2016

Started the mail sink daemon

Fri Jul 1 19:53:49 CEST 2016

Rebooted because since 2016 May 20 that it is not sending packets

Fri Jul 1 20:04:22 CEST 2016

Poweroff