Index of /publicDatasets/CTU-Malware-Capture-Botnet-175-1

[ICO]NameLast modifiedSizeDescription

[PARENTDIR]Parent Directory  -  
[   ]2016-06-11_win9.biargus2016-09-04 10:34 458K 
[   ]2016-06-11_win9.binetflow2016-09-04 10:34 531K 
[   ]2016-06-11_win9.capinfos2016-09-04 10:33 1.1K 
[   ]2016-06-11_win9.dnstop2016-09-04 10:33 2.0K 
[   ]2016-06-11_win9.passivedns2016-09-04 10:33 1.2K 
[   ]2016-06-11_win9.pcap2016-07-12 07:29 6.9M 
[   ]2016-06-11_win9.rrd2016-07-12 07:30 8.0M 
[   ]2016-06-11_win9.tcpdstat2016-09-04 10:33 1.6K 
[   ]2016-06-11_win9.uniargus2016-12-05 22:15 4.6M 
[   ]2016-06-11_win9.uninetflow2016-12-05 22:15 3.1M 
[   ]2016-06-11_win9.weblogng2016-09-04 10:33 232  
[TXT]README.html2017-01-13 14:19 1.5K 
[TXT]README.md2016-09-04 10:37 970  
[DIR]bro/2017-08-31 09:45 -  
[TXT]fast-flux-dga-first-analysis.txt2017-01-13 14:19 2.9K 

Description

Files

IP Addresses

- Infected host: 10.0.2.109
- Default GW: 10.0.2.1

Timeline

Sat Jun 11 01:28:28 CEST 2016

started win9

Sat Jun 11 01:30:10 CEST 2016

infected with https://goo.gl/NrGdrX

Small amount of traffic. Most of the capture is dhcp6

Tue Jul 12 07:29:02 CEST 2016

power off