Index of /publicDatasets/CTU-Malware-Capture-Botnet-188-1

[ICO]NameLast modifiedSizeDescription

[PARENTDIR]Parent Directory  -  
[   ]2016-09-19_win2.biargus2016-09-19 18:08 401M 
[   ]2016-09-19_win2.binetflow2016-09-19 18:08 387M 
[   ]2016-09-19_win2.capinfos2016-09-19 17:53 1.1K 
[   ]2016-09-19_win2.dnstop2016-09-19 17:51 10K 
[TXT]2016-09-19_win2.html2016-09-19 18:06 1.1M 
[   ]2016-09-19_win2.json2016-09-19 18:06 1.4M 
[   ]2016-09-19_win2.mitm.weblog2016-12-05 22:14 49K 
[   ]2016-09-19_win2.netflow52016-11-07 20:01 93M 
[   ]2016-09-19_win2.passivedns2016-09-19 17:51 20K 
[   ]2016-09-19_win2.pcap2016-09-19 17:35 687M 
[   ]2016-09-19_win2.rrd2016-09-19 17:36 8.0M 
[   ]2016-09-19_win2.tcpdstat2016-09-19 17:54 2.1K 
[   ]2016-09-19_win2.uniargus2016-12-05 22:14 357M 
[   ]2016-09-19_win2.uninetflow2016-12-05 22:14 191M 
[   ]2016-09-19_win2.weblogng2016-09-19 17:54 53M 
[   ]48616dd47e12e369feef53a57830158a.exe.zip2016-09-19 18:01 7.5M 
[TXT]README.html2017-01-13 14:10 2.1K 
[TXT]README.md2016-09-19 18:00 1.5K 
[DIR]bro/2017-10-29 19:34 -  
[TXT]fast-flux-dga-first-analysis.txt2017-01-13 14:10 17K 
[   ]mitm.out2016-09-10 18:09 2.3M 
[   ]mitm.out.bak2017-10-29 19:34 2.3M 
[   ]wget-log2017-10-29 20:28 3.8K 

Description

Files

IP Addresses

- Infected host: 192.168.1.112
- Default GW: 192.168.1.2

Timeline

Fri Sep 9 11:19:16 CEST 2016

started win2

Fri Sep 9 11:21:56 CEST 2016

infected

click on the button Finished I think it had some issues with the mitmproxy, maybe some of the connections were not SSL?

Mon Sep 19 17:38:08 CEST 2016

power off