Index of /publicDatasets/CTU-Malware-Capture-Botnet-189-1

[ICO]NameLast modifiedSizeDescription

[PARENTDIR]Parent Directory  -  
[IMG]training-capture-006.jpg2019-08-06 17:11 2.8M 
[   ]mitm.out2016-09-26 17:37 96M 
[TXT]fast-flux-dga-first-analysis.txt2017-01-13 14:10 35K 
[DIR]bro/2017-08-31 09:45 -  
[TXT]README.md2017-10-30 21:43 1.6K 
[TXT]README.html2017-10-30 21:43 2.3K 
[   ]9597fc80f793bbeceed69be9b1344fdb.exe.zip2016-09-26 17:59 200K 
[   ]2016-09-26_win7.weblogng2016-09-26 17:53 232  
[   ]2016-09-26_win7.tcpdstat2016-09-26 17:53 2.0K 
[   ]2016-09-26_win7.rrd2016-09-26 17:40 8.0M 
[   ]2016-09-26_win7.pcap2016-09-26 17:37 1.0G 
[   ]2016-09-26_win7.passivedns2016-09-26 17:50 74K 
[   ]2016-09-26_win7.netflow52016-11-08 21:17 32M 
[   ]2016-09-26_win7.mitm.weblog2016-12-05 22:14 5.7M 
[   ]2016-09-26_win7.dnstop2016-09-26 17:50 19K 
[   ]2016-09-26_win7.capinfos2016-09-26 17:53 1.1K 
[   ]2016-09-26_win7.binetflow2016-09-26 18:13 513M 
[   ]2016-09-26_win7.biargus2016-09-26 18:12 491M 

Description

Files

IP Addresses

- Infected host: 192.168.1.117
- Default GW: 192.168.1.2

Timeline

Fri Sep 2 13:46:18 CEST 2016

started win7

Fri Sep 2 13:48:04 CEST 2016

executed the malware
nothing happended

Fri Sep 2 13:50:28 CEST 2016

executed the malware
nothing happended

Fri Sep 2 13:53:31 CEST 2016

start IE
The malware started alone!!!

The bot connected to a 443 port, but the domain is sinkholed sinkhole-01.sinkhole.tech

Mon Sep 26 17:37:37 CEST 2016

power off