Index of /publicDatasets/CTU-Malware-Capture-Botnet-25-1

	Name	Last modified	Size	Description
	Parent Directory		-
	weblogs.filter	2013-12-09 12:06	1.9K
	tcpflow.report.pdf	2014-04-25 13:44	16K
	ralabel.conf	2013-11-06 15:43	6.0K
	ralabel-flowfilter.conf	2024-04-09 19:35	51K
	ra.conf.publish	2013-11-06 15:43	2.0K
	ra.conf.analysis	2013-11-06 15:44	2.0K
	labels.config	2024-04-09 23:00	80K
	histogram-of-web-domains-accessed.txt	2014-01-08 16:35	559
	fast-flux-dga-first-analysis.txt	2017-01-15 14:15	190K
	e1090d7126dd88d0d1d39b68ea3aae11.exe.zip	2015-12-16 10:26	273K
	bro/	2024-04-09 22:27	-
	argus_bi.conf	2013-11-06 15:43	20K
	README.md	2016-03-16 14:52	1.1K
	README.html	2017-01-15 14:15	1.5K
	2013-11-06_capture-win6.weblogng.labeled	2013-12-10 14:28	21M
	2013-11-06_capture-win6.weblogng	2016-06-15 18:04	22M
	2013-11-06_capture-win6.weblog	2013-11-06 15:44	17M
	2013-11-06_capture-win6.top5dns	2014-09-18 15:23	590
	2013-11-06_capture-win6.tcpdstat	2017-01-15 14:14	2.3K
	2013-11-06_capture-win6.rrd	2013-12-10 13:52	8.0M
	2013-11-06_capture-win6.pcap	2013-11-06 15:24	884M
	2013-11-06_capture-win6.passivedns	2014-09-18 15:21	246K
	2013-11-06_capture-win6.json	2015-06-01 15:32	94M
	2013-11-06_capture-win6.html	2015-06-01 15:32	76M
	2013-11-06_capture-win6.exes-downloaded.zip	2015-12-16 10:26	1.1K
	2013-11-06_capture-win6.dnstop	2014-09-18 15:27	18K
	2013-11-06_capture-win6.clf	2013-11-06 15:44	15M
	2013-11-06_capture-win6.capinfos	2015-08-29 20:57	767
	2013-11-06_capture-win6.binetflow.labeled.sorted	2015-01-30 19:55	36M
	2013-11-06_capture-win6.binetflow.labeled	2015-01-30 19:55	36M
	2013-11-06_capture-win6.binetflow	2015-09-25 15:27	158M
	2013-11-06_capture-win6.biargus.labeled	2014-11-04 13:04	138M
	2013-11-06_capture-win6.biargus	2015-09-25 15:27	154M
	2013-11-06_capture-win6.3model	2014-11-04 16:51	1.4M

Description

• Probable Name: Zbot at first, then others probably.
• Binary used: yL0T.exe
• MD5: e1090d7126dd88d0d1d39b68ea3aae11
• SHA1: e0513664515eacc65e9530afe665619f2bce3802
  
• SHA256: 3fc6bef5eac0656be77f8e96f2b7e08cadb418c11430e8c3d53b33788a93c86a
  
• VirusTotal
• HybridAnalysis
• RobotHash

• Infected Machines:
  • Windows Name: Win6, IP: 10.0.2.106
• Duration: 57.9 days

Analysis of DNS tuples

• 10.0.2.106-8.8.4.4-53-udp (From-Botnet-UDP-DNS--2201)
  • At least 3000 Flows
• 10.0.2.106-8.8.8.8-53-udp (From-Botnet-UDP-DNS--2202)
  • At least 3000 Flows

Timeline

Mon Sep 9 17:15:36 CEST 2013

Win6 infected

Malware has deleted itself and a lot of encrypted communication has started. Keep experiment running..

Wed Nov 6 15:29:06 CET 2013

stopped win6