![[ICO]](/icons/blank.gif){kind=icon}
![[PARENTDIR]](/icons/back.gif){kind=icon}
![[ ]](/icons/unknown.gif){kind=icon}
![[IMG]](/icons/image2.gif){kind=icon}
![[TXT]](/icons/text.gif){kind=icon}
![[ ]](/icons/script.gif){kind=icon}
![[DIR]](/icons/folder.gif){kind=icon}
![[ ]](/icons/compressed.gif){kind=icon}
Malware Capture Facility CVUT University, Prague, Czech Republic
These files were generated as part of a research project in the CVUT University, Prague, Czech Republic. The goal is to store long-lived real botnet traffic and to generate labeled netflows files. Any question feel free to contact us: Sebastian Garcia, sebastian.garcia@agents.fel.cvut.cz Vojtech Uhliř <vojtech.uhlir@agents.fel.cvut.cz
Disclaimer: You are free to use these files as long as you reference this project and the authors. #########################
The weblogs were generated with these command : justniffer -f $1 -p "port 80 or port 8080 or port 3128" -l "%request.timestamp2(%s) %dest.port %response.code %response.size %source.port %request.size http://%request.header.host%request.url %connection.time %dest.ip %source.ip %response.header.content-type %request.header.referer %request.header.user-agent" |awk '{if ($11 ~ /;/) print $1" "$2" "$3" "$4" "$5" "$6" "$7" "($81000)" "$9" "$10" "substr($11,1,match($11,/;/)-1)" "$13" "$14" "substr($0,index($0,$15)); else print $1" "$2" "$3" "$4" "$5" "$6" "$7" "($81000)" "$9" "substr($0,index($0,$10))}'|awk '{printf "%.3f %s %s %s %s %s %s %.0f %s %s", $1, $2, $3, $4, $5, $6, $7, $8, $9, substr($0,index($0,$10))}'|grep -v "Mb|rZl" > $FILE.weblog # The last grep is to avoid some lines with binary data. Sometimes the botnet uses these port but not for http, so we delete them # The last grep is to avoid some lines with binary data. Sometimes the botnet uses these port but not for http, so we delete them The last grep is to avoid some lines with binary data. Sometimes the botnet uses these port but not for http, so we delete them
The netflows are generated using the 2013-08-12_argus.conf file, the 2013-08-12_ra.conf file and the 2013-08-12_ralabel.conf conf file. The command used is this: 1- argus -F argus.conf -r file.pcap -w file.argus 2- ra -F ra.conf -Z b -nr file.argus -w - |ralabel -f ralabel.conf -r - -w file.argus.labeled 3- mv file.argus.labeled file.argus (this is to add labels to the argus file) 4- ra -F ra.conf -Z b -nr file.argus > file.argus.netflow.labeled
If you need the netflows without the labels, just regenerate them without the ralabel command.
104530 From-Botnet-V1-SPAM 1972733 From-Botnet-V1-TCP-Attempt 46215 From-Botnet-V1-UDP 53596 From-Botnet-V1-TCP-Established 758181 From-Botnet-V1-DNS 1117623 Background
Binary used: tdPTU02.exe (md5 bb99fa3473960eb3a8ddc214af23b220) Probable Name: Kelihos VirusTotal link: https://www.virustotal.com/en/file/59ea583b2a56a72a16b9cecfd88d9507a61ac6db5b8947b6e43da272eaa41a9a/analysis/1376577717/
Infected Machines: Windows Name: Win15, IP: 10.0.2.29 (Label: Botnet-V1)
Pcap Captures files: The pcap capture files were done by Virtualbox, because the vms were NATed. This means that all the captures start on 19707/1/1 because of a bug in virtualbox.
Sun Jul 21 14:47:38 CEST 2013 started the vm
Sun Jul 21 14:49:13 CEST 2013 Infected win15
Small research was done for this kind of malware according the md5 code. It was found as it could be type of PushDo malware.
Malware tries a huge amount of DNS requests, but it was not seen that it could be case of Domain Generation Algorithm DGA.
In some point it also starts to send a particular amount of spam.
Experiment is still running, more computers are going to be infected.