IP Addresses

- Infected host: 192.168.1.X
- Default GW: 192.168.1.X


Wed Jul 19 21:50:56 CEST 2017

started win2

Wed Jul 19 21:52:10 CEST 2017

Uninstall VirtualBox Guest Additions

Wed Jul 19 21:56:00 CEST 2017

1970/01/01 01:04:54.285381,3.016498,udp,,62188, ->,,1900,REQ,0,,2,350,350,s[266]=M-SEARCH * HTTP/1.1..Host: Installed Bittorent

Wed Jul 19 21:57:01 CEST 2017

Bittorrent opened some web pages in IE.

Wed Jul 19 21:57:27 CEST 2017

I quit the IE and the bittorent

Wed Jul 19 22:00:10 CEST 2017

infected Last packet in the pacp before infection 1970-01-01 02:09:01.407256 ARP, Reply is-at 08:00:27:e1:e3:8a, length 28

Last flow approximately before infection 1970/01/01 01:09:27.399191,0.000222,arp,,, who,,,CON,,,2,102,42,,d[18]=..................,,,d[18]=..................

Mon Jul 24 08:41:29 CEST 2017

power off


These files were generated in the Stratosphere Lab as part of the Malware Capture Facility Project in the CVUT University, Prague, Czech Republic. The goal is to store long-lived real botnet traffic and to generate labeled netflows files. Any question feel free to contact us: Sebastian Garcia:

You are free to use these files as long as you reference this project and the authors as follows: Garcia, Sebastian. Malware Capture Facility Project. Retrieved from