Index of /publicDatasets/CTU-Malware-Capture-Botnet-44

[ICO]NameLast modifiedSizeDescription

[PARENTDIR]Parent Directory  -  
[TXT]README.html2017-05-21 18:41 5.5K 
[TXT]README.md2017-05-21 18:41 4.7K 
[TXT]botnet-capture-20110812-rbot.html2015-05-14 12:07 409K 
[   ]botnet-capture-20110812-rbot.json2015-05-14 12:07 82K 
[   ]botnet-capture-20110812-rbot.pcap2011-08-15 14:22 123M 
[DIR]bro/2017-04-14 22:23 -  
[   ]capture20110812.binetflow.2format2017-05-08 20:30 1.1G 
[   ]capture20110812.pcap.netflow.labeled2016-12-08 14:25 1.4G 
[   ]capture20110812.truncated.pcap.bz22015-07-20 10:51 2.5G 
[DIR]detailed-bidirectional-flow-labels/2015-05-14 11:54 -  
[   ]rbot.exe.zip2015-12-16 10:28 106K 

CTU-Malware-Capture-Botnet-44 or Scenario 3 in the CTU-13 dataset.

Description

Files

IP Addresses

- Infected hosts
    - 147.32.84.165: Windows XP (English version) Name: SARUMAN (Label: Botnet) (amount of infected flows: 53518)
- Normal hosts:
    - 147.32.84.170 (amount of bidirectional flows: 217614, Label: Normal-V42-Stribrek)
    - 147.32.84.134 (amount of bidirectional flows: 1934, Label: Normal-V42-Jist)
    - 147.32.84.164 (amount of bidirectional flows: 9160, Label: Normal-V42-Grill)
    - 147.32.87.36 (amount of bidirectional flows: 3686, Label: CVUT-WebServer. This normal host is not so reliable since is a webserver)
    - 147.32.80.9 (amount of bidirectional flows: 28, Label: CVUT-DNS-Server. This normal host is not so reliable since is a dns server)
    - 147.32.87.11 (amount of bidirectional flows: 184, Label: MatLab-Server. This normal host is not so reliable since is a matlab server)

Important Label note

Please note that the labels of the flows generated by the malware start with "From-Botnet". The labels "To-Botnet" are flows sent to the botnet by unknown computers, so they should not be considered malicious perse. Also for the normal computers, the counts are for the labels "From-Normal". The labels "To-Normal" are flows sent to the botnet by unknown computers, so they should not be considered malicious perse.

Timeline

Fri Aug 12 14:12:11 CEST 2011

We are going to infect the vm with rbot.exe, a bot we can control with IRC.

The bandwith was limited to 2kbps.

When we download something, it is downloading at 1000 KB/s. Not sure how this happens.

Fri Aug 12 15:00:37 CEST 2011

We infect the computer and leave capturing only the packets.

We used the IRC channel to retrive some information about the bot and then command it to scan some ports in some networks.

Mon Aug 15 09:55:11 CEST 2011

I stop the bot.

Mon Aug 15 10:14:55 CEST 2011

We stop the botnet capture

Traffic Analysis

Disclaimer

These files were generated in the Stratosphere Lab as part of the Malware Capture Facility Project in the CVUT University, Prague, Czech Republic.
The goal is to store long-lived real botnet traffic and to generate labeled netflows files.
Any question feel free to contact us:
Sebastian Garcia: sebastian.garcia@agents.fel.cvut.cz
You are free to use these files as long as you reference this project and the authors as follows:
Garcia, Sebastian. Malware Capture Facility Project. Retrieved from https://stratosphereips.org