Name | Last modified | Size | Description | |
---|---|---|---|---|
Parent Directory | - | |||
README.html | 2023-01-21 12:00 | 6.4K | ||
README.md | 2023-01-21 11:59 | 5.2K | ||
botnet-capture-20110818-bot-2.html | 2015-05-14 12:59 | 352K | ||
botnet-capture-20110818-bot-2.json | 2015-05-14 12:59 | 2.5K | ||
botnet-capture-20110818-bot-2.pcap | 2011-08-18 15:55 | 4.0G | ||
bro/ | 2017-04-17 12:53 | - | ||
capture20110818-2.binetflow.2format | 2017-05-08 20:39 | 25M | ||
capture20110818-2.pcap.netflow.labeled | 2014-07-16 09:50 | 37M | ||
capture20110818-2.truncated.pcap.bz2 | 2015-07-21 08:05 | 80M | ||
detailed-bidirectional-flow-labels/ | 2015-05-14 11:55 | - | ||
ralabel-flowfilter.conf.generic | 2015-02-02 09:48 | 220K | ||
rbot.exe.zip | 2015-12-16 10:28 | 106K | ||
Probable Name: RBot
MD5: 2467b3c8b259cecd6ce2d5c31009df10
SHA1: 915934b43d63dc4040af3ea1ee6c80913288ff3b
SHA256: dcf50510efec16ff10c5aed91c8e386aba114e63842caa16ea40cac776c60816
Password of zip file: infected
Duration: 0 hours, 16 minutes and 0 seconds
RobotHash
capture20110818-2.pcap
It is a pcap capture with all the traffic (background, normal and botnet)
This pcap file was not made public because it contains too much private information about the users of the network.
This file was captures on the main router of the University network.
botnet-capture-20110818-2-bot.pcap
Capture with only the botnet traffic. It is made public.
This file was captured on the interface of the virtual machine being infected.
capture20110818-2.pcap.netflow.labeled
This file has the netflows generated by a unidirectional argus. The labels were assigned as this:
- First put Background to all the flows.
- Put LEGITIMATE to the flows that match some filters.
- Put Botnet to the flows that come to or from the infected IP addresses
bro
detailed-bidirectional-flow-labels
*.html
*.json
*truncated.pcap.bz2
- Infected hosts
- 147.32.84.165: Windows XP English version Name: SARUMAN. Label: Botnet. Amount of bidirectional flows: 4151
- 147.32.84.191: Windows XP English version Name: SARUMAN1. Label: Botnet. Amount of bidirectional flows: 4006
- 147.32.84.192: Windows XP English version Name: SARUMAN2. Label: Botnet. Amount of bidirectional flows: 7
- Normal hosts:
- 147.32.84.170 (amount of bidirectional flows: 581, Label: Normal-V42-Stribrek)
- 147.32.84.134 (amount of bidirectional flows: 11, Label: Normal-V42-Jist)
- 147.32.84.164 (amount of bidirectional flows: 2113, Label: Normal-V42-Grill)
- 147.32.87.36 (amount of bidirectional flows: 1, Label: CVUT-WebServer. This normal host is not so reliable since is a webserver)
- 147.32.80.9 (amount of bidirectional flows: 1, Label: CVUT-DNS-Server. This normal host is not so reliable since is a dns server)
- 147.32.87.11 (amount of bidirectional flows: 2, Label: MatLab-Server. This normal host is not so reliable since is a matlab server)
Please note that the labels of the flows generated by the malware start with “From-Botnet”. The labels “To-Botnet” are flows sent to the botnet by unknown computers, so they should not be considered malicious perse. Also for the normal computers, the counts are for the labels “From-Normal”. The labels “To-Normal” are flows sent to the botnet by unknown computers, so they should not be considered malicious perse.
This is a ICMP Dos to a computer done by a IRC botnet controlled by us. With the whole data.
We started the overall capture.
We started the bot capture.
We start to start only three vms.
We end to start only three vms.
We start to infect them.
We ended infecting them.
Bandwith is 100000kbps with 1000kb of burst
We attck with ICMP in saruman1
We attck with ICMP in saruman
The attack was successfull with only 2 computers!!!
The attack ended by timeout.
We stopped the vms.
The captures were stopped.
These files were generated in the Stratosphere Lab as part of the Malware Capture Facility Project in the CVUT University, Prague, Czech Republic.
The goal is to store long-lived real botnet traffic and to generate labeled netflows files.
Any question feel free to contact us:
Sebastian Garcia: sebastian.garcia@agents.fel.cvut.cz
You are free to use these files as long as you reference this project and the authors as follows:
Garcia, Sebastian. Malware Capture Facility Project. Retrieved from https://stratosphereips.org