Index of /publicDatasets/CTU-Malware-Capture-Botnet-64

	Name	Last modified	Size	Description
	Parent Directory		-
	62f06f0b41b5b9945036c69d2419f99a.zip	2014-03-30 23:10	658K
	2014-04-07_capture-win6.pcap	2014-04-06 09:47	1.6M
	2014-04-07_capture-win6.rrd	2014-04-07 10:57	8.0M
	2014-04-07_capture-win6.json	2015-04-10 10:08	302K
	2014-04-07_capture-win6.html	2015-04-10 10:08	523K
	2014-04-07_capture-win6.dnstop	2015-08-29 13:21	2.1K
	2014-04-07_capture-win6.passivedns	2015-08-29 13:21	2.1K
	README.md	2015-08-29 13:21	726
	2014-04-07_capture-win6.capinfos	2015-08-29 16:45	763
	2014-04-07_capture-win6.weblogng	2016-06-15 18:21	583
	2014-04-07_capture-win6.tcpdstat	2017-01-16 20:27	1.7K
	2014-04-07_capture-win6.biargus	2017-01-16 20:27	28K
	2014-04-07_capture-win6.binetflow	2017-01-16 20:27	18K
	fast-flux-dga-first-analysis.txt	2017-01-16 20:27	3.4K
	README.html	2017-01-16 20:27	917
	bro/	2017-08-31 09:45	-

Analysis

VirusTotal Link of the exe - The exe has MD5: a63d2a94bb30d6926360933b13af5291 - The zip file has another MD5: 62f06f0b41b5b9945036c69d2419f99a

Timeline

Sun Mar 30 23:04:44 CEST 2014

started win6

Sun Mar 30 23:06:40 CEST 2014

infected with 62f06f0b41b5b9945036c69d2419f99a.zip inside is the executable file gruppo.txt                                                                                          .exe

Mon Apr 7 10:17:23 CEST 2014

Huge powerdown on Sun 06, at 10am... powering up now.