Index of /publicDatasets/CTU-Malware-Capture-Botnet-65

	Name	Last modified	Size	Description
	Parent Directory		-
	fast-flux-dga-first-analysis.txt	2017-01-16 20:27	17K
	bro/	2017-08-31 09:45	-
	README.md	2015-04-09 15:39	581
	README.html	2017-01-16 20:27	797
	99513848a981463c0212b3021155c457.exe.zip	2015-12-16 10:26	181K
	2014-04-07_capture-win11.weblogng	2016-06-15 18:49	325K
	2014-04-07_capture-win11.tcpdstat	2017-01-16 20:27	1.7K
	2014-04-07_capture-win11.rrd	2014-04-07 11:02	8.0M
	2014-04-07_capture-win11.pcap	2014-04-06 09:48	35M
	2014-04-07_capture-win11.passivedns	2015-08-29 16:10	31K
	2014-04-07_capture-win11.json	2015-04-09 15:37	8.2M
	2014-04-07_capture-win11.html	2015-04-09 15:37	5.8M
	2014-04-07_capture-win11.dnstop	2015-08-29 16:10	7.0K
	2014-04-07_capture-win11.capinfos	2015-08-29 16:10	760
	2014-04-07_capture-win11.binetflow	2017-01-16 20:27	321K
	2014-04-07_capture-win11.biargus	2017-01-16 20:27	656K

Analysis Trojan/Adware/DownWare

VirusTotal Link

Timeline

Sun Feb 23 11:32:56 CET 2014

started win11

Sun Feb 23 11:35:22 CET 2014

infected with 99513848a981463c0212b3021155c457.exe: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

Tries to install PlusHD browser addon click on next click on next It is downloading stuff

Mon Apr 7 10:17:23 CEST 2014

Huge powerdown on Sun 06, at 10am... powering up now.