Index of /publicDatasets/CTU-Mixed-Capture-6

[ICO]NameLast modifiedSizeDescription

[PARENTDIR]Parent Directory  -  
[   ]2018-04-04_mixed.biargus2018-05-21 10:28 12M 
[   ]2018-04-04_mixed.binetflow2018-05-21 10:28 1.5M 
[   ]2018-04-04_mixed.capinfos2018-05-21 10:28 1.1K 
[   ]2018-04-04_mixed.dnstop2018-05-21 10:27 20K 
[TXT]2018-04-04_mixed.html2018-05-21 10:28 8.0M 
[   ]2018-04-04_mixed.json2018-05-21 10:28 11M 
[   ]2018-04-04_mixed.passivedns2018-05-21 10:27 287K 
[   ]2018-04-04_mixed.pcap2018-05-10 10:06 658M 
[   ]2018-04-04_mixed.tcpdstat2018-05-21 10:28 2.2K 
[   ]2018-04-04_mixed.weblogng2018-05-21 10:28 530K 
[TXT]README.html2018-05-21 10:28 4.4K 
[TXT]README.md2018-05-10 10:06 3.6K 
[DIR]bro/2018-05-21 10:27 -  
[DIR]suricata/2019-03-23 14:41 -  
[IMG]training-capture-007.jpg2022-08-07 23:35 2.4M 



IP Addresses

- Infected host: 192.168.1.xx
- Default GW:


Tue May 1 21:02:28 CEST 2018

Started normal This is the windows that is full but smaller

Last normal packet 9

Tue May 1 21:03:42 CEST 2018

Infected with 0d3019f5dfdd7ee6594aaf3ef712e86d0c207ae67e8c1a2cfb7c5e475cfec14a

Wed May 2 07:56:53 CEST 2018

Normal actions Last packet before doing normal actions by hand:
2132 04:00:54.354418 IP6 fe80::353e:6fce:ee32:1a73.51389 > ff02::c.1900: UDP, length 146

We did a lot of normal, google eemail, youtube, download docuemnts, ping from cmd.exe, and google drive.

Fri May 4 23:45:27 CEST 2018

Power it off


These files were generated in the Stratosphere Lab as part of the Malware Capture Facility Project in the CVUT University, Prague, Czech Republic. The goal is to store long-lived real botnet traffic and to generate labeled netflows files. Any question feel free to contact us: Sebastian Garcia:

You are free to use these files as long as you reference this project and the authors as follows: Garcia, Sebastian. Malware Capture Facility Project. Retrieved from