2015-11-20 - BIZCN GATE ACTOR NUCLEAR EK FROM 18.104.22.168 - 51649.EDINDAGODL.XYZ
- ZIP archive of the PCAP: 2015-11-20-BizCN-gate-actor-Nuclear-EK-traffic.pcap.zip 440.3 kB (440,344 bytes)
- ZIP archive of the malware: 2015-11-20-BizCN-gate-actor-Nuclear-EK-malware-and-artifacts.zip 451.6 kB (451,552 bytes)
Shown above: Injected script in page from compromised website.
Shown above: CryptoWall 4.0 sample retrieved from the infected host.
Shown above: Artifacts left behind after the CryptoWall 4.0 infection.
Shown above: Pcap of the traffic filtered in Wireshark.
ZIP files are password-protected with the standard password. If you don't know it, look at the "about" page of this website.
Click here to return to the main page.