2016-01-18 - TWO INFECTIONS (RIG AND ANGLER EK)
NOTICE:
- The zip archives on this page have been updated, and they now use the new password scheme. For the new password, see the "about" page of this website.
ASSOCIATED FILES:
- 2016-01-18-both-examples-of-EK-traffic.zip 1.8 MB (1,756,995 bytes)
- 2016-01-18-Angler-and-Rig-EK-malware-and-artifacts.zip 647.2 kB (647,234 bytes)
FIRST PCAP
FILE DETAILS:
- Pcap name: 2016-01-18-Rig-EK-traffic.pcap
- Start time: 2016-01-18 20:43:14 UTC
- End time: 2016-01-18 20:43:44 UTC
ASSOCIATED DOMAINS:
- 103.1.175[.]1 port 80 - www.hotelarunachala[.]in - Compromised website
- 192.185.35[.]254 port 80 - hollistercarwash[.]com - Gate/redirect
- 46.30.42[.]198 port 80 - htr.drraffihovsepianreview[.]com - Rig EK
SECOND PCAP
FILE DETAILS:
- Pcap name: 2016-01-18-Angler-EK-sends-Bedep-traffic.pcap
- Start time: 2016-01-18 21:54:38 UTC
- End time: 2016-01-18 21:58:58 UTC
ASSOCIATED DOMAINS:
- 216.28.245[.]214 port 80 - coolrilla[.]com - Compromised website
- 5.189.216[.]103 port 80 - nic.artededirigir[.]com[.]br - Redirect/gate
- 185.49.69[.]25 port 80 - omondi-liczyli.jwsjustdothemath[.]com - Angler EK
- www.ecb.europa[.]eu - Connectivity check by the infected host
- 195.22.28[.]199 port 80 - aodncqkbqddauoyqk[.]com - Post-infection traffic
- 195.22.28[.]222 port 80 - sso.anbtr[.]com - Post-infection traffic
- 195.22.28[.]198 port 80 - xsso.aodncqkbqddauoyqk[.]com - Post-infection traffic
- 208.100.26[.]234 port 80 - letvnhhitrdk[.]com - Post-infection traffic
- 95.211.205[.]230 port 80 - qufsvzeigvlxdbw[.]com - Post-infection traffic
- 104.193.252[.]234 port 80 - lampubuntuadv[.]com - GET /ads.php?sid=1948 [Post-infection ad traffic]
- 85.25.79[.]160 port 80 - reannewscomm[.]com - GET /ads.php?sid=1948 [Post-infection ad traffic]
- 89.163.240[.]118 port 80 - kjnoa9sdi3mrlsdnfi[.]com - GET /ads.php?sid=1948 [Post-infection ad traffic]
- 185.82.216[.]241 port 80 - lollytooneymoney[.]com - GET /ads.php?sid=1948 [Post-infection ad traffic]
- 185.82.216[.]240 port 80 - allhobbyworldsnet[.]com - GET /ads.php?sid=1948 [Post-infection ad traffic]
- 85.25.79[.]160 port 80 - reannewscomm[.]com - GET /ads.php?sid=1948 [Post-infection ad traffic]
- 89.163.240[.]119 port 80 - gerausports[.]com - GET /ads.php?sid=1948 [Post-infection ad traffic]
Click here to return to the main page.