2016-03-02 - ANGLER EK SENDS TESLACRYPT

PCAP AND MALWARE:

 

NOTES:


Shown above:  Start of the pseudo-Darkleech script in the initial page from the compromised website.

 


Shown above:  An example of the "admedia" script appended onto many of the .js files from the compromised website..

 

DETAILS


Shown above:  Today's traffic, filtered in Wireshark.

DATE/TIME:  2016-03-02 16:59 UTC

 

EXPLOITS/MALWARE:

 

FINAL NOTES

Once again, here are the associated files:

ZIP files are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.