2016-03-18 - ANGLER EK DATA DUMP

PCAPS AND MALWARE:

 

ASSOCIATED DOMAINS

ANGLER EK:

TESLACRYPT POST-INFECTION FROM 2016-03-17:

TESLACRYPT POST-INFECTION FROM 2016-03-18:

 

IMAGES


Shown above:  Pcaps for this blog entry's traffic filtered in Wireshark.

 


Shown above:  Injected script in page from compromised website on 2016-03-17.

 


Shown above:  Injected script in page from compromised website on 2016-03-18.

 


Shown above:  Start of pseudo-Darkleech injected script in page from compromised website on 2016-03-18.

 


Shown above:  Decrypt instructions from TeslaCrypt samples on 2016-03-18.

 

FINAL NOTES

Once again, here are the associated files:

ZIP files are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.