2016-04-06 - PSEUDO DARKLEECH ANGLER EK FROM 85.143.223.178 SENDS TESLACRYPT

PCAP AND MALWARE:

 

NOTES:

 

2016-04-06-pseudo-Darkleech-Angler-EK-malware-and-artifacts.zip archive contents:

 

TRAFFIC


Shown above:  Pcap for this blog entry's traffic filtered in Wireshark.

 

ASSOCIATED DOMAINS:

 

IMAGES


Shown above:  Start of injected pseudo-Darkleech script in page from the compromised website.

 


Shown above:  Decrypt instructions (the text file) caused by the TeslaCrypt ransomware.

 

FINAL NOTES

Once again, here are the associated files:

The ZIP files are password-protected with the standard password.  If you don't know it, email me at admin@malware-traffic-analysis.net and ask.

Click here to return to the main page.