2015-11-19 - BIZCN GATE ACTOR NUCLEAR EK FROM 5.231.54.59 - 16953.FALMUEMB.XYZ
ASSOCIATED FILES:
- ZIP archive of the PCAP: 2015-11-19-BizCN-gate-actor-Nuclear-EK-traffic.pcap.zip 467.4 kB (467,446 bytes)
- ZIP archive of the malware: 2015-11-19-BizCN-gate-actor-Nuclear-EK-malware-and-artifacts.zip 427.5 kB (427,493 bytes)
IMAGES
Shown above: Desktop after the CryptoWall 3.0 infection.
Shown above: Checking the decrypt instructions after the CryptoWall 3.0 infection.
Shown above: Some of the artifacts left behind after the CryptoWall 3.0 infection.
Shown above: Pcap of the infection traffic filtered in Wireshark.
Shown above: Malware retrieved from the infected host.
Shown above: Malicious script in page from compromised website.
Shown above: Examples of the gate domains on 46.172.83.0/24.
FINAL NOTES
ZIP files are password-protected with the standard password. If you don't know it, look at the "about" page of this website.
Click here to return to the main page.