2017-12-08 - FOBOS CAMPAIGN RIG EK SENDS BUNITU

ASSOCIATED FILES:

  • 2017-12-08-Fobos-campaign-Rig-EK-sends-Bunitu.pcap   (317,090 bytes)
  • 2017-12-08-Bunitu-post-infection-artifact-liaogiu.dll   (30,208 bytes)
  • 2017-12-08-Fobos-campaign-Rig-EK-payload-Bunitu.exe   (174,080 bytes)
  • 2017-12-08-Rig-EK-flash-exploit.swf   (14,197 bytes)
  • 2017-12-08-Rig-EK-landing-page.txt   (132,707 bytes)
  • 2017-12-08-page-from-krai-soft.net.txt   (39,071 bytes)
  • 2017-12-08-script-returned-from-103jdhhfff99500910.info.txt   (921 bytes)

 

NOTES:

 

TRAFFIC


Shown above:  Traffic from the infection filtered in Wireshark.

 

ASSOCIATED DOMAINS:

 

FILE HASHES

RIG EK FLASH EXPLOIT:

MALWARE RETRIEVED FROM THE INFECTED HOST:

 

IMAGES


Shown above:  Malware persistent on the infected Windows host.

 

FINAL NOTES

Once again, here are the associated files:

Zip archives are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.