2015-04-03 - NUCLEAR EK DROPS TESLACRYPT MALWARE

ASSOCIATED FILES:

 

NOTES:

 

CHAIN OF EVENTS

DATE AND TIME OFF THE ACTIVITY:

 

ASSOCIATED DOMAINS:

 

NUCLEAR EK:

 

POST-INFECTION TRAFFIC:

 

SNORT EVENTS

Signature hits from the Emerging Threats and ETPRO rulesets using Sguil on Security Onion (without ET POLICY or ET INFO events):

Significant signature hits from the Talos (Sourcefire VRT) ruleset using Snort 2.9.7.2 on Debian 7:

 

PRELIMINARY MALWARE ANALYSIS

FLASH EXPLOIT:

File name:  2015-04-03-Nuclear-EK-flash-exploit.swf
File size:  8.7 KB ( 8930 bytes )
MD5 hash:  b7ed8635d35845d880d5e98c1568115e
Detection ratio:  0 / 42
First submission:  2015-04-03 16:17:20 UTC
VirusTotal link:  https://www.virustotal.com/en/file/10bb822d37c8b5f6d31b97ece2d409a961c8ab411e5ea56d9d9f020feae04fc3/analysis/

 

SILVERLIGHT EXPLOIT:

File name:  2015-04-03-Nuclear-EK-silverlight-exploit.xap
File size:  17.5 KB ( 17940 bytes )
MD5 hash:  2f6b618d8784229ff5911ece667d9320
Detection ratio:  0 / 42
First submission:  2015-04-03 16:17:32 UTC
VirusTotal link:  https://www.virustotal.com/en/file/7196c54642c29163efcda569789858b9a894df33c24b1a634d836dc3a748ba82/analysis/

 

MALWARE PAYLOAD:

File name:  2015-04-03-Nuclear-EK-malware-payload.exe
File size:  279.0 KB ( 285696 bytes )
MD5 hash:  f3b12a197d732cda29d6d9e698ea58bf
Detection ratio:  2 / 57
First submission:  2015-04-03 16:17:49 UTC
VirusTotal link:  https://www.virustotal.com/en/file/6c6f88ebd42e3ef5ca6c77622176183414d318845f709591bc4117704f1c95f4/analysis/
Malwr link:  https://malwr.com/analysis/YWRiZjUyOGU1ZTRmNDA1M2FiNDU2YWYyOTBhYzE3ZGE/

 

SCREENSHOTS FROM THE INFECTED HOST

 

FINAL NOTES

Once again, here are the associated files:

ZIP files are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.