2015-07-02 - FIESTA EK FROM 66.225.219[.]224 - JACKKWIZC.DDNSKING[.]COM

NOTICE:

• The zip archives on this page have been updated, and they now use the new password scheme.  For the new password, see the "about" page of this website.

ASSOCIATED FILES:

• 2015-07-02-Fiesta-EK-traffic.pcap.zip
• 2015-07-02-Fiesta-EK-malware-and-artifacts.zip

 

 

CHAIN OF EVENTS

ASSOCIATED DOMAINS:

• 66.225.219[.]224 port 80 - jackkwizc.ddnsking[.]com - Fiesta EK

 

FIESTA EK:

• 2015-07-02 16:37:23 UTC - jackkwizc.ddnsking[.]com - GET /p4zra9wf/counter.php?id=3
• 2015-07-02 16:37:23 UTC - jackkwizc.ddnsking[.]com - GET /p4zra9wf/?3
• 2015-07-02 16:37:24 UTC - jackkwizc.ddnsking[.]com - GET /p4zra9wf/dJ2H9rIuFm6RnI1eVRHew-bR96kfkM8Wi-WKVeP2-qiW
• 2015-07-02 16:37:24 UTC - jackkwizc.ddnsking[.]com - GET /p4zra9wf/fqvX3UJpRUzzw413CrFN0tzYrCt6TXgvegnIUUct0z3yH6.4060129
• 2015-07-02 16:37:24 UTC - jackkwizc.ddnsking[.]com - GET /p4zra9wf/evFbw9YzC6rV8sUMqFIXYwYcR9WWI2GPGHRW-crCzbiIf.910
• 2015-07-02 16:37:25 UTC - jackkwizc.ddnsking[.]com - GET /p4zra9wf/babhQrLu6OqLDSG-XjwNF8t4whAGQGDNKfV80zstXb.118800.94
• 2015-07-02 16:37:26 UTC - jackkwizc.ddnsking[.]com - GET /p4zra9wf/dDcTF93Sk5-XJJ9qFhyYw-3N9WWdvFJWiIw-crGKl_yq
• 2015-07-02 16:37:27 UTC - jackkwizc.ddnsking[.]com - GET /p4zra9wf/dDcTF93Sk5-XJJ9qFhyYw-3N9WWdvFJWiIw-crGKl_yq.1
• 2015-07-02 16:37:31 UTC - jackkwizc.ddnsking[.]com - GET /p4zra9wf/ChtpxP1zKW5SY0rFR3xu5A7e6TXAArVQNYIc9sEX_2p
• 2015-07-02 16:37:33 UTC - jackkwizc.ddnsking[.]com - GET /p4zra9wf/ChtpxP1zKW5SY0rFR3xu5A7e6TXAArVQNYIc9sEX_2p.1
• 2015-07-02 16:37:38 UTC - jackkwizc.ddnsking[.]com - GET /p4zra9wf/CNje0q2VVGhD0XrcRGSw-r7tBLEAMtWnI_yc8cfKvK3
• 2015-07-02 16:37:40 UTC - jackkwizc.ddnsking[.]com - GET /p4zra9wf/CNje0q2VVGhD0XrcRGSw-r7tBLEAMtWnI_yc8cfKvK3.1
• 2015-07-02 16:37:40 UTC - jackkwizc.ddnsking[.]com - GET /p4zra9wf/5JFw9Q0lh3rxF6g3pcN2Cw-b5tB-f27tWi-wyVfyXIUHB
• 2015-07-02 16:37:42 UTC - jackkwizc.ddnsking[.]com - GET /p4zra9wf/5L1sHwfqpTAPl20ySw-X9zhrY_BzzAGqLnIWAV8eybZaO
• 2015-07-02 16:37:42 UTC - jackkwizc.ddnsking[.]com - GET /p4zra9wf/BsNuPU6IG61QiqwY2tW5vS_4uwA7SAQYUvceHVXxhC.1
• 2015-07-02 16:37:44 UTC - jackkwizc.ddnsking[.]com - GET /p4zra9wf/BsNuPU6IG61QiqwY2tW5vS_4uwA7SAQYUvceHVXxhC.1.1

 

Click here to return to the main page.