2015-11-22 - BIZCN GATE ACTOR NUCLEAR EK FROM 18.104.22.168 - 439520.13406.DUCO-OR.XYZ
- ZIP archive of the PCAP: 2015-11-22-BizCN-gate-actor-Nuclear-EK-traffic.pcap.zip 287.5 kB (287,471 bytes)
- ZIP archive of the malware: 2015-11-22-BizCN-gate-actor-Nuclear-EK-malware-and-artifacts.zip 218.6 kB (218,573 bytes)
Shown above: Pcap of the traffic filtered in Wireshark.
Shown above: Injected script in page from the comrpomised website.
Shown above: Malware retrieved from the infected host.
ZIP files are password-protected with the standard password. If you don't know it, look at the "about" page of this website.
Click here to return to the main page.