Malspam E-mail Leads to Ransomware Cerber/Zerber Infection TRAFFIC SAMPLE

May 11, 2020 by bytecash

Malspam E-mail Leads to Ransomware Cerber/Zerber Infection TRAFFIC SAMPLE Example of files that were encrypted and protected: The domain name ftoxmpdipwobp4qy.joa688.top was NX and not required for the purchase process. 2016-12-16 01:29:05.256362 IP 192.168.1.102.50104 > 72.167.232.152.80: Flags [P.], seq 0:303, ack 1, win 256, length 303: HTTP: GET //up1/1/4fv3b5.exe HTTP/1.1 E..W..@……..fH……P.n……P…….GET //up1/1/4fv3b5.exe HTTP/1.1 Accept: application/x-shockwave-flash, … Read more Malspam E-mail Leads to Ransomware Cerber/Zerber Infection TRAFFIC SAMPLE

Malspam E-mail Leads to Ransomware Cerber/Zerber Infection TRAFFIC SAMPLE

February 14, 2020 by bytecash

Example of files that were encrypted and protected: The domain name ftoxmpdipwobp4qy.joa688.top was NX and not required for the purchase process. 2016-12-16 01:29:05.256362 IP 192.168.1.102.50104 > 72.167.232.152.80: Flags [P.], seq 0:303, ack 1, win 256, length 303: HTTP: GET //up1/1/4fv3b5.exe HTTP/1.1 E..W..@……..fH……P.n……P…….GET //up1/1/4fv3b5.exe HTTP/1.1 Accept: application/x-shockwave-flash, image/gif, image/jpeg, image/pjpeg, */* Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; … Read more Malspam E-mail Leads to Ransomware Cerber/Zerber Infection TRAFFIC SAMPLE

Latest from PCAP Analysis

AsyncRAT RacoonStealer tunnabelly.ug jamshed.pk vbchjfssdfcxbcver.ru thompson.ug PCAP Traffic Sample File Download June 24, 2020

2020-06-23 15:26:21.518710 IP 10.1.10.15.49742 > 217.8.117.45.80: Flags [P.], seq 1:502, ack 1, win 16425, length 501: HTTP: GET /zxcv.EXE HTTP/1.1 E….=@…wX . …u-.N.P’&”i….P.@).Q..GET /zxcv.EXE HTTP/1.1 Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, */* Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729) Accept-Encoding: […]

AZORult RacoonStealer Banking Malware Crypto miner PCAP File Download Traffic Sample June 24, 2020

AZORult/RacoonStealer can steal banking information including passwords and credit card details as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat. Raccoon is an info stealer type malware available as a Malware as a Service. It can be obtained for a subscription […]

Quasar RAT ClipBanker Banking Trojan Malware PCAP File Download Traffic Sample June 24, 2020

Quasar is a very popular RAT in the world thanks to its code being available in the open-source. This malware can be used to remotely control the victim’s computer. 4.exe is the dropper for the banking trojan and Quasar is the GET /line ip-api.com traffic. TrojanBanker:Win32/ClipBanker.777af9cd Trojan[Banker]/Win32.ClipBanker . .T&.h.c.P.J.\V.4.P.@)N……… 2020-06-23 14:29:07.371643 IP 10.1.10.15.49763 > 84.38.180.104.80: Flags […]

Latest Vulnerabilities

U.S. Levies Sanctions Against Russian Research Institution Linked to Triton Malware

The latest in a flurry of actions this week, tied to foreign threats against U.S. computer systems, includes sanctions by the Department of the Treasury.

Louisiana Calls Out National Guard to Fight Ransomware Surge

An investigation showed a custom backdoor RAT and the Emotet trojan in the networks of municipal victims of the attacks.

Election Security: Beyond Mail-In Voting

There are many areas of the election process that criminal hackers can target to influence election results.

Georgia Election Data Hit in Ransomware Attack

With Election Day approaching, local governments need to be prepared for malware attacks on election infrastructure.

COVID-19 Vaccine-Maker Hit with Cyberattack, Data Breach

Dr. Reddy's, the contractor for Russia’s “Sputinik V” COVID-19 vaccine and a major generics producer, has had to close plants and isolate its data centers.