Angler Exploit Kit from 18.104.22.168 sends Bedep
The norm for Angler Exploit Kit from the “pseudo-Darkleech” campaign is to send BEDEP and CRYPTXXX. In a recent post by Malware-Traffic-Analysis he writes about how Bedep acts differently when it detects a VM (Virtual Machine). I do not know if this was the case for this infection but I feel it should be noted.
- 22.214.171.124 – nzersef.tk – EiTest GATE
- 126.96.36.199 – stnd0z.nqj7hnp.top – Angler LANDING PAGE
- 188.8.131.52 – mbkdkxmbkjabafqvut.com – POST /index.php – Bedep POST INFECTION TRAFFIC
- 184.108.40.206 – POST /calendar.php – Bedep POST INFECTION TRAFFIC
IMAGES and DETAILS:
MALICIOUS PAYLOAD SENT BY ANGLER: