ElTest -> Rig Exploit Kit -> Bandarchor Ransomware Traffic Analysis

Source: malware-traffic-analysis.net

​The infection method is as follows:

• www[.]tdca[.]ca - Compromised site
• mapobifi[.]xyz - 85.93.0.110 port 80 – EITest gate
•  ew[.]203kcontractorsarkansas[.]com - 109.234.36.220 port 80 -  Rig EK
• 109.236.87.204 - GET /default.jpg - Post-infection traffic caused by the Bandarchor ransomware
• 109.236.87.204 - POST /yyy/fers.php - Post-infection traffic caused by the Bandarchor ransomware

*Analyze PCAP using filter “http.request”

Read More