CryptoWall: Magic behind the dropper

In this article we take a look at de-obfuscating the latest CryptoWall 3.0 dropper (Which is actually very, very simple). [https://tribalchicken.net/content/images/2015/03/ce0.png] As noted in a previous article [https://tribalchicken.com.au/security/cryptowall-3-0-still-alive/], the latest variant of CryptoWall 3.0 is getting around via a .js… leer más

CryptoWall 3.0: still alive.

Note: This is not yet a full analysis. Early this morning I received several phishing emails that look suspiciously like those associated with the delivery of Cryptowall 3.0…. [https://tribalchicken.net/content/images/2015/03/Screen-Shot-2015-03-24-at-8.17.16-pm.png] The zip files contain an obfuscated .js file. Unfortunately I did not get time to… leer más