|
Introduction Yesterday on Tuesday 2016-09-27, the Afraidgate campaign switched from Neutrino exploit kit (EK) to Rig EK [1]. As we go into Wednesday 2016-09-28, this trend continues. So let's examine another case of Afraidgate using Rig EK! Details The Afraidgate campaign has been sending Locky since it stopped distributing CryptXXX ransomware in mid-July 2016 [2]. Afraidgate started using Neutrino EK after Angler EK disappeared in early June 2016 [3]. Currently, Afraidgate is using Rig EK, and it's distributing the newest variant of Locky ransomware. This newest variant is called "Odin" because of the .odin file extension Locky is now using for its encrypted files [4]. The image below shows the current chain of events since Afraidgate switched to Rig EK.
Infection traffic
Indicators from this traffic are:
In the image below, injected script is highlighted in a page from the compromised site. This script kicked off the infection chain by generating HTTP traffic to a gate. Checking the domain registration, we see the gate's name servers are from afraid.org, which is a common characteristic for gates used by this campaign.
Next, the Afraidgate URL returned script with an iframe that pointed to a Rig EK landing page.
Rig EK has gone through some changes in recent weeks. Earlier this month, I noticed the landing page for Rig EK included a large amount of non-ASCII characters. That was also the case today.
The Rig EK Flash exploits are now around 25 kB in size.
The Rig EK payload is now encoded with an encryption algorithm. Previously, Rig EK used a more straight-forward method of XOR-ing the binary with an ASCII string. Now the payload is more heavily obfuscated. In this case, the payload was a downloader for Locky.
After Rig EK sent the Locky downloader, that downloader grabbed Locky. In the traffic, we see a fake user agent and fake content type in the HTTP headers. The Locky binary was also encoded as it came across the network.
A closer look at the traffic shows findidlist.com wasn't the first domain the infected host tried when downloading the Locky binary. Crocotan.com was tried first, but that domain has been apparently taken off line. After Locky was downloaded, the infected host generated several DNS queries for other domains, presumably for the Locky post-infection callback. None of those DNS queries were successful.
The infected host Even though Locky wasn't able to perform its post-infection callback, the victim host was still infected. File extensions were .odin for the encrypted files, so this is the most recent variant of Locky (the "Odin" variant).
Checking the Locky Drecryptor page revealed the ransom instructions. As we've often seen with Locky from the Afraidgate campaign, the ransom was 1.5 bitcoin, which as of today is approximately 908 US dollars.
Malware info The following artifacts were recovered from the infected host: Rig EK payload (Downloader for Locky):
Locky samples pulled from the infected host:
Final words Locky ransomware continues to be an evolving threat. Not only do we see it from near-daily waves of malicious spam (malspam), we also see it distributed in a more stealthy manner through EKs. The Afraidgate campaign is the currently biggest EK-based campaign distributing Locky. As always, properly-administered Windows hosts are not likely to be infected. As long as your Windows host is up-to-date and fully patched, your risk is minimal. If you're running Windows 10, I doubt you have anything to worry about. But apparently enough out-of-date Windows hosts browse the web, so this campaign is profitable for the criminal group behind it. Pcap and malware for this diary are located here. --- References: [1] http://www.malware-traffic-analysis.net/2016/09/27/index.html |
Brad 422 Posts ISC Handler Sep 28th 2016 |
| Thread locked Subscribe |
Sep 28th 2016 5 years ago |
Sign Up for Free or Log In to start participating in the conversation!
https://www.sans.edu
