Rig Exploit Kit via Afraidgate delivers Locky ransomware from 158.255.6.18

NOTES:

  • Today I captured traffic from the Rig Exploit Kit (EK) which delivered Locky ransomware via the Afraidgate campaign. [Information on Afraidgate campaign]
  • The Locky variant used the .8d44 file extension on the encrypted files.
  • The infected host did not communicate with a Command and Control (C2) host
  • Once again thanks to @CyberScimitar for finding and sharing compromised site.

I have added a zipped pcap file for your analysis. The password for the zipped pcap is infected all lowercase.

PCAP file of the infection traffic:
2016-10-14-Rig-EK-pcap.zip

 

ASSOCIATED DOMAINS AND IP ADDRESSES:

  • breastfriends.org – COMPROMISTED SITE
  • 159.203.2.200 – round.luc-hariman.com GET /scripts/jqueryui.js – AFRAIDGATE
  • 194.87.237.217 – re.prescriptionsforskin.com – RIG EK LANDING PAGE
  • 158.255.6.18 – emmelineramsey.com – LOCKY RANSOMWARE DOWNLOAD

ASSOCIATED DOMAINS FOR RANSOM PAYMENT:

jhomitevd2abj3fk.tor2web.org
jhomitevd2abj3fk.onion.to

 

IMAGES AND DETAILS OF INFECTION CHAIN:

Shown above: Network traffic associated with the Rig EK, Afraidgate campaign and Locky ransomware

 

Shown above: Injected script found on index page of compromised site which redirects visitor to the Afraidgate to start infection chain

 

Shown above: Extracted JavaScript found on Afraidgate which redirects to the Rig EK landing page

 

Shown above: Name servers associated with the Afraidgate domain name

 

Shown above: _HOWDO_text.html ransom note and payment instructions associated with Locky ransomware

 

MALICIOUS PAYLOAD ASSOCIATED WITH RIG EXPLOIT: