Rig Exploit Kit via EiTest delivers malicious payload from 185.141.26.12


NOTES:

  • Today I captured traffic from the Rig Exploit Kit (EK) which delivered a malicious payload via the EITEST campaign.
  • The EITEST campaign has changed it’s injected script on compromised sites from an obfuscated hex script to a javascript redirect.
  • Snort, using the Emerging Threats open ruleset generated alerts for likely Shylock/URLzone/Gootkit/Zeus Panda C2.
  • Thanks to Baber for sharing information on compromised site.

I have added a zipped pcap file for your analysis. The password for the zipped pcap is infected all lowercase.

PCAP file of the infection traffic:
2016-10-15-Rig-EK-2-pcap.zip

 

ASSOCIATED DOMAINS AND IP ADDRESSES:

  • www.rmmagazine.com – COMPROMISED SITE
  • 185.141.26.12 – a7wsdn.xnxbtb.top – RIG EK LANDING PAGE
  • 27.125.1.250 Port 443 – greatmusichits.online – POST INFECTION TRAFFIC

 

IMAGES AND DETAILS OF INFECTION CHAIN:

Shown above: Network traffic  associated with the Rig exploit and the delivery of malicious payload

 

Shown above: Injected script found on index page of compromised site which redirects visitor to the Rig EK landing page to start infection chain – Web page source code can be found by right clicking on web page and selecting “View source”

 

Shown above: Post infection traffic over SSL port 443 associated with malicious payload

 

Shown above: Malicious SSL certificate “MyCompany Ltd.” used by malicious payload

 

Shown above: Snort alerts generated by the Emerging Threats open ruleset

 

MALICIOUS PAYLOAD ASSOCIATED WITH RIG EXPLOIT: