Rig Exploit Kit via pseudoDarkleech from 109.234.38.100 delivers Cerber ransomware

by Analysis in pseudoDarkleech

NOTES:

  • Today I captured traffic from the latest version of Cerber ransomware. The ransomware was delivered via the pseudoDarkleech campaign with use of the Rig Exploit Kit.
  • The injection method was an Iframe, as mentioned in a post on SANS Internet Storm Center forum Change in patterns for the pseudoDarkleech campaign.

I have added a zipped pcap file for your analysis. The password for the zipped pcap is infected all lowercase.

PCAP file of the infection traffic:
2016-10-21-Rig-EK-pcap.zip

 

ASSOCIATED DOMAINS AND IP ADDRESSES:

  • www.yoso.ca – COMPROMISED SITE
  • 109.234.38.100 – re.traderskingvip.com – RIG EK LANDING PAGE
  • 46.22.220.22 – ffoqr3ug7m726zou.zn90h4.bid – CERBER POST INFECT TRAFFIC
  • 148.251.6.214 – btc.blockr.io – CERBER POST INFECT TRAFFIC
  • 31.184.234.0 – 31.184.235.255 UDP Port 6892 – CERBER POST INFECT TRAFFIC

ASSOCIATED DOMAINS FOR RANSOM PAYMENT:

http://ffoqr3ug7m726zou.zn90h4.bid
http://ffoqr3ug7m726zou.e6cf2t.bid
http://ffoqr3ug7m726zou.onion.to
http://ffoqr3ug7m726zou.onion

 

IMAGES AND DETAILS OF INFECTION CHAIN:

Shown above: Network traffic  associated with the Rig exploit and Cerber ransomware infection

 

Shown above: Injected script found on index page of compromised site which redirects visitor to the Rig EK landing page to start infection chain – Web page source code can be found by right clicking on web page and selecting “View source”

 

Shown above: Packet 218 shows partial content of Rig exploiting flash

 

Shown above: Packet 775 shows partial content of malicious payload delivered as an application/octet-stream in an encrypted/obfuscated format

 

Shown above: Infected host desktop ransom note and payment instructions associated with Cerber Ransomware

 

MALICIOUS PAYLOAD ASSOCIATED WITH RIG EXPLOIT:

 

Tagged with: , , , ,