Rig Exploit Kit via pseudoDarkleech from 109.234.38.100 delivers Cerber ransomware
NOTES:
- Today I captured traffic from the latest version of Cerber ransomware. The ransomware was delivered via the pseudoDarkleech campaign with use of the Rig Exploit Kit.
- The injection method was an Iframe, as mentioned in a post on SANS Internet Storm Center forum Change in patterns for the pseudoDarkleech campaign.
I have added a zipped pcap file for your analysis. The password for the zipped pcap is infected all lowercase.
PCAP file of the infection traffic:
2016-10-21-Rig-EK-pcap.zip
ASSOCIATED DOMAINS AND IP ADDRESSES:
- www.yoso.ca – COMPROMISED SITE
- 109.234.38.100 – re.traderskingvip.com – RIG EK LANDING PAGE
- 46.22.220.22 – ffoqr3ug7m726zou.zn90h4.bid – CERBER POST INFECT TRAFFIC
- 148.251.6.214 – btc.blockr.io – CERBER POST INFECT TRAFFIC
- 31.184.234.0 – 31.184.235.255 UDP Port 6892 – CERBER POST INFECT TRAFFIC
ASSOCIATED DOMAINS FOR RANSOM PAYMENT:
http://ffoqr3ug7m726zou.zn90h4.bid
http://ffoqr3ug7m726zou.e6cf2t.bid
http://ffoqr3ug7m726zou.onion.to
http://ffoqr3ug7m726zou.onion
IMAGES AND DETAILS OF INFECTION CHAIN:
Shown above: Network traffic associated with the Rig exploit and Cerber ransomware infection
Shown above: Injected script found on index page of compromised site which redirects visitor to the Rig EK landing page to start infection chain – Web page source code can be found by right clicking on web page and selecting “View source”
Shown above: Packet 218 shows partial content of Rig exploiting flash
Shown above: Packet 775 shows partial content of malicious payload delivered as an application/octet-stream in an encrypted/obfuscated format
Shown above: Infected host desktop ransom note and payment instructions associated with Cerber Ransomware
MALICIOUS PAYLOAD ASSOCIATED WITH RIG EXPLOIT:
- 2016-10-21-Rig-EK.swf
Virus Total Link - 2016-10-21-rad97FE7.tmp.exe
Virus Total Link