Rig Exploit Kit via pseudoDarkleech from 95.128.181.244 delivers Cerber ransomware

NOTES:

 

I have added a zipped pcap file for your analysis. The password for the zipped pcap is infected all lowercase.

PCAP file of the infection traffic:
2016-11-4-Rig-EK-pcap.zip

 

ASSOCIATED DOMAINS AND IP ADDRESSES:

  • sassyalbertsoap.com – COMPROMISED SITE
  • 95.128.181.244 – red.sevending.com – RIG EK LANDING PAGE
  • 46.22.223.215 – xrhwryizf5mui7a5.ugk9za.top – CERBER POST INFECT TRAFFIC
  • 194.165.16.0 – 194.165.19.254 UDP Port 6892 – CERBER POST INFECT TRAFFIC

ASSOCIATED DOMAINS FOR RANSOM PAYMENT:

http://xrhwryizf5mui7a5.ugk9za.top
http://xrhwryizf5mui7a5.z5xfkc.top
http://xrhwryizf5mui7a5.onion.to

 

IMAGES AND DETAILS OF INFECTION CHAIN:

Shown above: Network traffic  associated with the Rig exploit and Cerber ransomware infection

 

Shown above: Injected script found on index page of compromised site which redirects visitor to the Rig EK landing page to start infection chain – Web page source code can be found by right clicking on web page and selecting “View source”

 

Shown above: Infected host desktop ransom note and payment instructions associated with Cerber Ransomware

 

Shown above: After extracting Rig flash exploit and saving as .swf file, decompiled using Flare (http://www.nowrap.de/flare.html) and examined flash meta data with text editor.

 

MALICIOUS PAYLOAD ASSOCIATED WITH RIG EXPLOIT: