Rig Exploit Kit via pseudoDarkleech from 195.133.201.6 delivers Cerber ransomware

NOTES:

 

I have added a zipped pcap file for your analysis. The password for the zipped pcap is infected all lowercase.

PCAP file of the infection traffic:
2016-11-17-Rig-EK-pcap.zip

 

ASSOCIATED DOMAINS AND IP ADDRESSES:

  • violinworkshop.co.uk – COMPROMISED SITE
  • 195.133.201.6 – add.webuyoboes.com – RIG EK LANDING PAGE
  • 23.94.62.200 – ffoqr3ug7m726zou.gyciiz.top – CERBER POST INFECT TRAFFIC
  • 65.55.50.0 – 65.55.50.31 UDP Port 6892 – CERBER POST INFECT TRAFFIC
  • 192.42.118.0 – 192.42.118.31  UDP Port 6892 – CERBER POST INFECT TRAFFIC
  • 194.165.16.0 – 194.165.19.255 UDP Port 6892 – CERBER POST INFECT TRAFFIC

ASSOCIATED DOMAINS FOR RANSOM PAYMENT:

http://ffoqr3ug7m726zou.gyciiz.top
http://ffoqr3ug7m726zou.ewfp5y.bid
http://ffoqr3ug7m726zou.onion.to

 

IMAGES AND DETAILS OF INFECTION CHAIN:

Shown above: Network traffic  associated with the Rig exploit and Cerber ransomware infection

 

Shown above: Fiddler used to show each stage of infection chain

 

Shown above: Injected script found on index page of compromised site which redirects visitor to the Rig EK landing page to start infection chain – Web page source code can be found by right clicking on web page and selecting “View source”

 

Shown above: Infected host desktop ransom note and payment instructions associated with Cerber Ransomware

 

Shown above: After extracting Rig flash exploit and saving as .swf file, decompiled using Flare (http://www.nowrap.de/flare.html) and examined flash meta data with text editor.

 

MALICIOUS PAYLOAD ASSOCIATED WITH RIG EXPLOIT: