2016-08-23 - PSEUDO-DARKLEECH NEUTRINO EK FROM 74.208.209[.]10 SENDS CRYPMIC RANSOMWARE

NOTICE:

• The zip archives on this page have been updated, and they now use the new password scheme.  For the new password, see the "about" page of this website.

ASSOCIATED FILES:

• 2016-08-23-pseudoDarkleech-Neutrino-EK-sends-CrypMIC-ransomware.pcap.zip   208.0 kB (208,007 bytes)

• 2016-08-23-pseudoDarkleech-Neutrino-EK-sends-CrypMIC-ransomware.pcap   (508,780 bytes)

• 2016-08-23-pseudoDarkleech-Neutrino-EK-and-CrypMIC-ransomware-files.zip   336.8 kB (336,778 bytes)

• 2016-08-23-page-from-altron.com-with-injected-script.txt   (71239 bytes)
• 2016-08-23-CrypMIC-ransomware-decrypt-instructions.HTML   (238,182 bytes)
• 2016-08-23-CrypMIC-ransomware-decrypt-instructions.JPG   (225,433 bytes)
• 2016-08-23-CrypMIC-ransomware-decrypt-instructions.TXT   (1,654 bytes)
• 2016-08-23-pseudoDarkleech-Neutrino-EK-flash-exploit.swf   (77,735 bytes)
• 2016-08-23-pseudoDarkleech-Neutrino-EK-landing-page.txt   (2,354 bytes)
• 2016-08-23-pseudoDarkleech-Neutrino-EK-payload-CrypMIC-ransomware.dll   (69,632 bytes)

 

BACKGROUND ON THE PSEUDO-DARKLEECH CAMPAIGN::

• Something I wrote on exploit kit (EK) fundamentals:  link
• 2016-03-22 - PaloAlto Networks Unit 42 blog:  Campaign Evolution: Darkleech to Pseudo-Darkleech and Beyond
• 2016-07-02 - SANS ISC diary:  Change in patterns for the pseudoDarkleech campaign

 

BACKGROUND ON CRYPMIC RANSOMWARE:

• 2016-07-06 - SANS ISC diary:  CryptXXX ransomware updated   [The date I first noticed this new branch of ransomware.]

• 2016-07-14 - From the Proofpoint blog [link]: "We believe that CryptXXX is in active development and possibly split off into two branches. The original branch is now up to version 5.001 (we wrote about the upgrade to version 3.100 near the end of May), while the new branch uses a different format for versioning and will require further analysis."

• 2016-07-20 - TrendLabs Security Intelligence Blog - CrypMIC Ransomware Wants to Follow CryptXXX's Footsteps   [TrendLabs analyzes the new branch and names it.]

 

Shown above:  Flowchart for this infection traffic.

 

TRAFFIC

Shown above:  Injected script from the pseudoDarkleech campaign in same page from the compromised site.

 

Shown above:  Traffic from the pcap filtered in Wireshark.   Wireshark filter: http.request or (!(tcp.port eq 80) and tcp.flags eq 0x0002)

 

ASSOCIATED DOMAINS:

• www.altron[.]com - Compromised site
• 74.208.209[.]10 port 80 - orbisonia.clay4u[.]co[.]uk - Neutrino EK
• 85.14.243[.]9 port 443 - Post-infection traffic caused by CrypMIC ransomware (custom encoded & clear text, not HTTPS/SSL)

DOMAINS FROM THE DECRYPT INSTRUCTIONS:

• ccjlwb22w6c22p2k[.]onion[.]to
• ccjlwb22w6c22p2k[.]onion[.]city

NOTE: The above 2 domains from the decrypt instructions are the same ones I've seen from CrypMIC ransomware since 2016-07-26 or earlier.

 

FILE HASHES

FLASH EXPLOIT:

• SHA256 hash:  a71188d09ef0aa99533d222b91500005eff86c58d33bddaa9e2f9f645971eaaf
  File name:  2016-08-23-pseudoDarkleech-Neutrino-EK-flash-exploit.swf

PAYLOAD:

• SHA256 hash:  cef1c724d0ad18a5cbda3629efc0aa6d6385597363edaf6085c49b86c3dca74c
  File name:  2016-08-23-pseudoDarkleech-Neutrino-EK-payload-CrypMIC-ransomware.dll

 

IMAGES

Shown above:  Desktop of an infected Windows host after rebooting.

 

Click here to return to the main page.