2013-07-14 - DOTKACHEF EK FROM 209.240.135.142 - WWW.LAPOSTGROUP.COM

PCAP AND MALWARE:

 

NOTES:

 

CHAIN OF EVENTS

ASSOCIATED DOMAINS:

 

COMPROMISED WEBSITE AND REDIRECT:

 

DOTKACHEF EK:

 

PRELIMINARY MALWARE ANALYSIS

JAVA EXPLOIT:

File name:  2013-07-14-DotkaChef-EK-java-exploit.jar
File size:  28.7 KB ( 29376 bytes )
MD5 hash:  1b5d049ecf4231a5eaded355d4d72258
Detection ratio:  18 / 53
First submission:  2013-07-13 16:41:50 UTC
VirusTotal link:  https://www.virustotal.com/en/file/8e2bfb0f7d7955d086a7ca0ef221caf3a360fa1d396d26fc19557c5410ca5319/analysis/

 

MALWARE PAYLOAD:

File name:  2013-07-14-DotkaChef-EK-malware-payload.exe
File size:  218.0 KB ( 223232 bytes )
MD5 hash:  f5a5c38d93179cf9d7559054348d7484
Detection ratio:  46 / 55
First submission:  2013-07-15 00:49:49 UTC
VirusTotal link:  https://www.virustotal.com/en/file/75941c19409c3c616bd1159fb192efe108bf188f01471c4df95b2b42ba817ddc/analysis/

 

SNORT EVENTS

Screenshot of Emerging Threats signature hits from Sguil on Security Onion (without ET POLICY or ET INFO events):

 

SCREENSHOTS FROM THE TRAFFIC

Page from the website that was first viewed:

 

Redirect (gate) pointing to DotkaChef EK landing page:

 

DotkaChef EK landing page:

 

DotkaChef EK delivering the java exploit:

 

DotkaChef EK delivering the malware payload:

 

FINAL NOTES

Once again, here's the PCAP of the traffic and ZIP file of the malware:

ZIP files are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.