2014-09-22 - ANGLER EK FROM 192.99.197.134 - ASD.SINGULARITYMUSCULUSINTERCOSTALIS.US

ASSOCIATED FILES:

 

CHAIN OF EVENTS

ASSOCIATED DOMAINS:

 

COMPROMISED WEBSITE AND REDIRECT:

 

ANGLER EK:

 

POST-INFECTION TRAFFIC:

 

PRELIMINARY MALWARE ANALYSIS

FLASH EXPLOIT:

File name:  2014-09-22-Angler-EK-flash-exploit.swf
File size:  49.3 KB ( 50486 bytes )
MD5 hash:  72acc95350e18c6bef8083a7ea11bbe0
Detection ratio:  1 / 55
First submission:  2014-09-19 12:46:08 UTC
VirusTotal link:  https://www.virustotal.com/en/file/a317a2fec99e8ab93487bba8f6398d1dfd89aff67f4b3acb21d782d0657ddac2/analysis/

 

MALWARE PAYLOAD:

File name:  2014-09-22-Angler-EK-malware-payload.dll
File size:  328.8 KB ( 336693 bytes )
MD5 hash:  a6ce0a4dc74d171c98fa5847a852745b
Detection ratio:  3 / 54
First submission:  2014-09-22 01:10:46 UTC
VirusTotal link:  https://www.virustotal.com/en/file/e69541d84efa6958d5968e93f3102fe653741176f8a7df901e920322182bbc65/analysis/

 

DROPPED MALWARE ON INFECTED VM (DLL FILE):

File name:  AngoSquq.dat
File size:  268.0 KB ( 274432 bytes )
MD5 hash:  279f81c4e92c2050c75ea02db562accb
Detection ratio:  13 / 55
First submission:  2014-09-22 01:37:18 UTC
VirusTotal link:  https://www.virustotal.com/en/file/97c95795c6010f44d2750185c36d9694ef932679487ebd052910c6ac63fa2f45/analysis/

 

SNORT EVENTS

Emerging Threats and ETPRO rulesets from Sguil on Security Onion (not including ET INFO, ET POLICY, and other more common rules):

Sourcefire VRT ruleset from Snort 2.9.6.2 on Debian 7 (not including preprocessor alerts):

 

HIGHLIGHTS FROM THE TRAFFIC

Script in page from compromised website:

 

Flash-based redirect leads to Angler EK:

 

Angler EK delivers malware payload:

 

Post-infection traffic:

 

FINAL NOTES

Once again, here are the associated files:

ZIP files are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.