2014-12-01 - NEW VERSION OF NEUTRINO EK FROM 107.191.118[.]231 AND 168.235.69[.]123

NOTICE:

ASSOCIATED FILES:

NOTES:

 

CHAIN OF EVENTS

ASSOCIATED DOMAINS:

 

2014-11-29 19:07 UTC - NEUTRINO EK:

 

2014-11-29 19:19 UTC - NEUTRINO EK:

 

2014-12-01 14:02 UTC - NEUTRINO EK:

 

2014-12-01 14:43 UTC - NEUTRINO EK:

 

SANDBOX ANALYSIS OF THE MALWARE PAYLOAD (SAME PAYLOAD FROM ALL 4 INFECTIONS):

 

SNORT EVENTS

Emerging Threats and ETPRO rulesets from Sguil on Security Onion using Suricata:

Sourcefire VRT ruleset from Snort 2.9.6.2 on Debian 7:

 

PRELIMINARY MALWARE ANALYSIS

FLASH EXPLOIT

File name:  2014-12-01-Neutrino-EK-flash-exploit.swf
File size:  41,512 bytes
MD5 hash:  52fab50c4012980a6879f1880cb8bc4f
Detection ratio:  0 / 55
First submission:  2014-11-27 17:46:34 UTC
VirusTotal link:  https://www.virustotal.com/en/file/1409423b38599e7d1bc66298d1793fcf7dcc7de13689c5fc34afd5309e476477/analysis/

 

MALWARE PAYLOAD

File name:  2014-12-01-Neutrino-EK-malware-payload.exe
File size:  136,704 bytes
MD5 hash:  80e090c484d6fd131baaafbfdbf109b4
Detection ratio:  13 / 55
First submission:  2014-12-02 16:18:07 UTC
VirusTotal link:  https://www.virustotal.com/en/file/a85101aaa1863d119847f1cc8271343d1a911f304641a02af953c17ecdae84d6/analysis/

 

HIGHLIGHTS FROM THE TRAFFIC ON 2014-11-29

Embedded iframe in page from compromised website (same in all 4 examples):

 

Redirect (same URL in all 4 examples):

 

Neutrino EK landing page:

 

Neutrino EK calls for javascript from ajax.googleapis[.]com:

 

Neutrino EK delivers Flash exploit:

 

Encrypted EXE payload sent after successful Flash exploit:

 

One last GET request by the EK returns a 404 Not Found:

 

Click here to return to the main page.