2016-10-18 - PSEUDO-DARKLEECH RIG EK FROM 195.133.201.132 SENDS CERBER RANSOMWARE
ASSOCIATED FILES:
- ZIP archive of the pcap: 2016-10-18-pseudoDarkleech-Rig-EK-sends-Cerber-ransomware.pcap.zip 591.2 kB (591,158 bytes)
- 2016-10-18-pseudoDarkleech-Rig-EK-sends-Cerber-ransomware.pcap (722,872 bytes)
- ZIP archive of the malware: 2016-10-18-pseudoDarkleech-Rig-EK-sends-Cerber-malware-and-artifacts.zip 820.2 kB (820,221 bytes)
- 2016-10-18-Cerber-decryption-instructions-README.hta (63,062 bytes)
- 2016-10-18-Cerber-decryption-instructions.bmp (1,890,054 bytes)
- 2016-10-18-page-from-basket-brabant.be-with-injected-script.txt (58,670 bytes)
- 2016-10-18-pseudoDarkleech-Rig-EK-flash-exploit.swf (51,789 bytes)
- 2016-10-18-pseudoDarkleech-Rig-EK-landing-page.txt (30,353 bytes)
- 2016-10-18-pseudoDarkleech-Rig-EK-payload-Cerber.exe (467,707 bytes)
NOTES:
- Thansk to @FreeBSDfan for his tweet about the compromised site.
BACKGROUND ON THE PSEUDO-DARKLEECH CAMPAIGN:
- Something I wrote on exploit kit (EK) fundamentals: link
- 2016-03-22 - PaloAlto Networks Unit 42 blog: Campaign Evolution: Darkleech to Pseudo-Darkleech and Beyond
- 2016-07-02 - SANS ISC diary: Change in patterns for the pseudoDarkleech campaign
- 2016-09-14 - Malware-traffic-analysis.net: The pseudoDarkleech campaign starts using Rig EK instead of Neutrino EK
- 2016-10-03 - Malware-traffic-analysis.net: The pseudoDarkleech campaign stops sending CryptXXX, starts sending Cerber ransomware
Shown above: Flowchart for this infection traffic.
TRAFFIC
Shown above: Injected script from the pseudoDarkleech campaign in a page from the compromised site.
Shown above: Traffic from the infection filtered in Wireshark.
ASSOCIATED DOMAINS:
- www.basket-brabant.be - Compromised site
- 195.133.201.132 port 80 - add.jamesthorpebourbon.com - Rig EK
- 31.184.234.0 - 31.184.235.255 port 6892 (UDP) - UDP traffic caused by Cerber
- 107.161.95.138 port 80 - ffoqr3ug7m726zou.zn90h4.bid - HTTP traffic caused by Cerber
OTHER DOMAINS FROM THE DECRYPT INSTRUCTIONS:
- ffoqr3ug7m726zou.e6cf2t.bid
- ffoqr3ug7m726zou.onion.to
FILE HASHES
FLASH EXPLOIT:
- SHA256 hash: 45e63ef9fc34347e45aa9dc40f820f207948ca0c415ac5d156020a1dedbb4d49
File name: 2016-10-18-pseudoDarkleech-Rig-EK-flash-exploit.swf (51,789 bytes)
PAYLOAD:
- SHA256 hash: e14f32bdfbb2dc1117736029677effdedec2f570d73092261ba98f040a1b282f
File name: 2016-10-18-pseudoDarkleech-Rig-EK-payload-Cerber.exe (467,707 bytes)
IMAGES
Shown above: Desktop of the infected Windows host.
FINAL NOTES
Once again, here are the associated files:
- ZIP archive of the pcap: 2016-10-18-pseudoDarkleech-Rig-EK-sends-Cerber-ransomware.pcap.zip 591.2 kB (591,158 bytes)
- ZIP archive of the malware: 2016-10-18-pseudoDarkleech-Rig-EK-sends-Cerber-malware-and-artifacts.zip 820.2 kB (820,221 bytes)
ZIP files are password-protected with the standard password. If you don't know it, look at the "about" page of this website.
Click here to return to the main page.