2016-12-23 - AFRAIDGATE RIG-V FROM 81.177.140[.]7 SENDS "OSIRIS" VARIANT LOCKY RANSOMWARE

NOTICE:

• The zip archives on this page have been updated, and they now use the new password scheme.  For the new password, see the "about" page of this website.

ASSOCIATED FILES:

• 2016-12-23-Afraidgate-Rig-V-sends-Locky-ransomware.pcap.zip   493.2 kB (493,208 bytes)

• 2016-12-23-Afraidgate-Rig-V-sends-Locky-ransomware.pcap   (623,434 bytes)

• 2016-12-23-Afraidgate-Rig-V-and-Locky-ransomware-files.zip   233.6 kB (233,583 bytes)

• 2016-12-23-Afraidgate-Rig-V-artifact-OTTYUADAF.txt   (1,137 bytes)
• 2016-12-23-Afraidgate-Rig-V-flash-exploit.swf   (12,964 bytes)
• 2016-12-23-Afraidgate-Rig-V-landing-page.txt   (5,370 bytes)
• 2016-12-23-Afraidgate-Rig-V-payload-Locky-ransomware-rad24B6F.tmp.exe   (203,264 bytes)
• 2016-12-23-Locky-ransomware-decryption-instructions-DesktopOSIRIS.bmp   (3,578,902 bytes)
• 2016-12-23-Locky-ransomware-decryption-instructions-DesktopOSIRIS.htm   (8,017 bytes)
• 2016-12-23-mybook.bookinturkey_net-scripts-comments_simple.js.txt   (456 bytes)
• 2016-12-23-page-from-dannabananas_com-with-injected-Afraidgate-script.txt   (90,856 bytes)

BACKGROUND ON RIG EXPLOIT KIT:

• I'm routinely intercepting 2 versions of Rig EK as classified in an October 2016 blog post by Kafeine.
• Rig-V: a "VIP version" with new URL patterns and RC4 encryption for the payload.  Used by the Afraidgate, EITest, and pseudoDarkleech campaigns.
• Rig-E: a variant with old URL patterns, but uses with RC4 encryption for the payload.  Also known as Empire Pack.  I often see Rig-E used by the EITest campaign.

BACKGROUND ON THE AFRAIDGATE CAMPAIGN:

• My most recent in-depth write-up on the Afraidgate campaign can be found here.

Shown above:  Flowchart for this infection traffic.

 

TRAFFIC

Shown above:  Page from the compromised website with injected script leading to an Afraidgate redirect URL.

 

Shown above:  Afraidgate redirect URL leading to a Rig-V landing page.

 

Shown above:  Traffic from the pcap filtered in Wireshark.

 

ASSOCIATED DOMAINS:

• www.dannabananas[.]com - Compromised website
• 46.101.82[.]38 port 80 - mybook.bookinturkey[.]net - GET /scripts/comments_simple.js - Afraidgate URL
• 81.177.140[.]7 port 80 - red.happyeyesusa[.]com - Rig-V
• 81.177.3[.]145 port 80 - 81.177.3[.]145 - POST /checkupdate - Locky post-infection callback

TOR DOMAIN FROM THE DECRYPT INSTRUCTIONS:

• g46mbrrzpfszonuk[.]onion

 

FILE HASHES

RIG-V FLASH EXPLOIT:

• SHA256 hash:  f494fba94a5d577b3e16b146176dc180e758ce5435e6198dbe79d9e0b3527746   (12,964 bytes)
  File description:  Rig-V Flash exploit seen on 2016-12-23

RIG EK PAYLOAD (LOCKY RANSOMWARE):

• SHA256 hash:  02dc8f9a48e035c8acccd9371da0d848c38c911730d201c61af388fd67e063be   (203,264 bytes)
  File location:  C:\Users\[username]\AppData\Local\Temp\rad24B6F.tmp.exe

 

IMAGES

Shown above:  Desktop of an infected Windows host after rebooting.  This is the most recent variant of Locky (the "Osiris" variant).

 

Click here to return to the main page.