Following RoughTed again I came across a website that used the “http.eqiv” attribute to refresh the page which led to Rig EK. Rig EK dropped two payloads which both were the same file with different names. The Flash exploit was also present which is worth mentioning as for a few days it had stopped using Flash. The final payload appeared to be a coin miner but it did not perform any of its capabilities. The payload could be a work in progress so I will pass it to the @MalwareHunterTeam who may find it of interest.
- A few articles on Rig exploit kit and it’s evolution:
- Article on Rough Ted:
(in password protected zip: (infected))
- 05-June-2017-Rig-Miner-PCAP -> Pcap
- 05-June-2017-Rig-Miner-CSV -> CSV of the traffic (resolved IP addresses)
- 05-June-2017-Miner-> Miner “curl.exe”
Details of infection chain:
(click to enlarge!)
RoughTed is a malvertising operation known for it’s wide scope. See the MalwareBytes article above for a more in depth dive. In this chain I started with the RoughTed URL and within 8 seconds Rig EK had dropped a payload.
RoughTed led to a compromised website that used the “http.equiv” attribute to refresh the screen which presents the Rig EK landing page.
Rig EK dropped two payloads both of which were the same file as the final binary but with different names. I also observed the Flash exploit which was missing from Rig EK for the last few days.
The payload copied itself to “Appdata/Roaming/MetaData” and created a startup entry. Multiple vendors detected the executable as “MSILPerseus” which is considered a form of adware.
|Detection ratio:||19 / 61|
The binary did not seem to perform any actions. It is possible it was waiting for a user action or that the code was corrupt. I did fine 2 URL’s in the strings one of which returns your public IP:
I also viewed the functions and saw multiple suspicious commands such as modules, file downloads, POST requests.
I also passed the sample to @Antelox who identified a string:
“%USERPROFILE%\Desktop\miner no tor\mayweather\obj\Debug\utcsvc.pdb”