Summary:

It has a while since I have blogged. This is due to two things. First I found a new job which I start next month so that has taken up some of my time. Next I’ve found Rig EK activity to have greatly reduced. I did find other Rulan, Fobos and Seamless samples which I decided not to blog about as they were same old. So if I disappear after blogging this, it’s just that the EK landscape is drying up. I’ll be back if something changes!

Today however Rulan dropped Quant Loader which I believe in turn dropped an Ursnif banking trojan variant. This make s change from it’s usual Chthonic payload. Otherwise it’s the same campaign. This demonstrates the campaign is still active. I have also seen it live twice from malvertising campaigns.

Background Information:

• A few articles on Rig exploit kit and it’s evolution:

https://www.uperesia.com/analyzing-rig-exploit-kit
http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html
http://securityaffairs.co/wordpress/55354/cyber-crime/rig-exploit-kit-cerber.html

• Article on Quant Loader:

https://blogs.forcepoint.com/security-labs/locky-distributor-uses-newly-released-quant-loader-sold-russian-underground

Downloads

(in password protected zip)

• 11-September-2017-Rig-QuantLoader-PCAP-> Pcap of traffic
• 11-September-2017-Rig-QuantLoader-CSV-> CSV of traffic for IOC’s
• 11-September-2017-QuantLoader -> Quant Loader and binaries downloaded
• Quant Loader -> 92e2ba2c8047648af88e89e1c7c2c07752ffb1d299674171a0836aeb9a313894
• Module Downloaded –> 41e17ea8101b4fac481168afed74955d58c230e8df3c590ecbf66e7ed42a11ce

Details of infection chain:

(click to enlarge!)

Rulan leads to Quant Loader which drops Ursnif Variant

Full Details:

The malware downloaded a binary which appeared to communicate using Tor. Exactly what this is I’m not certain but there are a few VT detections for an Ursnif variant. I have always found Ursnif and Dreambot  to request a URL containing “/images/” and a media file like a “avi” or “jpg”. Below you can see a similar request made by this module:

The location it was copied to is also consistent with Dreambot samples I have seen in the past.

Here is the Hybrid Analysis report:

https://www.hybrid-analysis.com/sample/41e17ea8101b4fac481168afed74955d58c230e8df3c590ecbf66e7ed42a11ce?environmentId=100

That’s about all for now, it’s an interesting sample and it is interesting to see Rulan drop another payload other than Chthonic.