Summary:

Today Rig EK dropped what looked like an infomation stealer. Based on the URL structure and the location in which it was copied and maintains persistence I believe this to be a Ursnif/ISFB variant.

I browsed to a website and watched it copy my browsing traffic into a folder and then periodically POST it to a C2 server bundled into a .bin file. The replies also contained an unusual header which indicated i was “infected”.

Background Information:

• A few articles on Rig exploit kit and it’s evolution:

https://www.uperesia.com/analyzing-rig-exploit-kit
http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html
http://securityaffairs.co/wordpress/55354/cyber-crime/rig-exploit-kit-cerber.html

Downloads

(in password protected zip)

• 17-October-2017-Rig-Ursnif-PCAP-> Pcap of traffic (note this pcap is a bit bare)
• 17-October-2017-Rig-Ursnif-CSV-> CSV of traffic for IOC’s
• 17-October-2017-Ursnif> Ursnif Variant  –
  

  c7bdd2ce90b35f5796531290ebac12557a68e237924b980e69e8b3265e261445

Details of infection chain:

(click to enlarge!)

Full Details:

The infection chain originated from malvertising. A 302 redirect sends the user to Rig EK landing page

 

Summary:

Yesterday I caught Rig EK dropping a variant of Smoke Loader which is different to todays one. Today’s sample is more consistent with what you would expect from Smoke Loader with its connectivity checks to popular domains like Microsoft and its attempts to hide processes. Yesterdays sample did not do any of this so campaign is likely ran by different threat actors.

This time only an XMR miner was dropped which did begin to connect to the mining server on port 4444. No other payloads were witnessed.  It’s worth keeping an eye on the IP of the domain that redirected to Rig EK as I’m sure it will be hosting different payloads later.

Background Information:

• A few articles on Rig exploit kit and it’s evolution:

https://www.uperesia.com/analyzing-rig-exploit-kit
http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html
http://securityaffairs.co/wordpress/55354/cyber-crime/rig-exploit-kit-cerber.html

Downloads

(in password protected zip)

• 14-October-2017-Rig-Smoke-PCAP-> Pcap of traffic
• 14-October-2017-Rig-Smoke-CSV-> CSV of traffic for IOC’s
• 14-October-2017-Rig-Smoke-> Smoke Loader  – faebfbfb3939abae9d566c332105bfdaa97529fe6a9fa769b3046069b0617caa

Smoke Loader- https://www.virustotal.com/#/file/faebfbfb3939abae9d566c332105bfdaa97529fe6a9fa769b3046069b0617caa/detection

XMR Miner – https://www.virustotal.com/#/file/2b83c69cf32c5f8f43ec2895ec9ac730bf73e1b2f37e44a3cf8ce814fb51f120/details

Details of infection chain:

(click to enlarge!)

Full Details:

The infection chain actually came from malvertising. The webpage contained a 1px iframe which leads to Rig EK.

 

Summary:

Been an interesting few weeks and I haven’t been able to update but the other researchers appear to have found a few interesting things. I thought I would blog if anyone wanted a pcap to look at.

I actually found this through my normal malvertising route. After pondering and assistance the payload was determined to be Smoke Loader leading to a Miner and AZORult stealer. It’s an interesting sample! Thanks to @James_inthe_box  for looking into it deeper.

Background Information:

• A few articles on Rig exploit kit and it’s evolution:

https://www.uperesia.com/analyzing-rig-exploit-kit
http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html
http://securityaffairs.co/wordpress/55354/cyber-crime/rig-exploit-kit-cerber.html

Downloads

(in password protected zip)

• 13-October-2017-Rig-Miner-PCAP-> Pcap of traffic
• 13-October-2017-Rig-Miner-CSV-> CSV of traffic for IOC’s
• 13-October-2017-Rig-Miner-> Smoke Loader  – 60489385b91478d36e4d027e70d662a861f305cc5d4bdce20f312ac1c7c2f126

Details of infection chain:

(click to enlarge!)

Full Details: