2013-08-23 - G01PACK EXPLOIT KIT & RANSOMWARE

PCAP AND MALWARE:

 

NOTES:

Searching through the CLEAN MX realtime database, I found a compromised site named mpraid3.com.  According to the whois on the domain name, noraud3.com was registered on 2013-08-21, only 2 days prior to this blog entry.  It was registered through DomainContext, Inc.  From what I can tell, this is a registrar based in Russia.  The domain is hosted on 192.133.137.142, which is registered to Serverel.com, a hosting provider based in Sunnyvale, California.

When we visit that website in a vulnerable Windows host, it doesn't go to a website, but redirects to some malicious code that provides a blank page.  Within a few seconds, the vulnerable Windows host is infected with "ransomware" that locks your computer with a fake notice as shown below...

 

SNORT EVENTS

Using Security Onion to monitor a vulnerable Windows computer, the following events triggered in Sguil when typing mpraid3.com into a web browser:

INFECTION TRAFFIC

The first HTTP GET request was to mpraid3.com on 192.133.137.142, which returned a 302 with a redirect to the malware delivery domain at kucf.3wasnev.info on 5.149.255.102.

Here are all the actors involved in this traffic:

Here's an overview of the infection traffic:

INFECTION TRAFFIC DETAILS

GET /
IP address: 192.133.137.142
domain name: mpraid3.com

Sguil events: None

Screenshot of the traffic:

 

GET /?52c4cd7199af493d987fa2366f66c99b=r9&5eec33d94eb1695a176b0322ddf07048=mpraid3.com
IP address: 5.149.255.102
domain name: kucf.3wasnev.info

Sguil events:

Screenshot of traffic:

 

GET /6c2c7b0be76e03a583fc65dc488fdbff/c8d54b59e486a9fc421fcd4f70f5a36e.swf
IP address: 5.149.255.102
domain name: kucf.3wasnev.info

Sguil event:

Screenshot of traffic:

 

GET /6c2c7b0be76e03a583fc65dc488fdbff/a73370ca160391ecf91ebf547b502d7a.jnlp
IP address: 5.149.255.102
domain name: kucf.3wasnev.info

Sguil events:

Screenshot of traffic:

 

GET /6c2c7b0be76e03a583fc65dc488fdbff/5ce0ac3225e2cc25264b5f827f176f51.jar
IP address: 5.149.255.102
domain name: kucf.3wasnev.info

Sguil events:

Screenshot of traffic:

 

GET /6c2c7b0be76e03a583fc65dc488fdbff/0
IP address: 5.149.255.102
domain name: kucf.3wasnev.info

Sguil event:

Screenshot of traffic:

This is an executable that's been XOR-ed with 2A (hexadecimal for the asterisk symbol "*") on each byte.  Here's what the beginning of the file looks like in a hex editor before it's decoded:
There are a few different ways to convert the file.  For example, the following Python script should do the trick, assuming the file you extract from Wireshark is named extracted-file.bin:
b = bytearray(open('extracted-file.bin', 'rb').read())
for i in range(len(b)):
    b[i] ^= 0x2A
open('output-binary.exe', 'wb').write(b)
Here's what it looks like after every byte is XOR-ed with 0x2A:

 

GET /6c2c7b0be76e03a583fc65dc488fdbff/4
IP address: 5.149.255.102
domain name: kucf.3wasnev.info

Screenshot of traffic:

This was the second executable.  In this case, each byte is XOR-ed with 0x0f.  If you review the PCAP, you'll see each malicious executable was sent twice, with a different character used to XOR each binary.

 

The following callback traffic occurred, and some more malicious files were returned.  Review the PCAP for further information on this additional traffic.

PRELIMINARY MALWARE ANALYSIS

Java exploit from 5.149.255.102 (kucf.3wasnev.info):

https://www.virustotal.com/en/file/8c95ee3c4ba389dab0dd1d54fef00728a9bac3344df04bbf46994829478479d6/analysis/1377314813/

File name:  java-exploit-from-kucf.3wasnev.info.jar
File size:  15.5 KB ( 15900 bytes )
MD5:  760c5b866d28ebf68bc5d376164b428b
Detection ratio:  2 / 46

First malicious executable from 5.149.255.102 (kucf.3wasnev.info):

https://www.virustotal.com/en/file/fc01b4102926c8975de5831b470d3e2ab2b5f105a0143e33397d89d0f35060f5/analysis/1377314840/

File name:  first-malicious-executable-from-kucf.3wasnev.info.exe
File size:  182.0 KB ( 186369 bytes )
MD5:  8131f6c79a87235bd6bb0f4035757dd2
Detection ratio:  1 / 46

Second malicious executable from 5.149.255.102 (kucf.3wasnev.info):

https://www.virustotal.com/en/file/bfae1b2a7cd32bc4cc58d9779baefc5f1e3b9f6f1eca34061a53c1360025ef4f/analysis/1377314862/

File name:  second-malicious-executable-from-kucf.3wasnev.info.exe
File size:  276.0 KB ( 282625 bytes )
MD5:  85485ae602ec53395929a344fd1a6bcd
Detection ratio:  0 / 37

FINAL NOTES

Once again, here are the associated files:

ZIP files are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.