2014-05-25 - ANGLER EK FROM 192.99.41[.]165 - DENOTING.CENTRIXSF[.]COM

NOTICE:

ASSOCIATED FILES:

NOTES:

 

CHAIN OF EVENTS

ASSOCIATED DOMAINS:

ITEMS FROM COMPROMISED WEBSITE WITH MALICIOUS JAVASCRIPT:

REDIRECTS FROM THE MALICIOUS JAVASCRIPT:

SECOND REDIRECT POINTING TO ANGLER EK:

ANGLER EK:

PAYLOAD FROM ANGLER EK GETS MORE MALWARE:

POST-INFECTION TRAFFIC AFTER THE FOLLOW-UP MALWARE:

 

PRELIMINARY MALWARE ANALYSIS

SILVERLIGHT EXPLOIT

File name:  2014-05-25-Angler-EK-silverlight-exploit.xap
File size:  52,467 bytes
MD5 hash:  e2a6c17c6e5f8bf7b8caec89400f7645
Detection ratio:  0 / 53
First submission:  2014-05-16 14:54:01 UTC
VirusTotal link:  https://www.virustotal.com/en/file/6ffc300642bb3d871940fddef6abd8bbe01f5b913fba7c7a4753786f7cf747a4/analysis/

 

MALWARE PAYLOAD

File name:  2014-05-25-Angler-EK-malware-payload.exe
File size:  167,936 bytes
MD5 hash:  e3a6129a25a2a4c55a57c964575f4d6b
Detection ratio:  3 / 52
First submission:  2014-05-25 08:09:06 UTC
VirusTotal link:  https://www.virustotal.com/en/file/801f4ec08b036d4605a902580ab1454e2659d4f940a42a6474ecb5e10bea9b5b/analysis/

 

FIRST POST-INFECTION MALWARE FILE

File name:  2014-05-25-Angler-EK-post-infection-malware-01.exe
File size:  131,080 bytes
MD5 hash:  a043a43f4b993fd2b0eabb594175901b
Detection ratio:  4 / 52
First submission:  2014-05-25 08:10:15 UTC
VirusTotal link:  https://www.virustotal.com/en/file/e4b174c153b239831090faff7bd3b6343c2ca800490d538d81dcca0500eb5566/analysis/

 

SECOND POST-INFECTION MALWARE FILE

File name:  2014-05-25-Angler-EK-post-infection-malware-02.exe
File size:  230,400 bytes
MD5 hash:  f612500ee9764e18ca78d2e78df5b017
Detection ratio:  3 / 53
First submission:  2014-05-25 01:41:23 UTC
VirusTotal link:  https://www.virustotal.com/en/file/7351e53bd863795104d609f2192e3436d3a07fb597f0bab35d175df88a34c3e0/analysis/<

 

ALERTS

ALERTS FOR THE INFECTION TRAFFIC (from Sguil on Security Onion)

 

HIGHLIGHTS FROM THE TRAFFIC

Malicious javascript in the index page from compromised web site--points to first redirect on lifephotoblogs.com:

 

The same script is also appended to any javascript retrieved from the web site.  For example:

 

The first redirect has javascript that points to second redirect at b6e0f620.eu:

 

The second redirect has some base64 script that points to Angler EK at denoting.centrixsf[.]com:

 

Angler EK delivers Silverlight exploit:

 

EXE payload sent after successful Silverlight exploit:

 

Post-infection: CryptoWall in action on the infected VM::

 

Click here to return to the main page.