2014-05-25 - ANGLER EK FROM 192.99.41.165 - DENOTING.CENTRIXSF.COM

PCAP AND MALWARE:

NOTES:

 

CHAIN OF EVENTS

ASSOCIATED DOMAINS:

ITEMS FROM COMPROMISED WEBSITE WITH MALICIOUS JAVASCRIPT:

REDIRECTS FROM THE MALICIOUS JAVASCRIPT:

SECOND REDIRECT POINTING TO ANGLER EK:

ANGLER EK:

PAYLOAD FROM ANGLER EK GETS MORE MALWARE:

POST-INFECTION TRAFFIC AFTER THE FOLLOW-UP MALWARE:

 

PRELIMINARY MALWARE ANALYSIS

SILVERLIGHT EXPLOIT

File name:  2014-05-25-Angler-EK-silverlight-exploit.xap
File size:  51.2 KB ( 52467 bytes )
MD5 hash:  e2a6c17c6e5f8bf7b8caec89400f7645
Detection ratio:  0 / 53
First submission:  2014-05-16 14:54:01 UTC
VirusTotal link:  https://www.virustotal.com/en/file/6ffc300642bb3d871940fddef6abd8bbe01f5b913fba7c7a4753786f7cf747a4/analysis/

 

MALWARE PAYLOAD

File name:  2014-05-25-Angler-EK-malware-payload.exe
File size:  164.0 KB ( 167936 bytes )
MD5 hash:  e3a6129a25a2a4c55a57c964575f4d6b
Detection ratio:  3 / 52
First submission:  2014-05-25 08:09:06 UTC
VirusTotal link:  https://www.virustotal.com/en/file/801f4ec08b036d4605a902580ab1454e2659d4f940a42a6474ecb5e10bea9b5b/analysis/
Malwr link:  https://malwr.com/analysis/ZGE5YjI0NTllZmI5NDM5NGIyZTMzMzAxYmM4ZTBmMGU/

 

FIRST POST-INFECTION MALWARE FILE

File name:  2014-05-25-Angler-EK-post-infection-malware-01.exe
File size:  128.0 KB ( 131080 bytes )
MD5 hash:  a043a43f4b993fd2b0eabb594175901b
Detection ratio:  4 / 52
First submission:  2014-05-25 08:10:15 UTC
VirusTotal link:  https://www.virustotal.com/en/file/e4b174c153b239831090faff7bd3b6343c2ca800490d538d81dcca0500eb5566/analysis/
Malwr link:  https://malwr.com/submission/status/Y2I0MTZkNTJmNzAyNDgxY2I2MmQ4NTQyMTU5OGIxYWY/ [analysis still pending]

 

SECOND POST-INFECTION MALWARE FILE

File name:  2014-05-25-Angler-EK-post-infection-malware-02.exe
File size:  225.0 KB ( 230400 bytes )
MD5 hash:  f612500ee9764e18ca78d2e78df5b017
Detection ratio:  3 / 53
First submission:  2014-05-25 01:41:23 UTC
VirusTotal link:  https://www.virustotal.com/en/file/7351e53bd863795104d609f2192e3436d3a07fb597f0bab35d175df88a34c3e0/analysis/
Malwr link:  https://malwr.com/analysis/MWRiZDJkMmI2MGQ4NGRiYWI5ZWJhOWJkZTE4YjU4ZDU/

 

SNORT EVENTS

SNORT EVENTS FOR THE INFECTION TRAFFIC (from Sguil on Security Onion)

 

HIGHLIGHTS FROM THE TRAFFIC

Malicious javascript in the index page from compromised web site--points to first redirect on lifephotoblogs.com:

 

The same script is also appended to any javascript retrieved from the web site.  For example:

 

The first redirect has javascript that points to second redirect at b6e0f620.eu:

 

The second redirect has some base64 script that points to Angler EK at denoting.centrixsf.com:

 

Angler EK delivers Silverlight exploit:

 

EXE payload sent after successful Silverlight exploit:

 

Post-infection: CryptoWall in action on the infected VM::

 

FINAL NOTES

Once again, here are links for the associated files:

ZIP files are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.