2014-06-06 - CVE-2014-0515 EXPLOIT FROM FLASHPACK EK - 176.9.117[.]170 - SPCIOLV24HKA0E790VWIZGM.ADDIRECTORY[.]ORG

NOTICE:

ASSOCIATED FILES:

NOTES:

UPDATE:

Kafeine has confirmed this is CVE-2014-0515 as posted here

 

CHAIN OF EVENTS

ASSOCIATED DOMAINS:

FLASHPACK EK:

POST-INFECTION CALLBACK TRAFFIC:

 

PRELIMINARY MALWARE ANALYSIS

CVE-2014-0515 FLASH EXPLOIT

File name:  2014-06-06-FlashPack-EK-flash-exploit.swf
File size:  10,192 bytes
MD5 hash:  c49057333ebe34638e7908b43bd23f6c
Detection ratio:  0 / 51
First submission:  2014-06-06 16:48:28 UTC
VirusTotal link:  https://www.virustotal.com/en/file/8a5edd1e23db8054e6b7b76193a70edc7c0924320f4d26ab963aa53cea35ab90/analysis/

File name:  2014-06-06-2014-06-06-Flash-exploit-uncompressed.swf
File size:  11,193 bytes
MD5 hash:  20b5d3a62c337e95463cd32ef6344c80
Detection ratio:  0 / 50
First submission:  2014-06-07 16:54:34 UTC
VirusTotal link:  https://www.virustotal.com/en/file/8bbda5a76249805d88d4869049fc05e57810efcd9e38353486c0d2a7297c5eb8/analysis/

 

MALWARE PAYLOAD

File name:  2014-06-06-FlashPack-EK-malware-payload.exe
File size:  94,972 bytes
MD5 hash:  9e4018fcaaac9e188d942cfe7b4b36f4
Detection ratio:  22 / 51
First submission:  2014-06-07 16:48:18 UTC
VirusTotal link:  https://www.virustotal.com/en/file/5f981b8572797dd2594d17650ceba925d55be0448413e43a674ce046983bfb80/analysis/

 

FOLLOW-UP MALWARE

File name:  2014-06-06-FlashPack-EK-follow-up-malware.exe
File size:  135,692 bytes
MD5 hash:  313e77258a7e51456b0034ee687e6434
Detection ratio:  16 / 51
First submission:  2014-06-07 16:48:36 UTC
VirusTotal link:  https://www.virustotal.com/en/file/b6b5c71e865ff972e606858fb378dea005bbcf05119bf917b62aa8a918cc6660/analysis/

 

ALERTS

ALERTS FOR THE INFECTION TRAFFIC (from Sguil on Security Onion)

Emerging Threats and ETPRO rulesets:

Sourcefire VRT ruleset:

 

HIGHLIGHTS FROM THE TRAFFIC

Cushion redirect to FlashPack EK:

 

POST /tresting/avalonr/json.php:

 

In the above image, the HTTP POST data after id= is hex encoded.  It translates to:

 

HTML after the 200 OK header lines contains hex-encoded data (everything with \x before it).  That translates to:

 

The above trasnlation also contains hex-encoded data.  Translating that shows us the first appearance of flash0515.php

 

HTTP GET request for flash0515.php

 

The hex-encoded data in the above image translates to:

 

The results in the image above also contain hex-encoded data.  The last part of it translates to text showing how the CVE-2014-0515 Flash exploit will be delivered:

 

Here's the CVE-2014-0515 Flash exploit:

 

Here's the malware payload after the successful Flash exploit:

 

Callback traffic from the infected host.  Session:19399 states the TCP port for further callback traffic:

 

Callback traffic on TCP port 19399 with the request for more malware:

 

The actual HTTP GET reqeust for more malware:

 

Click here to return to the main page.