2014-06-14 - FIESTA EK FROM 64.202.116[.]151 - DEASTOME[.]IN[.]UA

NOTICE:

• The zip archives on this page have been updated, and they now use the new password scheme.  For the new password, see the "about" page of this website.

ASSOCIATED FILES:

• 2014-06-14-Fiesta-EK-traffic.pcap.zip
• 2014-06-14-Fiesta-EK-malware.zip

 

CHAIN OF EVENTS

ASSOCIATED DOMAINS:

• 199.91.124[.]30 - talkofthevillages[.]com - Compromised website
• 75.102.9[.]195 - easyslowz[.]com - Redirect
• 64.202.116[.]151 - deastome[.]in[.]ua - Fiesta EK

COMPROMISED WEBSITE AND REDIRECT:

• 23:22:25 UTC - talkofthevillages[.]com - GET /
• 23:22:26 UTC - easyslowz[.]com - GET /iuK7boGCJA.js?kWvl=4ce427f

FIESTA EK:

• 23:22:27 UTC - deastome[.]in[.]ua - GET /v20idaf/2
• 23:22:28 UTC - deastome[.]in[.]ua - GET /v20idaf/1b1bc3e2606ec9c94215575951085206005b07595751550904510801070b5c57;112202;228
• 23:22:28 UTC - deastome[.]in[.]ua - GET /v20idaf/40b77fd96fc4fc605d550e0c055d530d0509540c0304540201035b54535e5d5c
• 23:22:29 UTC - deastome[.]in[.]ua - GET /v20idaf/6130c376beb77fdf455d450b510800020708050b5751070d03020a53070b0e53;4060129
• 23:22:30 UTC - deastome[.]in[.]ua - GET /v20idaf/49f93c10027fae2057490d0201580604050050020701010b010a5f5a575b0856;4
• 23:22:31 UTC - deastome[.]in[.]ua - GET /v20idaf/49f93c10027fae2057490d0201580604050050020701010b010a5f5a575b0856;4;1
• 23:22:35 UTC - deastome[.]in[.]ua - GET /v20idaf/26f51f5a9b76ff9a51460d0e035d0255030f500e0504055a07055f56555e0c04;5
• 23:22:36 UTC - deastome[.]in[.]ua - GET /v20idaf/26f51f5a9b76ff9a51460d0e035d0255030f500e0504055a07055f56555e0c04;5;1
• 23:22:37 UTC - deastome[.]in[.]ua - GET /v20idaf/22ba98389b76ff9a5142095a0b03040c030b545a0d5a030307015b025d000a5d;6
• 23:22:38 UTC - deastome[.]in[.]ua - GET /v20idaf/22ba98389b76ff9a5142095a0b03040c030b545a0d5a030307015b025d000a5d;6;1
• 23:23:11 UTC - deastome[.]in[.]ua - GET /v20idaf/1869556c38c80ffc504a5702070e01570001000201570658040b0f5a510d0f06
• 23:23:21 UTC - deastome[.]in[.]ua - GET /v20idaf/4cda5d52507dc03c571b015a075f0206055a525a0106050901505d02515c0c57;1;2
• 23:23:23 UTC - deastome[.]in[.]ua - GET /v20idaf/4cda5d52507dc03c571b015a075f0206055a525a0106050901505d02515c0c57;1;2;1

 

MALWARE

• Flash exploit:   2014-06-14-Fiesta-EK-flash-exploit.swf   (Virus total link)
• Java exploit:   2014-06-14-Fiesta-EK-java-exploit.jar   (Virus total link)
• Silverlight exploit:   2014-06-14-Fiesta-EK-Silverlight-exploit.xap   (Virus total link)
• Malware payload:   2014-06-14-Fiesta-EK-malware-payload.exe   (Virus total link)

 

ALERTS

Emerging Threats and ETPRO rulesets:

• 2014-06-14 23:20:42 UTC - 64.202.116[.]151:80 - ET CURRENT_EVENTS Fiesta URI Struct (sid:2018407)
• 2014-06-14 23:20:42 UTC - 64.202.116[.]151:80 - ET CURRENT_EVENTS Fiesta Flash Exploit Download (sid:2018411)
• 2014-06-14 23:20:43 UTC - 64.202.116[.]151:80 - ET CURRENT_EVENTS Fiesta SilverLight Exploit Download (sid:2018409)
• 2014-06-14 23:20:43 UTC - 64.202.116[.]151:80 - ET CURRENT_EVENTS Possible Neutrino/Fiesta SilverLight Exploit March 05 2014 DLL Naming Convention (sid:2018226)
• 2014-06-14 23:21:25 UTC - 64.202.116[.]151:80 - ET CURRENT_EVENTS Unknown - Java Request - gt 60char hex-ascii (sid:2014912)

Sourcefire VRT ruleset:

• 2014-06-14 23:20:42 UTC - 64.202.116[.]151:80 - EXPLOIT-KIT Fiesta exploit kit outbound connection attempt (sid:29443)
• 2014-06-14 23:20:43 UTC - 64.202.116[.]151:80 - EXPLOIT-KIT Angler exploit kit Silverlight exploit download (sid:28612)
• 2014-06-14 23:21:25 UTC - 64.202.116[.]151:80 - EXPLOIT-KIT Multiple exploit kit jar file download attempt (sid:27816)

NOTE: These alerts were taken from Sguil on Security Onion

 

Click here to return to the main page.