2014-06-15 - NUCLEAR EK FROM 5.45.179[.]4 - CERTIFICAT.ENGLEWOODFLORIDAREALTOR[.]COM

NOTICE:

• The zip archives on this page have been updated, and they now use the new password scheme.  For the new password, see the "about" page of this website.

ASSOCIATED FILES:

• 2014-06-15-Nuclear-EK-traffic.pcap.zip
• 2014-06-15-Nuclear-EK-malware.zip

 

CHAIN OF EVENTS

NUCLEAR EK:

• 02:09:04 UTC - 5.45.179[.]4:80 - certificat.englewoodfloridarealtor[.]com - GET /3885aedbt7ju.html
• 02:09:17 UTC - 5.45.179[.]4:80 - certificat.englewoodfloridarealtor[.]com - GET /2582691206/3/1402777200.jar
• 02:09:17 UTC - 5.45.179[.]4:80 - certificat.englewoodfloridarealtor[.]com - GET /2582691206/3/1402777200.jar
• 02:09:17 UTC - 5.45.179[.]4:80 - certificat.englewoodfloridarealtor[.]com - GET /2582691206/3/1402777200.jar
• 02:09:18 UTC - 5.45.179[.]4:80 - certificat.englewoodfloridarealtor[.]com - GET /f/3/1402777200/2582691206/2
• 02:09:18 UTC - 5.45.179[.]4:80 - certificat.englewoodfloridarealtor[.]com - GET /f/3/1402777200/2582691206/2/2

POST-INFECTION TRAFFIC:

• 02:10:25 UTC - 84.19.191[.]164:80 - market.SBPVSISTERCITY[.]ORG - POST /es/cambios.php
• Also saw repeated DNS queries for:   carbon-fox[.]su

 

MALWARE

• Java exploit:   2014-06-15-Nuclear-EK-java-exploit.jar   (Virus total link)
• Malware payload 1 of 2:   2014-06-15-Nuclear-EK-malware-payload-01.exe   (Virus total link)
• Malware payload 2 of 2:   2014-06-15-Nuclear-EK-malware-payload-02.exe   (Virus total link)

 

ALERTS

Emerging Threats and ETPRO rulesets:

• 2014-06-15 02:07:30 UTC - 5.45.179[.]4:80 - ET CURRENT_EVENTS Nuclear EK JAR URI Struct Nov 05 2013 (sid:2017666)
• 2014-06-15 02:07:31 UTC - 5.45.179[.]4:80 - ET CURRENT_EVENTS Nuclear EK Payload URI Struct Nov 05 2013 (sid:2017667)
• 2014-06-15 02:07:32 UTC - 5.45.179[.]4:80 - ET TROJAN Java EXE Download by Vulnerable Version - Likely Driveby (sid:2013036)
• 2014-06-15 02:08:39 UTC - 84.19.191[.]164:80 - ET TROJAN Fareit/Pony Downloader Checkin 2 (sid:2014411)
• 2014-06-15 02:08:39 UTC - 84.19.191[.]164:80 - ETPRO TROJAN Fareit/Pony Downloader CnC response (sid:2805976)

Sourcefire VRT ruleset:

• 2014-06-15 02:07:30 UTC - 5.45.179[.]4:80 - EXPLOIT-KIT Nuclear exploit kit outbound jar request (sid:30219)
• 2014-06-15 02:07:31 UTC - 5.45.179[.]4:80 - EXPLOIT-KIT Multiple exploit kit jar file download attempt (sid:27816)
• 2014-06-15 02:07:31 UTC - 5.45.179[.]4:80 - EXPLOIT-KIT Nuclear exploit kit outbound payload request (sid:30220)
• 2014-06-15 02:07:31 UTC - 5.45.179[.]4:80 - EXPLOIT-KIT Java User-Agent downloading Portable Executable - Possible exploit kit (sid:25042)
• 2014-06-15 02:07:31 UTC - 5.45.179[.]4:80 - EXPLOIT-KIT Multiple exploit kit single digit exe detection (sid:28423)
• 2014-06-15 02:08:39 UTC - 84.19.191[.]164:80 - MALWARE-CNC Win.Trojan.Zeus encrypted POST Data exfiltration (sid:27919)

NOTE: These alerts were taken from Sguil on Security Onion

 

Click here to return to the main page.