2015-01-01 - NUCLEAR EK (OPERATION WINDIGO) FROM 67.215.2.195 - JKARBQS789VHNMQZN919NHM.EKAY61.COM

ASSOCIATED FILES:

 

NOTES:

 

CHAIN OF EVENTS

ASSOCIATED DOMAINS:

 

COMPROMISED WEBSITE AND URL THAT RETURNED THE REDIRECT:

 

CUSHION REDIRECT:

 

NUCLEAR EK:

 

POST-EK TRAFFIC TO ADULTFRIENDFINDER:

 

POST-INFECTION TRAFFIC IN A VM:

 

SNORT EVENTS - INITIAL INFECTION

Emerging Threats and ETPRO rulesets from Sguil on Security Onion monitoring the infection traffic using Suricata (not including ET INFO or ET POLICY rules):

 

Sourcefire VRT ruleset from Snort 2.9.7.0 on Debian 7 using tcpreplay:

 

SNORT EVENTS - RUNNING GLUPTEBA IN A VM

Emerging Threats and ETPRO rulesets from Sguil on Security Onion monitoring the infection traffic using Suricata (not including ET INFO or ET POLICY rules):

 

Sourcefire VRT ruleset from Snort 2.9.7.0 on Debian 7 using tcpreplay:

 

PRELIMINARY MALWARE ANALYSIS

FLASH EXPLOIT

File name:  2015-01-01-Nuclear-EK-flash-exploit.swf
File size:  23.0 KB ( 23574 bytes )
MD5 hash:  b2caafaffe671c5d01ba8e4639c8b694
Detection ratio:  1 / 54
First submission:  2014-12-29 11:21:03 UTC
VirusTotal link:  https://www.virustotal.com/en/file/a4ffa77ead9a12f8c92baf56811c8fecea00318237c14873a4d1365e59383dc0/analysis/

 

SILVERLIGHT EXPLOIT

File name:  2015-01-01-Nuclear-EK-silverlight-exploit.xap
File size:  18.6 KB ( 19011 bytes )
MD5 hash:  1758856cf438d3e4f6bf9bbba7fa57e7
Detection ratio:  0 / 55
First submission:  2015-01-01 03:17:00 UTC
VirusTotal link:  https://www.virustotal.com/en/file/1a9d7563bc019b7563344213f1d70d36c49092a20581581b3829cd6be3deedd1/analysis/

 

MALWARE PAYLOAD (GLUPTEBA)

File name:  2015-01-01-Nuclear-EK-malware-payload.exe
File size:  113.3 KB ( 116010 bytes )
MD5 hash:  09708c49ffb1556c9b80b3a2dc1f57fe
Detection ratio:  16 / 56
First submission:  2015-01-01 03:17:14 UTC
VirusTotal link:  https://www.virustotal.com/en/file/3131530e33f806f9a65879a3948c41cae29acb240687b0bede928d28fd4151bf/analysis/
Malwr link:  https://malwr.com/analysis/OGU3MzNmOWY1MTk3NGQzNmJkMGU1YTUzNGVkM2U3ZTc/

 

SCREENSHOTS FROM THE TRAFFIC

HTTP GET request that returns a 302 Found for the Cushion redirect:

 

First HTTP GET request for the Cushion redirect:

 

Second HTTP GET request for the Cushion redirect:

 

Nuclear EK sends Flash exploit:

 

Nuclear EK sends Silverlight exploit:

 

EXE payload sent after successful exploit.  The malware payload is XOR-ed with the ASCII string:&bnsp; rhiPcRu

 

Post-infection traffic from the infected VM:

 

FINAL NOTES

Once again, here are the associated files:

ZIP files are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.