2015-04-09 - NUCLEAR EK DELIVERS TROLDESH RANSOMWARE

ASSOCIATED FILES:

 

NOTES:

 


Shown above: One of the text files with instructions to decrypt your files.

 


Shown above: The desktop background image telling you to look at the README.txt files.

 

CHAIN OF EVENTS

NUCLEAR EK FROM 108.61.188.200 PORT 80:

 

POST-INFECTION TRAFFIC:

 

SNORT EVENTS

Signature hits from the Emerging Threats and ETPRO rulesets using Sguil on Security Onion (without ET POLICY, ET INFO, or ET TOR events):

Significant signature hits from the Talos (Sourcefire VRT) ruleset using Snort 2.9.7.2 on Debian 7:

 

PRELIMINARY MALWARE ANALYSIS

FLASH EXPLOIT:

File name:  2015-04-09-Nuclear-EK-flash-exploit.swf
File size:  15.1 KB ( 15463 bytes )
MD5 hash:  aac06dd10cfe2f04867e674cf8485686
Detection ratio:  0 / 57
First submission:  2015-04-09 19:29:26 UTC
VirusTotal link:  https://www.virustotal.com/en/file/6048f8c0e63658005ece9165a5ed1ade3fd8ac64f96b4409f1330cb7aebfd53c/analysis/

 

MALWARE PAYLOAD:

File name:  2015-04-09-Nuclear-EK-malware-payload.exe
File size:  908.0 KB ( 929792 bytes )
MD5 hash:  5a4834df63b62f4ca8de004fbbd23ae6
Detection ratio:  8 / 57
First submission:  2015-04-09 19:29:39 UTC
VirusTotal link:  https://www.virustotal.com/en/file/4329a3730c04c6c43b8261e246d861379e75ae01f8a997ad1df845a36a191d32/analysis/
Malwr link:  https://malwr.com/analysis/YjQ4NjVlNWNkYjljNDAxYWJlYzQwMDk3YzA2ZmU1N2Y/

 

SCREENSHOTS FROM THE TRAFFIC

HTTP requests and TLS traffic noted in Wireshark:

 

Nuclear EK landing page:

 

Nuclear EK sending a Flash exploit:

 

Nuclear EK sending an obfuscated malware payload:

 

Post-infection traffic that generated the ETPRO TROJAN alert for Win32/Troldesh.A Ransomware External IP Check:

 

FINAL NOTES

Once again, here are the associated files:

ZIP files are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.