2015-07-10 - ANGLER EK FROM 176.9.245[.]142 SENDS CRYPTOWALL 3.0 RANSOMWARE

NOTICE:

• The zip archives on this page have been updated, and they now use the new password scheme.  For the new password, see the "about" page of this website.

ASSOCIATED FILES:

• 2015-07-10-Angler-EK-sends-CrytoWall-3.0-ransomware.pcap.zip
• 2015-07-10-Angler-EK-and-CryptoWall-3.0-ransomware-files.zip

 

NOTES:

• Bitcoin address for the CryptoWall 3.0 ransomware sample was: 1LY58fiaAYFKgev67TN1UJtRveJh81D2dU (same as the past two days).

 

CHAIN OF EVENTS

ASSOCIATED DOMAINS:

• 176.9.245[.]142 port 80 - commotusque.lennydepaul[.]com - Angler EK
• 185.28.23[.]14 port 80 - bigappledreaming[.]com - CryptoWall 3.0 ransomware check-in
• 95.163.121[.]228 port 80 - 6i3cb6owitcouepv.mywa2pay[.]com - Viewing one of the decrypt instructions pages
• 95.163.121[.]228 port 80 - 6i3cb6owitcouepv.micropaysearch[.]com - Viewing another of the decrypt instructions pages
• 6i3cb6owitcouepv.light2mind[.]com - DNS query for one of the decrypt pages that didn't resolve
• 6i3cb6owitcouepv.rightslavebb[.]com - DNS query for one of the decrypt pages that didn't resolve

 

ANGLER EK:

• 2015-07-10 22:17:40 UTC - commotusque.lennydepaul[.]com - GET /intriguing/viewtopic.php?f=48&t=70417552

• 2015-07-10 22:17:42 UTC - commotusque.lennydepaul[.]com - GET /hope.wrf?money=&six=07ev5N1BEu&horse=&first=wdcU8dbG&because=Kn-MoLz&
  love=ARnaB0rRdX&army=g_caz_SQ_&try=&particular=oC4=

• 2015-07-10 22:17:48 UTC - commotusque.lennydepaul[.]com - GET /intriguing/hope.sht?then=&cut=L0U&that=OZJSFfF7&remove=XMy-1&realize=v0n&
  serious=ko8hxs8w0_bnkjAWA_VDarQ5BNsXF

• 2015-07-10 22:17:50 UTC - commotusque.lennydepaul[.]com - GET /wife.shtml?better=ilsGdwB9-r&since=&lead=4K_-2V&fine=&story=fBwieu30zAwE44w03-
  ZnxQpv_QpCtFct

 

CRYPTOWALL 3.0 POST-INFECTION TRAFFIC:

• 2015-07-10 22:17:53 UTC - ip-addr[.]es - GET /
• 2015-07-10 22:17:56 UTC - bigappledreaming[.]com - POST /wp-content/themes/aa.php?z=dha0a96vu9
• 2015-07-10 22:17:59 UTC - bigappledreaming[.]com - POST /wp-content/themes/aa.php?r=34q25ye568ccpv
• 2015-07-10 22:18:02 UTC - bigappledreaming[.]com - POST /wp-content/themes/aa.php?l=fbh4p0k0ze570
• 2015-07-10 22:18:12 UTC - bigappledreaming[.]com - POST /wp-content/themes/aa.php?l=xwt1b9x1i8
• 2015-07-10 22:18:26 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /1Nswsiv
• 2015-07-10 22:18:30 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/style.css
• 2015-07-10 22:18:30 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/flags/us.png
• 2015-07-10 22:18:30 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/flags/it.png
• 2015-07-10 22:18:30 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/flags/fr.png
• 2015-07-10 22:18:30 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/flags/es.png
• 2015-07-10 22:18:30 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/flags/de.png
• 2015-07-10 22:18:31 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /picture.php?k=1nswsiv&778a4086808184848d9b257f8c45fce4
• 2015-07-10 22:18:32 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/lt.png
• 2015-07-10 22:18:33 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/rt.png
• 2015-07-10 22:18:33 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/lb.png
• 2015-07-10 22:18:33 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/rb.png
• 2015-07-10 22:18:37 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /favicon.ico
• 2015-07-10 22:18:40 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - POST /1Nswsiv
• 2015-07-10 22:18:42 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/bitcoin.png
• 2015-07-10 22:18:42 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/button_pay.png
• 2015-07-10 22:18:52 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /1Nswsiv
• 2015-07-10 22:18:54 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/style.css
• 2015-07-10 22:18:54 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/flags/us.png
• 2015-07-10 22:18:54 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/flags/es.png
• 2015-07-10 22:18:54 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/flags/it.png
• 2015-07-10 22:18:54 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/flags/fr.png
• 2015-07-10 22:18:54 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/flags/de.png
• 2015-07-10 22:18:55 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /picture.php?k=1nswsiv&314834718128a4884b0120f2e75e3b19
• 2015-07-10 22:18:56 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/lt.png
• 2015-07-10 22:18:56 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/rt.png
• 2015-07-10 22:18:56 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/lb.png
• 2015-07-10 22:18:56 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/rb.png
• 2015-07-10 22:18:58 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /favicon.ico
• 2015-07-10 22:19:03 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - POST /1Nswsiv
• 2015-07-10 22:19:05 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/bitcoin.png
• 2015-07-10 22:19:05 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/button_pay.png

 

Click here to return to the main page.