2015-07-16 - ANGLER EK FROM 206.190.134[.]188 SENDS CRYPTOWALL 3.0 RANSOMWARE

NOTICE:

• The zip archives on this page have been updated, and they now use the new password scheme.  For the new password, see the "about" page of this website.

ASSOCIATED FILES:

• 2015-07-16-Angler-EK-sends-CryptoWall-3.0-ransomware-2-pcaps.zip
• 2015-07-16-Angler-EK-and-CryptoWall-3.0-ransomware-files.zip

 

NOTES:

• Bitcoin address for the CryptoWall 3.0 ransomware sample was: 1LY58fiaAYFKgev67TN1UJtRveJh81D2dU (same one I've documented since 2015-07-09).

 

TRAFFIC - EXAMPLE 1 OF 2

ASSOCIATED DOMAINS:

• 94.131.14[.]28 port 80 - uhadnw.hopto[.]org - Redirect from compromised website to Angler
• 206.190.134[.]188 port 80 - serrulateedlperroch.ajuuas-odessa[.]com - Angler EK
• 64.90.49[.]124 port 80 - michaelserwa[.]com - Post-infection CryptoWall 3.0 ransomware traffic
• 95.163.121[.]228 port 80 - 6i3cb6owitcouepv.mywa2pay[.]com - Viewing the decrypt instructions
• 95.163.121[.]228 port 80 - 6i3cb6owitcouepv.micropaysearch[.]com - Viewing the decrypt instructions
• 6i3cb6owitcouepv.light2mind[.]com - Domain for decrypt instructions that didn't resolve
• 6i3cb6owitcouepv.rightslavebb[.]com - Domain for decrypt instructions that didn't resolve

 

TRAFFIC:

• 2015-07-16 15:03:05 UTC - uhadnw.hopto[.]org - GET /wordpress/?bf7N&utm_source=le

• 2015-07-16 15:03:07 UTC - serrulateedlperroch.ajuuas-odessa[.]com - GET /emolument/viewtopic.php?t=40&f=18283025

• 2015-07-16 15:03:11 UTC - serrulateedlperroch.ajuuas-odessa[.]com - GET /really.docmhtml?free=O7TXKeaOWb&tooth=UYHNky-D8&bill=lfGCaAj&God=149iv&
  than=EXm7X3kKY8&much=&French=qu1XH81

• 2015-07-16 15:03:14 UTC - serrulateedlperroch.ajuuas-odessa[.]com - GET /several.sites2?attend=SzF8lBbV7B&far=&other=5bG&be=JvIxcW7ri&speak=&
  provide=jS-oaj6Gg&God=0IeQI&one=AKPn4QmrMbTw

• 2015-07-16 15:03:19 UTC - serrulateedlperroch.ajuuas-odessa[.]com - GET /emolument/oil.ashx?ride=&manager=HHX&drive=&temperature=OoYVqeOG&
  right=4C5Xkcynb&rather=&cut=NNStAWfolTQ5uuN7ZsHwJDVdEQCW

• 2015-07-16 15:03:23 UTC - ip-addr[.]es - GET /
• 2015-07-16 15:03:25 UTC - michaelserwa[.]com - POST /wp-content/plugins/wp-db-backup-made/a.php?i=06sqbz12x9gw
• 2015-07-16 15:03:28 UTC - michaelserwa[.]com - POST /wp-content/plugins/wp-db-backup-made/a.php?c=k28yrc09wsev
• 2015-07-16 15:03:32 UTC - michaelserwa[.]com - POST /wp-content/plugins/wp-db-backup-made/a.php?f=t3mbjwemoqt
• 2015-07-16 15:04:04 UTC - michaelserwa[.]com - POST /wp-content/plugins/wp-db-backup-made/a.php?g=qbwttp03l0
• 2015-07-16 15:04:20 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /-------
• 2015-07-16 15:04:21 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/style.css
• 2015-07-16 15:04:23 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/flags/us.png
• 2015-07-16 15:04:24 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/flags/es.png
• 2015-07-16 15:04:24 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/flags/it.png
• 2015-07-16 15:04:24 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /picture.php?k=1nswsiv&ecbded3b282639c72785713d1feee3d1
• 2015-07-16 15:04:24 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/flags/de.png
• 2015-07-16 15:04:24 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/lt.png
• 2015-07-16 15:04:25 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/flags/fr.png
• 2015-07-16 15:04:25 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/rt.png
• 2015-07-16 15:04:25 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/lb.png
• 2015-07-16 15:04:26 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/rb.png
• 2015-07-16 15:04:27 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /favicon.ico
• 2015-07-16 15:04:34 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - POST /-------
• 2015-07-16 15:04:38 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/flags/ca.png
• 2015-07-16 15:04:38 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/bitcoin.png
• 2015-07-16 15:04:38 UTC - 6i3cb6owitcouepv.mywa2pay[.]com - GET /img/button_pay.png
• 2015-07-16 15:06:53 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /-------
• 2015-07-16 15:06:56 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/style.css
• 2015-07-16 15:06:58 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/flags/us.png
• 2015-07-16 15:06:58 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/flags/it.png
• 2015-07-16 15:06:58 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/flags/es.png
• 2015-07-16 15:06:58 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /picture.php?k=1nswsiv&13c9abbf7bc2de639ecd5dfbd905ae9d
• 2015-07-16 15:06:58 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/rt.png
• 2015-07-16 15:06:58 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/rb.png
• 2015-07-16 15:07:00 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/flags/fr.png
• 2015-07-16 15:07:00 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/flags/de.png
• 2015-07-16 15:07:00 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/lt.png
• 2015-07-16 15:07:00 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/lb.png
• 2015-07-16 15:07:02 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /favicon.ico
• 2015-07-16 15:07:04 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - POST /-------
• 2015-07-16 15:07:06 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/flags/ca.png
• 2015-07-16 15:07:06 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/bitcoin.png
• 2015-07-16 15:07:06 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/button_pay.png
• 2015-07-16 15:07:12 UTC - 6i3cb6owitcouepv.micropaysearch[.]com - GET /img/button_pay_sel.png

 

TRAFFIC - EXAMPLE 2 OF 2

ASSOCIATED DOMAINS:

• 206.190.134[.]188 port 80 - commisissemus.cancerexpo[.]com - Angler EK
• 205.186.156.195 port 80 - ibjja[.]com - Post-infection CryptoWall 3.0 ransomware traffic

 

TRAFFIC:

• 2015-07-16 15:23:26 UTC - commisissemus.cancerexpo[.]com - GET /monomolecular/viewtopic.php?t=39&f=20573126

• 2015-07-16 15:23:30 UTC - commisissemus.cancerexpo[.]com - GET /still.ppthtml?life=T8v-&good=&express=qpt4z&these=&spend=lG77k&
  influence=zujdH9LTDs&because=8v1f&well=&that=HPJ-2UR1y&expect=&change=bMhmAcBzHT&vary=W

• 2015-07-16 15:23:33 UTC - commisissemus.cancerexpo[.]com - GET /monomolecular/poet.website?direction=NzOT2gax&draw=&more=hDzF6-Q&
  finish=&reach=YDv3QN&deal=&especially=QoFCkc&paper=f2BEtJ&company=pGDKC&both=ICBfRnj¢ral=oRr

• 2015-07-16 15:23:34 UTC - commisissemus.cancerexpo[.]com - GET /than.iwdgt?hang=_U4y&color=noq2Z7vsa0&more=aUXIDZ_&date=jrt&
  difficulty=L8L9r4ZEzZ&policy=PiMdXiOix&any=POoYH

• 2015-07-16 15:23:42 UTC - ip-addr.es - GET /
• 2015-07-16 15:23:43 UTC - ibjja[.]com - POST /blog/wp-content/plugins/scribe/lib/history/views/meta-box/c.php?o=ogwh94w53ylq2p
• 2015-07-16 15:23:46 UTC - ibjja[.]com - POST /blog/wp-content/plugins/scribe/lib/history/views/meta-box/c.php?s=hcg1roit8y8
• 2015-07-16 15:23:49 UTC - ibjja[.]com - POST /blog/wp-content/plugins/scribe/lib/history/views/meta-box/c.php?y=ldo61h1m3irff65
• 2015-07-16 15:23:58 UTC - ibjja[.]com - POST /blog/wp-content/plugins/scribe/lib/history/views/meta-box/c.php?e=7202mtc4kna

 

Click here to return to the main page.