2015-08-27 - ANGLER EK FROM 74.63.210[.]179 SENDS TESLACRYPT 2.0 RANSOMWARE

NOTICE:

• The zip archives on this page have been updated, and they now use the new password scheme.  For the new password, see the "about" page of this website.

ASSOCIATED FILES:

• 2015-08-27-Angler-EK-sends-TeslaCrypt-ransomware.pcap.zip
• 2015-08-27-Angler-EK-and-TeslaCrypt-ransomware-artifacts.zip

 

NOTES:

• Follow-up to a diary I posted at:  https://isc.sans.edu/diary/Actor+that+tried+Neutrino+exploit+kit+now+back+to+Angler/20075/
• I can't share the compromised website that kicked off this particular infection chain; however, the injected script on a page from the site is shown below:

 

CHAIN OF EVENTS

ASSOCIATED DOMAINS:

• 74.63.210[.]179 port 80 - precisiamowolfi.samatter[.]com - Angler EK
• 77.221.130[.]1 port 80 - flagman-gpm[.]com - TeslaCrypt 2.0 ransomware callback

 

ANGLER EK:

• 2015-08-27 15:49:18 UTC - precisiamowolfi.samatter[.]com - GET /civis/viewforum.php?f=7bpv&sid=.2psd9039m68981&

• 2015-08-27 15:49:21 UTC - precisiamowolfi.samatter[.]com - GET /hill.lbc?cell=&cover=f1nrZhb&marriage=xjL&together=iJMh-D&supply=&feed=iQ5byPNu&
  page=&under=IBes1RicYCKvMwg5sdvKW97b

• 2015-08-27 15:49:21 UTC - precisiamowolfi.samatter[.]com - POST /civis/study.fcgi?should=itRdAMn&view=&own=bpae&policy=JDh3B&dollar=&because=ooD&
  talk=qx7gr1WBcM&father=CkwmMu7C2&project=nSGdQWNWGw

• 2015-08-27 15:49:22 UTC - precisiamowolfi.samatter[.]com - GET /hill.lbc?cell=&cover=f1nrZhb&marriage=xjL&together=iJMh-D&supply=&feed=iQ5byPNu&
  page=&under=IBes1RicYCKvMwg5sdvKW97b

• 2015-08-27 15:49:24 UTC - precisiamowolfi.samatter[.]com - GET /individual.asr?detail=qk1X8F&remain=7HZT0Wf&deal=&simple=cNeJ4y5FRm&follow=&
  girl=GkkK59&marry=78o&matter=FOL5EI&function=GIQyk5BTvO

• 2015-08-27 15:49:28 UTC - precisiamowolfi.samatter[.]com - GET /within.htx?month=b1RvXO7_Ri&complete=5_Wl-I&window=diX1MlTLAY&fine=skTFhYlC&
  influence=iQ66fdd4vG&process=b8pr

 

POST-INFECTION TRAFFIC:

• 2015-08-27 15:49:29 UTC - ipinfo[.]io - GET /ip

• 2015-08-27 15:49:29 UTC - flagman-gpm[.]com - GET /r.php?D0B1745184D4B19325F8CA239D78E80477C2B52A3C53B5B18A947BF1E71BBE4EDF1D9D76B1678
  219645D1A720154AED397C30E196DE706B0288C47A9B0664127429FBC81BAADFE54B51522FE48D8237920970789E49956710F61B5CD14A02CEAAA3F8AB6F
  F7315B11918A8C61497A400741F61ED4E2D3717BC087C5F4306367478163FE6F268C34A4C808664CD49B8987E539913B31F0C050E6CE28756DCB01123CC1
  13DBC0E4A0BC604FEA087434E4DA10285EB803ADBB1BB8EC3E6DB40EF768FA43D7A566C3D04306E776EB00813F981572225348AFFBFD1218952E0A3DF76

• 2015-08-27 15:50:01 UTC - flagman-gpm[.]com - GET /r.php?D3ECA3EC23AA62A397F6CA71219BA2F07B913FC1D66753BA6555F6D0CD29F33FE42D5D1F90C8
  02A49F300070B868682926A01B36324A906C02C3808FC79BDEB8E5A2D7DEA7847694A649C10BDE0FE181E7B8ED3314D1054DC7748024ED892111DC9E4CB
  1B166DEF08C3ACCEBB90E4074DA3C4EDAD80BD7018AA74D85FD0CC02D74F6C6C563C2BBE9330FEC3AF137A272213A3BDC83AA8241DC9640E3CF49FDB
  657435DB7087630C5DC3D0053C5E93195

 

 

Click here to return to the main page.