2016-01-04 - NEUTRINO EK FROM 45.32.238[.]202 SENDS CRYPTOWALL RANSOMWARE

NOTICE:

ASSOCIATED FILES:

NOTES:

  • https://isc.sans.edu/diary/Actor+using+Angler+exploit+kit+switched+to+Neutrino/20059
  • https://isc.sans.edu/diary/Actor+that+tried+Neutrino+exploit+kit+now+back+to+Angler/20075

    •  


    Shown above:  Traffic from the infection, filtered in Wireshark.

     

    TRAFFIC

    ASSOCIATED DOMAINS:

     

    COMPROMISED SITE:

     

    NEUTRINO EK:

     

    POST-INFECTION CRYPTOWALL TRAFFIC:

     

    ALERTS

    Significant signature hits from Suricata using the Emerging Threats ruleset on Security Onion:

    Significant signature hits from the Talos (Sourcefire VRT) registered ruleset using Snort 2.9.8.0 on Debian 7:

     

    PRELIMINARY MALWARE ANALYSIS

    FLASH EXPLOIT:

    File name:  2016-01-04-Neutrino-EK-flash-exploit.swf
    File size:  86,152 bytes
    MD5 hash:  cb24e563daaf06c61f9373b78b5c7050
    SHA1 hash:  419d983ff021c51ff2de1880d5fe57dc384b537e
    SHA256 hash:  4e7a5e284e6ed9f4a4807aae2189b829a43c216a56f9d2cf73fc7e7e4fe1f414
    Detection ratio (at the time of submission):  1 / 53
    First submission to VirusTotal:  2016-01-04 18:01:01 UTC

     

    MALWARE PAYLOAD (CRYPTOWALL RANSOMWARE):

    File name:  2016-01-04-Neutrino-EK-payload-CryptoWall.exe
    File size:  358,400 bytes
    MD5 hash:  e86daca8abdaf5915d5b93283b62e954
    SHA1 hash:  1d7967ac6303754253296a4529d957141523b5d9
    SHA256 hash:  dbed14393c8c7dc284b94efe9df7d5739ab544ddc17559b23d23281cd0c5ba82
    Detection ratio (at the time of submission):  2 / 54
    First submission to VirusTotal:  2016-01-04 18:03:11 UTC

     

    SCREENSHOTS


    Shown above:  Infected user's Windows desktop after the CryptoWall ransomware infection.

     


    Shown above:  Start of injected script in page from the compromised website (starts at beginning before the opening HTML tags).

     


    Shown above:  End of injected script in page from the comrpomised website (ends with </script> on line 444).

     


    Shown above:  Neutrino EK sends its landing page.

     


    Shown above:  Neutrino EK sends a Flash exploit.

     


    Shown above:  Neutrino EK sends its malware payload (encrypted binary for CryptoWall ransomware).

     


    Shown above:  Example of the CryptoWall ramsomware post-infection traffic.

     

    Click here to return to the main page.