2016-07-22 - PSEUDO-DARKLEECH NEUTRINO EK FROM 188.138.70[.]188 SENDS CRYPTXXX RANSOMWARE

NOTICE:

• The zip archives on this page have been updated, and they now use the new password scheme.  For the new password, see the "about" page of this website.

ASSOCIATED FILES:

• 2016-07-22-pseudoDarkleech-Neutrino-EK-sends-CryptXXX-ransomware.pcap.zip   462.4 kB (462,413 bytes)

• 2016-07-22-pseudoDarkleech-Neutrino-EK-sends-CryptXXX-ransomware.pcap   (490,851 bytes)

• 2016-07-22-pseudoDarkleech-Neutrino-EK-and-CryptXXX-ransomware-files.zip   429.7 kB (429,686 bytes)

• 2016-07-22-page-from-chromechurch_com-with-injected-script.txt   (7,848 bytes)
• 2016-07-22-pseudoDarkleech-Neutrino-EK-flash-exploit.swf   (77,210 bytes)
• 2016-07-22-pseudoDarkleech-Neutrino-EK-landing-page.txt   (2,687 bytes)
• 2016-07-22-pseudoDarkleech-Neutrino-EK-payload-CryptXXX-ransomware.dll   (365,056 bytes)

NOTES:

• 2016-07-02 - SANS ISC diary:  Change in patterns for the pseudoDarkleech campaign
• 2016-07-06 - SANS ISC diary:  CryptXXX ransomware updated
• 2016-07-07 - Bleeping Computer:  New CryptXXX changes name to Microsoft Decryptor

• 2016-07-14 - Proofpoint Blog:  Spam, Now With a Side of CryptXXX Ransomware!

  "We believe that CryptXXX is in active development and possibly split off into two branches. The original branch is now up to version 5.001 (we wrote about the upgrade to version 3.100 near the end of May), while the new branch uses a different format for versioning and will require further analysis."

• I've seen both versions of CryptXXX raansomware since 2016-07-06.  Not sure which version this sample is, though.

• In the past 2 days, this infection showed MMS0 as the entry point when loading the CryptXXX raansomware DLL.  However, I was unable to get today's sample to generate any post-infection activity from this sample.  I've tried the sample on different virtual and physical hosts.

• I've noticed chromechurch[.]com compromised as early as 2016-06-30 and redirecting to Neutrino EK.

 

Shown above:  Flowchart for this infection traffic.

 

TRAFFIC

Shown above:  Injected script in page from compromised website.

 

Shown above:  Traffic from the pcap filtered in Wireshark.

 

ASSOCIATED DOMAINS:

• chromechurch[.]com - Compromised website
• 188.138.70[.]188 port 80 - nagatoyu-cacamo.healthbusinessmatters[.]com - Neutrino EK

DOMAINS FROM THE DECRYPT INSTRUCTIONS:

• Not applicable (wasn't able to get the CryptXXX raansomware binary to run).

 

FILE HASHES

FLASH FILES:

• SHA256 hash:  59c8253d230af40ece96b4a6907be36e9c039a0798d622a0f40408cc45071e4a
  File name:  2016-07-22-pseudoDarkleech-Neutrino-EK-flash-exploit.swf

PAYLOAD:

• SHA256 hash:  13811980e883157e61ad3a2a2ac56764368daed5b886a78b79bd1c6fd798122c
  File name:  2016-07-22-pseudoDarkleech-Neutrino-EK-payload-CryptXXX-raansomware.dll

 

Click here to return to the main page.