Introduction The Angler exploit kit (EK) is being used to push a new variant of TeslaCrypt/AlphaCrypt ransomware. I've been documenting cases of Angler EK pushing AlphaCrypt in recent weeks [1][2][3]. Last week on 2015-05-07, I started seeing a new variant [4]. This new variant has a popup window that uses CTB-Locker-style instructions. As seen below, this variant doesn't provide a name for itself in the decrypt instructions. The same malware sample used a different bitcoin address for each host it infected. Traffic Characteristics of this New Ransomware Variant The traffic appears identical to what we've seen with previous infections from TeslaCrypt and AlphaCrypt. A few hours ago I infected a host from a site using Angler EK and received similar alerts from the network traffic.
A sample of the ransomware can be found at: I infected 4 different hosts with Angler EK in a 5-hour timeframe and received the same ransomware. It was the same file with the same hash each time. However, the bitcoin address for the ransom payment was different for each infected host. Shown below are decrypt pages from the other 3 hosts: Here are the bitcoin addresses from these infected hosts:
Pcap files of the infection traffic (Angler EK and the post-infection) are available at:
Final Words From what I can tell, TeslaCrypt and AlphaCrypt are very similar to CryptoLocker. This new, unnamed variant appears to be another evolution from this family of ransomware. I've been seeing a lot of Angler EK lately. In recent weeks, more often than not, it's been pushing ransomware. Since 2015-05-07, I've only seen this new variant. --- References: [1] http://malware-traffic-analysis.net/2015/04/30/index.html |
Brad 432 Posts ISC Handler May 12th 2015 |
Thread locked Subscribe |
May 12th 2015 7 years ago |
Getting multiple emails for this one post...
|
Tri0x 17 Posts |
Quote |
May 12th 2015 7 years ago |
Any specific directory or folder that this drops in?
|
Tri0x 1 Posts |
Quote |
Jun 28th 2016 5 years ago |
Sign Up for Free or Log In to start participating in the conversation!