|
Introduction By Monday 2016-06-06, the pseudo-Darkleech campaign began using Neutrino exploit kit (EK) to send CryptXXX ransomware [1]. Until then, I'd only seen Angler EK distribute CryptXXX. However, this is not the first time we've seen campaigns associated with ransomware switch between Angler EK and Neutrino EK [2, 3, 4, 5]. It was documented as early as August 2015 [2]. This can be confusing, especially if you're expecting Angler EK. Campaigns can (and occasionally do) switch EKs. For an explanation of EK fundamentals, see this blog post. On Tuesday 2016-06-07, I found a compromised website with injected script from two different campaigns: pseudo-Darkleech and EITest. On that day, both campaigns were distributing CryptXXX ransomware. In today's diary, we examine two examples of Neutrino EK triggered by the same compromised website. One example starts with pseudo-Darkleech script, and the other starts with EITest script. Pcaps for today's ISC diary can be found here.
Of note, I've never seen both infections at the same time. I've only generated EK traffic from one campaign or the other. Injected script from the pseudo-Darkleech campaign tends to prevent injected script by other campaigns from running. Development and spread of CryptXXX Below is a timeline with documenting the development of CryptXXX and its spread from pseudo-Darkleech to other campaigns. It's not a complete list of everything about CryptXXX, but it provides a general outline.
Proofpoint's most recent entry lists the version history of CryptXXX from 1.001 on April 16th to version 3.100 on May 26th. It also describes some new tricks CryptXXX has up its sleeve. Infection traffic from Tuesday 2016-06-07 On Tuesday 2016-06-07, I found a website with injected script for both the pseudo-Darkleech campaign and the EITest campaign.
I was able to generate traffic for each campaign, but I had to use two separate visits, because the pseudo-Darkleech script prevented the EITest script from generating any EK traffic.
The Wireshark filter used in the above two images was: http.request or (!(tcp.port eq 80) and tcp.flags eq 0x0002) Indicators of compromise (IOCs) from the traffic follow:
In both cases, Neutrino EK delivered CryptXXX ransomware as a DLL file. As usual with CryptXXX infections, we saw C:\Windows\System32\rundll32.exe copied to the same folder as the CryptXXX DLL file. In this case, it was re-named explorer.exe.
The two CryptXXX DLL files from these infections are:
CryptXXX will have different domains in the decryption instructions depending on the campaign it came from. In the two images below, you'll find different domains used in instructions from the EITest CryptXXX sample and instructions from the pseudo-Darkleech CryptXXX sample.
Although CryptXXX samples from a specific campaign are changed or updated as the day progresses, they will always be different from CryptXXX samples from another campaign during the same timeframe. Checking the traffic on Security Onion using Suricata and the ETPro ruleset, I found the usual alerts for Neutrino EK traffic and CryptXXX callback after the initial infection.
Last month, Neutrino EK was documented using Flash exploits based on CVE-2016-4117 effective against Adobe Flash Player up to version 21.0.0.213 [15]. Post-infection traffic for CryptXXX is similar to what we've seen before. Overall, we found no real surprises from these infections. The only interesting fact is the switch (for now) from Angler EK to Neutrino EK to deliver CryptXXX.
As stated earlier, EmergingThreats has a rule for CryptXXX callback traffic. Talos also has you covered for CryptXXX in the Snort subscriber ruleset.
Final words Traffic patterns for Neutrino EK have remained relatively consistent since it reappeared in November 2014 after a 6-month absence [16]. The only big change? Neutrino EK now sticks to port 80. Before October or November of 2015, Neutrino EK almost always used a non-standard port for its HTTP traffic. Since then, it's consistently used TCP port 80 (like every other EK I currently see). How can people protect themselves against Neutrino EK? As always, properly administered Windows hosts that follow best security practices (up-to-date applications, latest OS patches, software restriction policies, etc.) should be protected against this EK threat. Unfortunately, a large percentage of Windows hosts don't follow best practices, and criminal groups are quick to take advantage. User awareness is an important part of any defense. You can't protect yourself from threats you don't understand. With that in mind, I'll mention again a post on EK fundamentals located here. It hopefully clears up some misconceptions I've heard over the years about EK activity. Pcaps and malware for this ISC diary can be found here.
--- References: [1] http://malware-traffic-analysis.net/2016/06/06/index.html/ |
Brad 357 Posts ISC Handler |
| Subscribe |
Jun 8th 2016 3 years ago |
Sign Up for Free or Log In to start participating in the conversation!
