Hackin9

Dark Reading

10 Tips for Securing Your SAP Implementation
Dark Reading
Sean Martin is an information security veteran of nearly 25 years and a four-term CISSP with articles published globally covering security management, cloud computing, enterprise mobility, governance, risk, and compliance—with a focus on specialized ...

 

The Register

Bypass the Windows AppLocker bouncer with a tweet-size command
The Register
... and should leave no trace on disk as it's a pure to-memory download. No patch exists for this, although regsvr32 can be firewalled off from the internet. Microsoft was not available for immediate comment. Infosec researcher Kenn White said: "This ...

and more »
 

Introduction

On Friday 2016-04-15, Proofpoint researchers spotted CryptXXX [1], a new type of ransomware from the actors behind Reveton. CryptXXX is currently spread through Bedep infections sent by the Angler exploit kit (EK). So far, Ive only seen Bedep send CryptXXX after Angler EK traffic caused by the pseudo-Darkleech campaign." />

CryptXXX infections have their own distinct look." />

Bedep recently improved its evasion capabilities [3]. Its being sent by one of the most capable EKs on the criminal market, and now were seeing a new type of ransomware. Lets take a look at traffic from this Angler EK/Bedep/CryptXXX combo.

Details

Below is an image of traffic filtered in Wireshark from an Angler EK/Bedep/CryptXXX infection on 2016-04-23." />

The first HTTP request is for the compromised website. Next, we see the following indicators of compromise (IOCs):

  • 188.138.125.86 port 80 - bladjie.esteroscreenrepair.com - Angler EK
  • 104.193.252.241 port 80 - qrwzoxcjatynejejsz.com - Bedep post-infection traffic
  • 217.23.6.40 port 443 - CryptXXX ransomware callback traffic (encrypted)
  • 93.190.141.27 port 80 - cetinhechinhis.com - Traffic from the click-fraud malware
  • 95.211.205.218 port 80 - tedgeroatref.com - Traffic from the click-fraud malware
  • 104.193.252.236 port 80 - rerobloketbo.com - Traffic from the click-fraud malware
  • 162.244.34.11 port 80 - tonthishessici.com - Traffic from the click-fraud malware
  • 207.182.148.92 port 80 - allofuslikesforums.com - Traffic from the click-fraud malware

As usual with the pseudo-Darkleech campaign, we find a distinctive pattern of injected script in a page from the compromised website." />
Shown above: Start of injected pseudo-Darkleech script sent by the compromised site.

Aside from a few URL pattern changes, Angler EK remains recognizable. However, Angler EK now masquerades its payload as a Flash file [4]. But its not actually Flash. Its the same kind of encrypted payload data as before, just disguised as a Flash file. As always, this gets decrypted on the victim" />
Shown above: Angler EK masquerading the encrypted payload as a Flash file.

As Proofpoints blog post already noted, CryptXXX uses a custom protocol on TCP port 443 for its callback traffic." />

Since this is a fileless infection (an old Angler trick), Bedep is stored in memory. You wont find it on the infected host. But the traffic always provides clues. When looking at the traffic in Wireshark, use File -- Export Objects -- HTTP. In that list, youll see where Angler EK sends the encrypted Bedep payload (disguised as a 775 kB Flash file)." />

Artifacts left behind on the infected Windows host include:

  • C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\8afc49b02429a
  • C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\msvcp60.dll
  • C:\ProgramData\3A1DC4C4719C.dat
  • C:\Users\Public\Music\Sample Music\de_crypt_readme.bmp
  • C:\Users\Public\Music\Sample Music\de_crypt_readme.html
  • C:\Users\Public\Music\Sample Music\de_crypt_readme.txt
  • C:\Users\Public\Pictures\Sample Pictures\de_crypt_readme.bmp
  • C:\Users\Public\Pictures\Sample Pictures\de_crypt_readme.html
  • C:\Users\Public\Pictures\Sample Pictures\de_crypt_readme.txt
  • C:\Users\Public\Videos\Sample Videos\de_crypt_readme.bmp
  • C:\Users\Public\Videos\Sample Videos\de_crypt_readme.html
  • C:\Users\Public\Videos\Sample Videos\de_crypt_readme.txt
  • C:\Users\[username]\AppData\Local\Temp\{F4DD9BAF-BD38-4055-90EE-07C071479B6A}\api-ms-win-system-acproxy-l1-1-0.dll

The top group is related to click-fraud malware. The bottom group is related to CryptXXX ransomware. Both were saved as DLL files.

Final words

This diary doesnt reveal anything new for Angler EK/Bedep/CryptXXX. However, I believe this combination is a significant development in EK-sourced ransomware. It deserves more scrutiny. Hopefully, repeated exposure will keep everyone aware of this continuing threat.

Pcap and malware for todays diary can be found here. Earlier examples are available at:

---
Brad Duncan
brad [at] malware-traffic-analysis.net

References:

[1] https://www.proofpoint.com/us/threat-insight/post/cryptxxx-new-ransomware-actors-behind-reveton-dropping-angler
[2] http://malware-traffic-analysis.net/2016/04/23/index.html
[3] http://malware.dontneedcoffee.com/2016/04/bedepantiVM.html
[4] https://twitter.com/kafeine/status/718449401396654080

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 

Waterbury Republican American

That USB drive you found has more than just spring break photos
Waterbury Republican American
... has more than just spring break photos. By Ally Marotti TRIBUNE NEWS SERVICE ... Jack Koziol, president and founder of InfoSec Institute, an Elmwood Park-based information security training company, agreed. "I don't think most people realize that ...

and more »
 
Internet Storm Center Infocon Status