Rig Exploit Kit via the EiTest delivers CryptFile2 ransomware from 126.96.36.199
- Today I captured traffic from the Rig Exploit Kit (EK) which delivered CryptFile2 ransomware via the EITEST campaign.
- Files on the infected host were encrypted and the file extensions were changed to @dr.com_.scl.
- The Rig exploit kit is making use of DNS Shadowing as explained in a sucuri.net blog post Website Malware – Evolution of Pseudo Darkleech.
- Malware-traffic-analysis.net noticed a change in the Rig Exploit Kit – URL – when used with the EiTest campaign delivering ransomware. 2016-11-07 – EITEST RIG EK FROM 188.8.131.52 SENDS CRYPTFILE2 RANSOMWARE
- Thanks to @CyberScimitar for sharing information on compromised site.
I have added a zipped pcap file for your analysis. The password for the zipped pcap is infected all lowercase.
PCAP file of the infection traffic:
ASSOCIATED DOMAINS AND IP ADDRESSES:
- dogfoodchat.com – COMPROMISED SITE
- 184.108.40.206 – add.stitchforstitch.com – RIG EK LANDING PAGE
- 220.127.116.11 – GET /updatemicrosoft.php –CRYPTFILE2 POST TRAFFIC
- 18.104.22.168 – POST /config/infoconfig.php –CRYPTFILE2 POST TRAFFIC
ASSOCIATED EMAILS FOR RANSOM PAYMENT:
IMAGES AND DETAILS OF INFECTION CHAIN:
Shown above: Injected script found on index page of compromised site associated with the EiTest campaign which redirects visitors to the Rig EK landing page – Web page source code can be found by right clicking on web page and selecting “View source”
Shown above: Fiddler used to show each stage of infection chain
MALICIOUS PAYLOAD ASSOCIATED WITH RIG EXPLOIT: