EiTest campaign Hoefler Text Pop-up delivers NetSupport Manager RAT
I have added a zipped pcap file for your analysis. The password for the zipped pcap is infected all lowercase.
PCAP file of the infection traffic:
2018-02-23-EITest-Hoefler-Text-pcap.zip
ASSOCIATED DOMAINS AND IP ADDRESSES:
- zaremedspa.com – COMPROMISED SITE
- 91.211.112.101 – teleduck.de GET /index_3.php – DOWNLOADER FOR NETSUPPORT MANAGER RAT
- 31.31.196.204 Port 443 – printscreens.info – NETSUPPORT MANAGER RAT POST INFECT TRAFFIC
- 94.242.198.167 Port 1488 – ebalodauna1488.com POST http://94.242.198.167/fakeurl.htm – NETSUPPORT MANAGER RAT POST INFECT TRAFFIC
IMAGES AND DETAILS OF INFECTION CHAIN:
Shown above: Network traffic associated with the EiTest campaign and Hoefler Text pop-up leading to NetSupport Manager RAT
Shown above: DNS traffic associated with the EiTest campaign and Hoefler Text pop-up leading to NetSupport Manager RAT
Shown above: First pop-up associated with Hoefler Text fake font
Shown above: Downloader associated with NetSupport Manager RAT downloaded from teleduck.de /index_3.php
MALICIOUS PAYLOAD ASSOCIATED WITH EITEST CAMPAIGN:
- Font_update.exe – NETSUPPORT RAT DOWNLOADER
SHA-256 Hash: 9e23d5b5ccfd47ffb28b4a2a3ef96a93b1b595893022ad564c29c6cdc8e9f39f
Virus Total Link - q.js – JavaScript used to download NETSUPPORT RAT
C:\Users\USERNAME\AppData\Local\Temp
SHA-256 Hash: c9aef58c5a639778b2f83495d30a4a9466d79e70b2d089cffb9e1974d335b4ed
Virus Total Link - client32.exe – NETSUPPORT CLIENT
C:\Users\USERNAME\AppData\Roaming\Dom
SHA-256 Hash: c9aef58c5a639778b2f83495d30a4a9466d79e70b2d089cffb9e1974d335b4ed
Virus Total Link