On Thursday 2015-12-18 during a Rig exploit kit (EK) infection in my lab environment, I saw the same infection chain patterns from a criminal group I hadn't noticed in a long time.
This appears to be the same actor that was using Sweet Orange EK to distribute Qbot malware in 2014 and early 2015 [1, 2, 3]. Why? Because the same type of obfuscation is used to generate the gate URL that I saw last year. The payload is also the same that I've seen from this actor (Qbot).
This actor appears to be using Rig EK now. Let's take a closer look at the infection traffic.
The EK traffic was identified as Rig EK when I read a traffic of the traffic using Snort 220.127.116.11 with the Snort registered rule set. It was also identified as Rig EK when I used tcpreplay in Security Onion using the EmergingThreats (ET) Pro ruleset.
The ET Pro rule set also identified HTTP and FTP traffic caused by Qbot malware after the Windows host was infected through Rig EK.
How does this actor generate the gate URL from the compromised website? It's done through injected script that uses several obfuscation tricks. One of the HTTP GET requests to the compromised website returned a .js file withe the malicious script tacked on the end of it. If you look at the TCP stream for this HTTP GET request in Wireshark, it'll look like garbage, because the data is gzip-compressed.
You'll neet to export HTTP objects from the pcap to look at the actual .js file. When I opened the extracted .js file in a text editor, I found the malicious script at the end of it.
In the above image, the end of the normal .js file is highlighted in orange near the top. Everything after that is the injected malicious script. I've highlighted code for the gate URL in yellow. How do you translate that to the actual gate URL? It uses both unicode and hexadecimal obfuscation for some of the letters in the URL. There's also a j7aMn function that's previously defined earlier in the script, and that's used to generate other letters in the gate URL.
The gate URL returns a variable called main_color_handle. This contains a long string of characters that the earlier malicious script uses to get the Rig EK landing page URL. First, you'll have to take everything away except 0 through 9 and a through f from the variable. Then translate the result from hexadecimal to ASCII. That's how you'll find the EK landing page.
Today's Rig EK example follows the same traffic patterns that I've examined many times before. Of note, the gate IP address and domain name in this example was st.dynamicwords.us on 18.104.22.168 which has been active with the same gate URL traffic patterns since 2015-12-02 .
Pcap and malware samples used in this diary are available here.
Dec 18th 2015
3 years ago