Rig exploit kit (EK) is one of a handful of EKs still active as reported in May 2019 by Malwarebytes. Even though EKs are far less active than in previous years, EK traffic is still sometimes noted in the wild. Twitter accounts like @nao_sec, @david_jursa, @jeromesegura, and @tkanalyst occasionally tweet about EK activity. Today's diary reviews a recent example of infection traffic caused by Rig EK.
For the past year, Rig EK has been using Flash exploits based on CVE-2018-8174 as noted in this May 2018 blog post from @kafeine. Since then, other sources have reported Rig EK delivering a variety of malware like the Grobios Trojan or malware based on a Monero cryptocurrency miner. Like other EKs, Rig EK is most often used in malvertising distribution campaigns. In today's infection, Rig EK delivered AZORult, and the infection followed-up with other malware I was unable to identify.
I used a gate from malvertising traffic in a recent tweet from @nao_sec. See images below for details.
Indicators of Compromise (IOCs)
Redirect domain that led to Rig EK:
AZORult post-infection traffic:
Infected Windows host retrieved follow-up malware:
My infected Windows host retrieved follow-up malware after the initial AZORult infection. However, I was using a virtual environment, and I didn't see any further post-infection traffic, so I could not identify the follow-up malware.
A pcap of the infection traffic along with the associated malware and artifacts can be found here.
Jun 17th 2019
5 months ago