CryptoBit: Another Ransomware Family Gets an Update
Palo Alto Unit 42 analyzes updated CryptoBit ransomware distributed via the Rig exploit kit, documenting IOCs, eight sample hashes, and disguise tactics from June 2016.
Unit 42 observed an updated CryptoBit ransomware variant (also tracked as CriptoBit or Mobef) delivered through the Rig exploit kit via the gate domain realstatistics.info between June 17-27, 2016. Infections targeted Windows hosts with out-of-date Flash plugins, and post-infection callbacks used fake user-agents and referrers to disguise traffic to laoismacau.com. At least eight samples were collected, and by June 27 the campaign had begun distributing other malware.
15