Threat actormedium
New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-8174 | Out-of-Bounds Write RCE in Microsoft Windows VBScript Engine | 7.5 | 88% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | api.clickaine.com | 5919 URL chain 2 hxxp://tania[.]web[.]telrock[.]net/ hxxp://api[.]clickaine[.]com/v1/apop/redirect/zone/15450 hxxp://findmyname[.]pw/M6rp |
| domain | damneddevastator.com | Gecko%29+Mobile%2F15E302&ip\=124.35.82.126&campaignI hxxp://damneddevastator[.]com/l/18358235b03f965b74d5?sub=&source=&code2=Y3RtATE1NDAzOTM |
| domain | findmyname.pw | ’ because all of the final exploit pages land on the domain findmyname[.]pw. These new Azorult samples variants use advanced obfuscat |
| domain | gfobhk.peak-serving.com | d=&cid=M2018102013-11642b318a12196b7fae1559b32a45c2 hxxps://gfobhk[.]peak-serving[.]com/?&id=15400452977053288308437914&tid=6639&sr=ep hxxp://s |
| domain | manuela.w.telrock.org | 56-8965/peevedly_Oversured_tungstic.cfml URL chain 3 hxxp://manuela[.]w[.]telrock[.]org/ hxxp://api[.]clickaine[.]com/v1/apop/redirect/zone/1 |
| domain | plugin-update.space | the behavior of accessing a malicious URL to get the file: plugin-update[.]space/download/10.17.18.exe. Figure 18 call CreateProcess or Sh |
| domain | sax.peakonspot.com | y using the AzoRult tag. IOCs URL Chains URL chain 1 hxxp://sax[.]peakonspot[.]com/dep.php?pid=6639&format=POPUP&subid=&cid=M2018102013-11 |
| domain | sl.ivankatraff.com | &sAoiIFu=Tirracke&KaaM=Uncloak_Becloaked URL chain 4 hxxp://sl[.]ivankatraff[.]com/sl?vId\=bmconv_20181024052548_bea8e890_2113_4ecc_951b_c |
| domain | sp.popcash.net | .]com/?&id=15400452977053288308437914&tid=6639&sr=ep hxxp://sp[.]popcash[.]net/go/161339/449201 hxxp://sp[.]popcash[.]net/sgo/ad?p=161 |
| domain | tania.web.telrock.net | o5&VX1m7hhu=ugaritic_Shying_fleece_15919 URL chain 2 hxxp://tania[.]web[.]telrock[.]net/ hxxp://api[.]clickaine[.]com/v1/apop/redirect/zone/1 |
| domain | whitepages.review | ndmyname[.]pw/pysV15/olt8uPj1/1969_04_11 URL chain 5 hxxp://whitepages[.]review/prpllr?cost=0.001850¤cy=USD&external_id=76427570563 |
| ipv4 | 124.35.82.126 | it%2F605.1.15+%28KHTML%2C+like+Gecko%29+Mobile%2F15E302&ip\=124.35.82.126&campaignI hxxp://damneddevastator[.]com/l/18358235b03f965b7 |
| ipv4 | 51.15.196.30 | e malware decrypts a C2 address and sends a POST request to 51[.]15[.]196[.]30/1/index.php with the encrypted victim’s ID. The C2 tr |
| md5 | 11642b318a12196b7fae1559b32a45c2 | [.]com/dep.php?pid=6639&format=POPUP&subid=&cid=M2018102013-11642b318a12196b7fae1559b32a45c2 hxxps://gfobhk[.]peak-serving[.]com/?&id=154004529770532883 |
| sha1 | 344fb5d5343a2ec681928a0244ca6ce98647ccaa | c ( i ) hash_str += hash_func ( '' . join ( user_info ) ) # 344FB5D5343A2EC681928A0244CA6CE98647CCAA hash_str = format_hash_str ( hash_str ) # 344FB5D-5343A2EC- |
| sha256 | 0e27bbfa70b399182f030ee18531e100d4f6e8cb64e592276b02c18b7b5d69e6 | 800ab3b8784f718bbe2e38159a883c2fc009af740df944431 Sample 3: 0e27bbfa70b399182f030ee18531e100d4f6e8cb64e592276b02c18b7b5d69e6 Appendix Appendix 1: hash algorithm and encryption. Hash al |
| sha256 | 3354a1d18aa861de2e17eeec65fc6545bc52deebe86c3ef12ccb372c312d8af8 | balo/13345/13231?potteries=icL8gc96 Binary SHA256 Sample 1: 3354a1d18aa861de2e17eeec65fc6545bc52deebe86c3ef12ccb372c312d8af8 Sample 2: 7a99eb3e340f61f800ab3b8784f718bbe2e38159a883c2fc0 |
| sha256 | 7a99eb3e340f61f800ab3b8784f718bbe2e38159a883c2fc009af740df944431 | e2e17eeec65fc6545bc52deebe86c3ef12ccb372c312d8af8 Sample 2: 7a99eb3e340f61f800ab3b8784f718bbe2e38159a883c2fc009af740df944431 Sample 3: 0e27bbfa70b399182f030ee18531e100d4f6e8cb64e592276 |
| url | http://api.clickaine.com/v1/apop/redirect/zone/15450 | leece_15919 URL chain 2 hxxp://tania[.]web[.]telrock[.]net/ hxxp://api[.]clickaine[.]com/v1/apop/redirect/zone/15450 hxxp://findmyname[.]pw/M6rpEF/lifted/7013-Tiddley-toady |
| url | http://damneddevastator.com/gw?sub=&source=Unknown&url=https%3A%2F%2Fsax.peakonspot.com%2Fdep.php%3Fpid%3D2457%26subid%3D2_Unknown%26cid%3Dbmconv_20181024091133_7532cd6e_41dc_445b_a538_a0f29d2af047%26ref%3D&vId=bmconv_20181024091133_7532cd6e_41dc_445b_a538_a0f29d2af047&hash=18358235b03f965b74d5&ete=true | nNldEltbWVkaWF0ZQBrbG5nAWVuLVVTAHJ0dAEhAGxhbwEtMQBobHMBMA__ hxxp://damneddevastator[.]com/gw?sub=&source=Unknown&url=https%3A%2F%2Fsax.peakonspot.com%2Fdep.php%3Fpid%3D2457%26subid%3D2_Unknown%26cid%3Dbmconv_20181024091133_7532cd6e_41dc_445b_a538_a0f29d2af047%26ref%3D&vId=bmconv_20181024091133_7532c |
| url | http://damneddevastator.com/l/18358235b03f965b74d5?sub=&source=&code2=Y3RtATE1NDAzOTM4OTI1MDEAc3JjAWlvAHZlcgExOQBwbHQBV2luMzIAdGNoATEAaXcBNzkyAGloATUwNABhdwExNDQwAGFoATg1NgB0egE0ODAAYnVpZAEAY2tlATEAb3JudAEAdm5kAQBoc2ZjAXRydWUAZnJtAWZhbHNlAHVhAU1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgVHJpZGVudC83LjA7IFNMQ0MyOyAuTkVUIENMUiAyLjAuNTA3Mjc7IC5ORVQgQ0xSIDMuNS4zMDcyOTsgLk5FVCBDTFIgMy4wLjMwNzI5OyBNZWRpYSBDZW50ZXIgUEMgNi4wOyAuTkVUNC4wQzsgLk5FVDQuMEU7IHJ2OjExLjApIGxpa2UgR2Vja28AYTQzATEwMTEwMQBhNDQBMTEAc2YBMTExMABmZgExMTAAY2hkATAAZmx2AWZhbHNlAGNobQEwMDEAbG5nATExMTEAc3RyZwExMTEwMTAwAG9zY3B1AQBwcmRzdWIBAGV2bG4BMzkAcmVmAQByYmNjATEwMjUxMTUzAGNudHABdHJ1ZQB3bm0BAHdnbHYBMABjZGcBMDAwMDAwMDAwMDAwMDAwMDAxMTExMDAxMDEwMDAwMDAwMTAyMjEyMDAwMDAwMDIyMjIyMjIyMjIyMjIyMjIyMgB3dXQBdy5wYW53X2hhc190aW1lb3V0X3NldDt3LnBhbndfQWN0aXZlWE9iamVjdF9BcmdzX0FycmF5O3cubXNJbmRleGVkREI7dy5jbGlwYm9hcmREYXRhO3cubWF4Q29ubmVjdGlvbnNQZXJTZXJ2ZXI7dy5vbmZvY3VzaW47dy5vbmZvY3Vzb3V0O3cub25oZWxwO3cuYW5pbWF0aW9uU3RhcnRUaW1lO3cubXNBbmltYXRpb25TdGFydFRpbWU7dy5tc0NyeXB0bzt3Lm9ubXNnZXN0dXJlY2hhbmdlO3cub25tc2dlc3R1cmVkb3VibGV0YXA7dy5vbm1zZ2VzdHVyZWVuZDt3Lm9ubXNnZXN0dXJlaG9sZDt3Lm9ubXNnZXN0dXJlc3RhcnQ7dy5vbm1zZ2VzdHVyZXRhcDt3Lm9ubXNpbmVydGlhc3RhcnQ7dy5vbm1zcG9pbnRlcmNhbmNlbDt3Lm9ubXNwb2ludGVyZG93bjt3Lm9ubXNwb2ludGVyZW50ZXI7dy5vbm1zcG9pbnRlcmxlYXZlO3cub25tc3BvaW50ZXJtb3ZlO3cub25tc3BvaW50ZXJvdXQ7dy5vbm1zcG9pbnRlcm92ZXI7dy5vbm1zcG9pbnRlcnVwO3cub25yZWFkeXN0YXRlY2hhbmdlO3cuaXRlbTt3Lm1zV3JpdGVQcm9maWxlck1hcms7dy5uYXZpZ2F0ZTt3LnNob3dIZWxwO3cuc2hvd01vZGVsZXNzRGlhbG9nO3cudG9TdGF0aWNIVE1MO3cubXNDYW5jZWxSZXF1ZXN0QW5pbWF0aW9uRnJhbWU7dy5tc0lzU3RhdGljSFRNTDt3Lm1zTWF0Y2hNZWRpYTt3Lm1zUmVxdWVzdEFuaW1hdGlvbkZyYW1lO3cudG9TdHJpbmc7dy5jbGVhckltbWVkaWF0ZTt3Lm1zQ2xlYXJJbW1lZGlhdGU7dy5tc1NldEltbWVkaWF0ZTt3LnNldEltbWVkaWF0ZQBrbG5nAWVuLVVTAHJ0dAEhAGxhbwEtMQBobHMBMA__ | C+like+Gecko%29+Mobile%2F15E302&ip\=124.35.82.126&campaignI hxxp://damneddevastator[.]com/l/18358235b03f965b74d5?sub=&source=&code2=Y3RtATE1NDAzOTM4OTI1MDEAc3JjAWlvAHZlcgExOQBwbHQBV2luMzIAdGNoATEAaXcBNzkyAGloATUwNABhdwExNDQwAGFoATg1NgB0egE0ODAAYnVpZAEAY2tlATEAb3JudAEAdm5kAQBoc2ZjAXRydWUAZnJtAWZhbHNl |
| url | http://findmyname.pw/1981_06_18/spumier/04_05_1952/E4bI5EK9?FYpUsha=Hangmen-Avowedly-Political-montreal&JAb1I5xAS=Reeled_chateaus_funduck_royalize_unconvert_Joysome&Outdraft=Tr6mHo5&VX1m7hhu=ugaritic_Shying_fleece_15919 | et/sgo/ad?p=161339&w=449201&t=33fd7220adb3c003&r=&vw=0&vh=0 hxxp://findmyname[.]pw/1981_06_18/spumier/04_05_1952/E4bI5EK9?FYpUsha=Hangmen-Avowedly-Political-montreal&JAb1I5xAS=Reeled_chateaus_funduck_royalize_unconvert_Joysome&Outdraft=Tr6mHo5&VX1m7hhu=ugaritic_Shying_fleece_15919 URL chain 2 hxxp:/ |
| url | http://findmyname.pw/cymbalo/13345/13231?potteries=icL8gc96 | ad_campaign_id=1382277&source=PropellerAds&sub_id_1=1774896 hxxp://findmyname[.]pw/cymbalo/13345/13231?potteries=icL8gc96 Binary SHA256 Sample 1: 3354a1d18aa861de2e17eeec65fc6545b |
| url | http://findmyname.pw/hoivSZVRX/NV1uI/vpLnq.shtml?nXslO=indult-Cadere&sAoiIFu=Tirracke&KaaM=Uncloak_Becloaked | g/ hxxp://api[.]clickaine[.]com/v1/apop/redirect/zone/15450 hxxp://findmyname[.]pw/hoivSZVRX/NV1uI/vpLnq.shtml?nXslO=indult-Cadere&sAoiIFu=Tirracke&KaaM=Uncloak_Becloaked URL chain 4 hxxp://sl[.]ivankatraff[.]com/sl?vId\=bmconv_ |
| url | http://findmyname.pw/M6rpEF/lifted/7013-Tiddley-toadyisms-11956-8965/peevedly_Oversured_tungstic.cfml | t/ hxxp://api[.]clickaine[.]com/v1/apop/redirect/zone/15450 hxxp://findmyname[.]pw/M6rpEF/lifted/7013-Tiddley-toadyisms-11956-8965/peevedly_Oversured_tungstic.cfml URL chain 3 hxxp://manuela[.]w[.]telrock[.]org/ hxxp://ap |
| url | http://findmyname.pw/pysV15/olt8uPj1/1969_04_11 | nv_20181024091133_7532cd6e_41dc_445b_a538_a0f29d2af047&ref= hxxp://findmyname[.]pw/pysV15/olt8uPj1/1969_04_11 URL chain 5 hxxp://whitepages[.]review/prpllr?cost=0.0018 |
| url | http://manuela.w.telrock.org/ | sms-11956-8965/peevedly_Oversured_tungstic.cfml URL chain 3 hxxp://manuela[.]w[.]telrock[.]org/ hxxp://api[.]clickaine[.]com/v1/apop/redirect/zone/15 |
| url | http://sax.peakonspot.com/dep.php?pid=6639&format=POPUP&subid=&cid=M2018102013-11642b318a12196b7fae1559b32a45c2 | activity using the AzoRult tag. IOCs URL Chains URL chain 1 hxxp://sax[.]peakonspot[.]com/dep.php?pid=6639&format=POPUP&subid=&cid=M2018102013-11642b318a12196b7fae1559b32a45c2 hxxps://gfobhk[.]peak-serving[.]com/?&id=15400452977053 |
| url | https://gfobhk.peak-serving.com/?&id=15400452977053288308437914&tid=6639&sr=ep | PUP&subid=&cid=M2018102013-11642b318a12196b7fae1559b32a45c2 hxxps://gfobhk[.]peak-serving[.]com/?&id=15400452977053288308437914&tid=6639&sr=ep hxxp://sp[.]popcash[.]net/go/161339/449201 hxxp://sp[.] |
| url | http://sl.ivankatraff.com/sl?vId\=bmconv_20181024052548_bea8e890_2113_4ecc_951b_c90aeffde1e6&publisherId\=40152&source\=5348_8482&ua\=Mozilla%2F5.0+%28iPhone%3B+CPU+iPhone+OS+11_3+like+Mac+OS+X%29+AppleWebKit%2F605.1.15+%28KHTML%2C+like+Gecko%29+Mobile%2F15E302&ip\=124.35.82.126&campaignI | -Cadere&sAoiIFu=Tirracke&KaaM=Uncloak_Becloaked URL chain 4 hxxp://sl[.]ivankatraff[.]com/sl?vId\=bmconv_20181024052548_bea8e890_2113_4ecc_951b_c90aeffde1e6&publisherId\=40152&source\=5348_8482&ua\=Mozilla%2F5.0+%28iPhone%3B+CPU+iPhone+OS+11_3+like+Mac+OS+X%29+AppleWebKit%2F605.1.15+%28KHTML%2C+like |
| url | http://sp.popcash.net/go/161339/449201 | erving[.]com/?&id=15400452977053288308437914&tid=6639&sr=ep hxxp://sp[.]popcash[.]net/go/161339/449201 hxxp://sp[.]popcash[.]net/sgo/ad?p=161339&w=449201&t=33 |
| url | http://sp.popcash.net/sgo/ad?p=161339&w=449201&t=33fd7220adb3c003&r=&vw=0&vh=0 | 4&tid=6639&sr=ep hxxp://sp[.]popcash[.]net/go/161339/449201 hxxp://sp[.]popcash[.]net/sgo/ad?p=161339&w=449201&t=33fd7220adb3c003&r=&vw=0&vh=0 hxxp://findmyname[.]pw/1981_06_18/spumier/04_05_1952/E4 |
| url | http://tania.web.telrock.net/ | t=Tr6mHo5&VX1m7hhu=ugaritic_Shying_fleece_15919 URL chain 2 hxxp://tania[.]web[.]telrock[.]net/ hxxp://api[.]clickaine[.]com/v1/apop/redirect/zone/15 |
| url | http://whitepages.review/prpllr?cost=0.001850¤cy=USD&external_id=76427570563780608&ad_campaign_id=1382277&source=PropellerAds&sub_id_1=1774896 | xp://findmyname[.]pw/pysV15/olt8uPj1/1969_04_11 URL chain 5 hxxp://whitepages[.]review/prpllr?cost=0.001850¤cy=USD&external_id=76427570563780608&ad_campaign_id=1382277&source=PropellerAds&sub_id_1=1774896 hxxp://findmyname[.]pw/cymbalo/13345/13231?potteries=icL8 |
From the original article
11 min read at unit42.paloaltonetworks.com
Observed in the wild as early as 2016, Azorult is a Trojan family which has been delivered in malicious macro-based documents via spam campaigns, or as a secondary payload in the RIG Exploit Kit campaigns. On October 20 th , 2018 we discovered that new Azorult variants were being used as primary payloads in a new ongoing campaign using the Fallout Exploit Kit.
By Tao Yan, Xingyu Jin, Bo Qu, Zhanglin He · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.