Skip to content
NewA calmer, faster ZeroHour
Threat actormediumExploited in the wild

Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX

Palo Alto Unit 42by Brad Duncan ()3 min read
Read at unit42.paloaltonetworks.com
AI summary · glm-5.3-flashSummaries by Vani AI

Unit 42 reports the Afraidgate campaign switched from Nuclear EK delivering Locky to Angler EK delivering CryptXXX via the Bedep downloader.

Unit 42 reported that the Afraidgate campaign, which uses gates registered through FreeDNS at afraid.org, switched in mid-April 2016 from Nuclear EK distributing Locky ransomware to Angler EK distributing CryptXXX. The Angler/Bedep/CryptXXX combination also spread from the pseudo-Darkleech campaign, with Bedep acting as a fileless, memory-resident downloader that also installs click-fraud malware. Recent Bedep updates detect virtual machines and alter behavior, complicating analyst investigation. Unit 42 published gate, EK, and post-infection indicators including gate IP 185.118.164.42 and associated domains.

Key facts
  • Afraidgate swapped Nuclear EK delivering Locky for Angler EK delivering CryptXXX in mid-April 2016.
  • Angler uses fileless in-memory execution for Bedep, which downloads CryptXXX ransomware and click-fraud malware.
  • Bedep now detects virtual machines, changing its post-infection traffic and skipping CryptXXX downloads during analysis.
  • Unit 42 shared gate, EK, and post-infection indicators, including gate IP 185.118.164.42.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1189 Drive-by CompromiseT1203 Exploitation for Client ExecutionT1105 Ingress Tool TransferT1486 Data Encrypted for ImpactT1620 Reflective Code Loading
Tags
angler-ekbedepcryptxxxexploit-kitlockyransomwareunit42
Vendors
Palo Alto NetworksFreeDNS
Threat actors
AfraidgatePseudo-Darkleech
Malware
Nuclear EKAngler EKLockyCryptXXXBedep
Organizations
Unit 42

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
domainafraid.orgare. This campaign uses gates registered through FreeDNS at afraid.org. We are calling this the Afraidgate campaign. Although we c
domainallofuslikesforums.com.11 port 80 - tonthishessici[.]com 207.182.148.92 port 80 - allofuslikesforums[.]com 85.25.79.211 port 80 - oqpwldjc.mjobrkn3[.]eu (using a VM
domainbreastcanceroutreach.comstate[.]com 192.169.190.97 port 80 - frageboegen-plletyksin.breastcanceroutreach[.]com 192.169.190.97 port 80 - reikleivn-azarashi.orlandohomesb
domaincetinhechinhis.com.203 port 80 - ranetardinghap[.]com 93.190.141.27 port 80 - cetinhechinhis[.]com 95.211.205.218 port 80 - tedgeroatref[.]com 104.193.252.2
domainesteroscreen.comlandohomesbydevito[.]com 209.126.120.8 port 80 - litigators.esteroscreen[.]com Bedep post-infection traffic: 104.193.252.241 port 80 - q
domainhelpthevets.orgET /js/script.js Angler EK: 85.25.160.124 port 80 - bintiye.helpthevets[.]org 85.25.160.124 port 80 - mcimaildmz.dinnerplate.co[.]uk 19
domainmjobrkn3.eu- allofuslikesforums[.]com 85.25.79.211 port 80 - oqpwldjc.mjobrkn3[.]eu (using a VM) CryptXXX post-infection traffic: 217.23.6.40
domainnewlandsierrarealestate.comate.co[.]uk 192.169.189.167 port 80 - candidulumbestuurlijk.newlandsierrarealestate[.]com 192.169.190.97 port 80 - frageboegen-plletyksin.breastcan
domainorlandohomesbydevito.comroutreach[.]com 192.169.190.97 port 80 - reikleivn-azarashi.orlandohomesbydevito[.]com 209.126.120.8 port 80 - litigators.esteroscreen[.]com Bed
domainqrwzoxcjatynejejsz.comcom Bedep post-infection traffic: 104.193.252.241 port 80 - qrwzoxcjatynejejsz[.]com 95.211.205.228 port 80 - yfczmludodohkdqnij[.]com (using
domainranetardinghap.comm (using a VM) Click-fraud traffic: 5.199.141.203 port 80 - ranetardinghap[.]com 93.190.141.27 port 80 - cetinhechinhis[.]com 95.211.205.2
domainrerobloketbo.com.218 port 80 - tedgeroatref[.]com 104.193.252.236 port 80 - rerobloketbo[.]com 162.244.34.11 port 80 - tonthishessici[.]com 207.182.148.
domaintedgeroatref.com.27 port 80 - cetinhechinhis[.]com 95.211.205.218 port 80 - tedgeroatref[.]com 104.193.252.236 port 80 - rerobloketbo[.]com 162.244.34.1
domaintonthishessici.com52.236 port 80 - rerobloketbo[.]com 162.244.34.11 port 80 - tonthishessici[.]com 207.182.148.92 port 80 - allofuslikesforums[.]com 85.25.7
domainyfczmludodohkdqnij.comport 80 - qrwzoxcjatynejejsz[.]com 95.211.205.228 port 80 - yfczmludodohkdqnij[.]com (using a VM) Click-fraud traffic: 5.199.141.203 port 80 -
ipv4104.193.252.236hechinhis[.]com 95.211.205.218 port 80 - tedgeroatref[.]com 104.193.252.236 port 80 - rerobloketbo[.]com 162.244.34.11 port 80 - tonthi
ipv4104.193.252.241litigators.esteroscreen[.]com Bedep post-infection traffic: 104.193.252.241 port 80 - qrwzoxcjatynejejsz[.]com 95.211.205.228 port 80 -
ipv4162.244.34.11eroatref[.]com 104.193.252.236 port 80 - rerobloketbo[.]com 162.244.34.11 port 80 - tonthishessici[.]com 207.182.148.92 port 80 - all
ipv4185.118.164.42the Afraidgate campaign are shown below. Figure 3: Gate on 185.118.164.42 leads to Angler EK/Bedep/CryptXXX on Friday 2016-04-22. Fig
ipv4192.169.189.167]org 85.25.160.124 port 80 - mcimaildmz.dinnerplate.co[.]uk 192.169.189.167 port 80 - candidulumbestuurlijk.newlandsierrarealestate[.]c
ipv4192.169.190.97rt 80 - candidulumbestuurlijk.newlandsierrarealestate[.]com 192.169.190.97 port 80 - frageboegen-plletyksin.breastcanceroutreach[.]com
ipv4207.182.148.92bloketbo[.]com 162.244.34.11 port 80 - tonthishessici[.]com 207.182.148.92 port 80 - allofuslikesforums[.]com 85.25.79.211 port 80 - o
ipv4209.126.120.8.97 port 80 - reikleivn-azarashi.orlandohomesbydevito[.]com 209.126.120.8 port 80 - litigators.esteroscreen[.]com Bedep post-infectio
ipv4217.23.6.40mjobrkn3[.]eu (using a VM) CryptXXX post-infection traffic: 217.23.6.40 port 443 (custom encoding)
ipv45.199.141.203yfczmludodohkdqnij[.]com (using a VM) Click-fraud traffic: 5.199.141.203 port 80 - ranetardinghap[.]com 93.190.141.27 port 80 - ceti
ipv485.25.160.124et.jacquieleebrasil.com[.]br - GET /js/script.js Angler EK: 85.25.160.124 port 80 - bintiye.helpthevets[.]org 85.25.160.124 port 80 -
ipv485.25.79.211ici[.]com 207.182.148.92 port 80 - allofuslikesforums[.]com 85.25.79.211 port 80 - oqpwldjc.mjobrkn3[.]eu (using a VM) CryptXXX post
ipv493.190.141.27fraud traffic: 5.199.141.203 port 80 - ranetardinghap[.]com 93.190.141.27 port 80 - cetinhechinhis[.]com 95.211.205.218 port 80 - ted
ipv495.211.205.218rdinghap[.]com 93.190.141.27 port 80 - cetinhechinhis[.]com 95.211.205.218 port 80 - tedgeroatref[.]com 104.193.252.236 port 80 - rero
ipv495.211.205.228traffic: 104.193.252.241 port 80 - qrwzoxcjatynejejsz[.]com 95.211.205.228 port 80 - yfczmludodohkdqnij[.]com (using a VM) Click-fraud

From the original article

3 min read at unit42.paloaltonetworks.com

In mid-April 2016, a campaign using Nuclear Exploit Kit (EK) to distribute Locky ransomware switched to using the Angler EK to install CryptXXX ransomware. This campaign uses gates registered through FreeDNS at afraid. org.

Palo Alto Unit 42

By Brad Duncan · unit42.paloaltonetworks.com

Read the full article at Palo Alto Unit 42

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.