RansomwarelowExploited in the wild

CryptoBit: Another Ransomware Family Gets an Update

Palo Alto Unit 42by Brad DuncanAug 17, 2026 · 09:48 UTC (Aug 17, 2026)2 min read2

AI summary · glm-5.3-flashSummaries by Vani AI

Palo Alto Unit 42 analyzes updated CryptoBit ransomware distributed via the Rig exploit kit, documenting IOCs, eight sample hashes, and disguise tactics from June 2016.

Unit 42 observed an updated CryptoBit ransomware variant (also tracked as CriptoBit or Mobef) delivered through the Rig exploit kit via the gate domain realstatistics.info between June 17-27, 2016. Infections targeted Windows hosts with out-of-date Flash plugins, and post-infection callbacks used fake user-agents and referrers to disguise traffic to laoismacau.com. At least eight samples were collected, and by June 27 the campaign had begun distributing other malware.

Key facts

CryptoBit, also called CriptoBit or Mobef, was delivered via the Rig exploit kit through the realstatistics.info gate
Targets Windows hosts with outdated Flash plugin using a Flash exploit payload
Post-infection callbacks use fake user-agent and referrer to mimic regular web traffic
Eight samples observed June 17-27, 2016; campaign later began distributing other malware

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

ATT&CK: T1189 Drive-By Compromise T1486 Data Encrypted for Impact

Tags: cryptobit exploit-kit ioc palo-alto-networks ransomware rig-ek unit-42

Vendors: Palo Alto Networks Panda Security
Products: Flash Player
Malware: CryptoBit Rig exploit kit

Indicators of compromise

auto-extracted · verify before use · export allAll

Type	Indicator	Context
domain	laoismacau.com	sy.dyndns.org[.]org - Rig EK on 2016-06-24 58.64.142[.]89 - laoismacau[.]com - post-infection traffic from CryptoBit The gate checked
domain	realstatistics.info	, this particular campaign used a gate with the domain name realstatistics[.]info that pointed to Rig EK. If a vulnerable Windows host enco
ipv4	5.61.32.163	7[.]139 - kjyrxilohcowy.dyndns[.]org - Rig EK on 2016-06-23 5.61.32[.]163 - smobutdobesy.dyndns.org[.]org - Rig EK on 2016-06-24 58
ipv4	5.61.37.139	5.95[.]39 - realstatistics[.]info - gate pointing to Rig EK 5.61.37[.]139 - kjyrxilohcowy.dyndns[.]org - Rig EK on 2016-06-23 5.61.
ipv4	58.64.142.89	]163 - smobutdobesy.dyndns.org[.]org - Rig EK on 2016-06-24 58.64.142[.]89 - laoismacau[.]com - post-infection traffic from CryptoBi
ipv4	85.25.95.39	ion on June 24. The indicators of compromise (IOCs) follow: 85.25.95[.]39 - realstatistics[.]info - gate pointing to Rig EK 5.61.37
sha256	2477db8c1a6882212921ce396d85964d182f9993a0786fb7ccc497b0af78fd3b	on 58.64.142[.]89. SHA256 hashes for these samples follow: 2477db8c1a6882212921ce396d85964d182f9993a0786fb7ccc497b0af78fd3b 4eb75511b34cc276251dff1007328477836da59458e1f89c607c2590fe2
sha256	4eb75511b34cc276251dff1007328477836da59458e1f89c607c2590fe2ebdaf	b8c1a6882212921ce396d85964d182f9993a0786fb7ccc497b0af78fd3b 4eb75511b34cc276251dff1007328477836da59458e1f89c607c2590fe2ebdaf 5351c106e578453993d20b10bd71301c831a2a0cea3aa45d911fde7a94b
sha256	5351c106e578453993d20b10bd71301c831a2a0cea3aa45d911fde7a94b9247a	511b34cc276251dff1007328477836da59458e1f89c607c2590fe2ebdaf 5351c106e578453993d20b10bd71301c831a2a0cea3aa45d911fde7a94b9247a 642a3067a35348a833e82e7c08eb53c27f6d2bc68c61bc6e81f135e9927
sha256	642a3067a35348a833e82e7c08eb53c27f6d2bc68c61bc6e81f135e9927969c7	106e578453993d20b10bd71301c831a2a0cea3aa45d911fde7a94b9247a 642a3067a35348a833e82e7c08eb53c27f6d2bc68c61bc6e81f135e9927969c7 6cb7ceca202fccbb8592728b030127eff7a5661b80131d2a40dc637b76d
sha256	6cb7ceca202fccbb8592728b030127eff7a5661b80131d2a40dc637b76d82fa8	067a35348a833e82e7c08eb53c27f6d2bc68c61bc6e81f135e9927969c7 6cb7ceca202fccbb8592728b030127eff7a5661b80131d2a40dc637b76d82fa8 8fe6b7f52033794d97aa58605ba3eb306c537abeeaf6d14f45ba3204bf1
sha256	8fe6b7f52033794d97aa58605ba3eb306c537abeeaf6d14f45ba3204bf112f70	eca202fccbb8592728b030127eff7a5661b80131d2a40dc637b76d82fa8 8fe6b7f52033794d97aa58605ba3eb306c537abeeaf6d14f45ba3204bf112f70 90e1ea707f97105a99cd7e960fc26deb91aba68f50ec80e40bf915822c4
sha256	90e1ea707f97105a99cd7e960fc26deb91aba68f50ec80e40bf915822c4e3998	7f52033794d97aa58605ba3eb306c537abeeaf6d14f45ba3204bf112f70 90e1ea707f97105a99cd7e960fc26deb91aba68f50ec80e40bf915822c4e3998 bd7e11ecdf7308a4173bdaff82b38c2fba47939ac0356a1878a52fff203
sha256	bd7e11ecdf7308a4173bdaff82b38c2fba47939ac0356a1878a52fff203656ab	a707f97105a99cd7e960fc26deb91aba68f50ec80e40bf915822c4e3998 bd7e11ecdf7308a4173bdaff82b38c2fba47939ac0356a1878a52fff203656ab Palo Alto Networks customers are protected from Rig EK and

From the original article

2 min read at unit42.paloaltonetworks.com

In April 2016, Panda Security reported yet another new family of ransomware named CryptoBit that spread through exploit kit (EK) traffic. In June 2016, we discovered an updated version of CryptoBit ransomware sent by Rig EK. On June 23 and June 24, this particular campaign used a gate with the domain name realstatistics[.]

Palo Alto Unit 42

By Brad Duncan · unit42.paloaltonetworks.com

Read the full article at Palo Alto Unit 42

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.