CryptoBit: Another Ransomware Family Gets an Update
Palo Alto Unit 42 analyzes updated CryptoBit ransomware distributed via the Rig exploit kit, documenting IOCs, eight sample hashes, and disguise tactics from June 2016.
Unit 42 observed an updated CryptoBit ransomware variant (also tracked as CriptoBit or Mobef) delivered through the Rig exploit kit via the gate domain realstatistics.info between June 17-27, 2016. Infections targeted Windows hosts with out-of-date Flash plugins, and post-infection callbacks used fake user-agents and referrers to disguise traffic to laoismacau.com. At least eight samples were collected, and by June 27 the campaign had begun distributing other malware.
- CryptoBit, also called CriptoBit or Mobef, was delivered via the Rig exploit kit through the realstatistics.info gate
- Targets Windows hosts with outdated Flash plugin using a Flash exploit payload
- Post-infection callbacks use fake user-agent and referrer to mimic regular web traffic
- Eight samples observed June 17-27, 2016; campaign later began distributing other malware
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | dyndns.org | nfo - gate pointing to Rig EK 5.61.37[.]139 - kjyrxilohcowy.dyndns[.]org - Rig EK on 2016-06-23 5.61.32[.]163 - smobutdobesy.dyndn |
| domain | laoismacau.com | sy.dyndns.org[.]org - Rig EK on 2016-06-24 58.64.142[.]89 - laoismacau[.]com - post-infection traffic from CryptoBit The gate checked |
| domain | org.org | - Rig EK on 2016-06-23 5.61.32[.]163 - smobutdobesy.dyndns.org[.]org - Rig EK on 2016-06-24 58.64.142[.]89 - laoismacau[.]com |
| domain | realstatistics.info | , this particular campaign used a gate with the domain name realstatistics[.]info that pointed to Rig EK. If a vulnerable Windows host enco |
| domain | smobutdobesy.dyndns.org | lohcowy.dyndns[.]org - Rig EK on 2016-06-23 5.61.32[.]163 - smobutdobesy.dyndns.org[.]org - Rig EK on 2016-06-24 58.64.142[.]89 - laoismacau[.] |
| sha256 | 2477db8c1a6882212921ce396d85964d182f9993a0786fb7ccc497b0af78fd3b | on 58.64.142[.]89. SHA256 hashes for these samples follow: 2477db8c1a6882212921ce396d85964d182f9993a0786fb7ccc497b0af78fd3b 4eb75511b34cc276251dff1007328477836da59458e1f89c607c2590fe2 |
| sha256 | 4eb75511b34cc276251dff1007328477836da59458e1f89c607c2590fe2ebdaf | b8c1a6882212921ce396d85964d182f9993a0786fb7ccc497b0af78fd3b 4eb75511b34cc276251dff1007328477836da59458e1f89c607c2590fe2ebdaf 5351c106e578453993d20b10bd71301c831a2a0cea3aa45d911fde7a94b |
| sha256 | 5351c106e578453993d20b10bd71301c831a2a0cea3aa45d911fde7a94b9247a | 511b34cc276251dff1007328477836da59458e1f89c607c2590fe2ebdaf 5351c106e578453993d20b10bd71301c831a2a0cea3aa45d911fde7a94b9247a 642a3067a35348a833e82e7c08eb53c27f6d2bc68c61bc6e81f135e9927 |
| sha256 | 642a3067a35348a833e82e7c08eb53c27f6d2bc68c61bc6e81f135e9927969c7 | 106e578453993d20b10bd71301c831a2a0cea3aa45d911fde7a94b9247a 642a3067a35348a833e82e7c08eb53c27f6d2bc68c61bc6e81f135e9927969c7 6cb7ceca202fccbb8592728b030127eff7a5661b80131d2a40dc637b76d |
| sha256 | 6cb7ceca202fccbb8592728b030127eff7a5661b80131d2a40dc637b76d82fa8 | 067a35348a833e82e7c08eb53c27f6d2bc68c61bc6e81f135e9927969c7 6cb7ceca202fccbb8592728b030127eff7a5661b80131d2a40dc637b76d82fa8 8fe6b7f52033794d97aa58605ba3eb306c537abeeaf6d14f45ba3204bf1 |
| sha256 | 8fe6b7f52033794d97aa58605ba3eb306c537abeeaf6d14f45ba3204bf112f70 | eca202fccbb8592728b030127eff7a5661b80131d2a40dc637b76d82fa8 8fe6b7f52033794d97aa58605ba3eb306c537abeeaf6d14f45ba3204bf112f70 90e1ea707f97105a99cd7e960fc26deb91aba68f50ec80e40bf915822c4 |
| sha256 | 90e1ea707f97105a99cd7e960fc26deb91aba68f50ec80e40bf915822c4e3998 | 7f52033794d97aa58605ba3eb306c537abeeaf6d14f45ba3204bf112f70 90e1ea707f97105a99cd7e960fc26deb91aba68f50ec80e40bf915822c4e3998 bd7e11ecdf7308a4173bdaff82b38c2fba47939ac0356a1878a52fff203 |
| sha256 | bd7e11ecdf7308a4173bdaff82b38c2fba47939ac0356a1878a52fff203656ab | a707f97105a99cd7e960fc26deb91aba68f50ec80e40bf915822c4e3998 bd7e11ecdf7308a4173bdaff82b38c2fba47939ac0356a1878a52fff203656ab Palo Alto Networks customers are protected from Rig EK and |
Full article531 words · extracted from unit42.paloaltonetworks.com · click to collapse
In April 2016, Panda Security reported yet another new family of ransomware named CryptoBit that spread through exploit kit (EK) traffic. In June 2016, we discovered an updated version of CryptoBit ransomware sent by Rig EK.
On June 23 and June 24, this particular campaign used a gate with the domain name realstatistics[.]info that pointed to Rig EK. If a vulnerable Windows host encountered this traffic, Rig EK delivered CryptoBit ransomware to infect the computer. Other sources use different terms for this ransomware, with some calling it "CriptoBit" or "Mobef" instead of Cryptobit.
Figure 1: Flowchart for these EK-based CryptoBit infections.
Infection Traffic
On Thursday June 23, we generated the following infection traffic as seen in Figure 2.
Figure 2: Traffic for the CryptoBit infection through Rig EK on June 23, 2016.
We also generated a similar infection on June 24. The indicators of compromise (IOCs) follow:
- 85.25.95[.]39 - realstatistics[.]info - gate pointing to Rig EK
- 5.61.37[.]139 - kjyrxilohcowy.dyndns[.]org - Rig EK on 2016-06-23
- 5.61.32[.]163 - smobutdobesy.dyndns.org[.]org - Rig EK on 2016-06-24
- 58.64.142[.]89 - laoismacau[.]com - post-infection traffic from CryptoBit
The gate checked for screen resolution and timezone, then it returned javascript with an iframe leading to Rig EK.
Figure 3: First HTTP request to the gate domain.
Figure 4: Second HTTP request to the gate domain.
Rig EK traffic has not changed much since May 2015, when it switched the payload obfuscation to XOR-ing the payload binary with an ASCII string. In this infection, the Windows host was vulnerable due to an out-of-date Flash plugin.
Figure 5: Rig EK sending a Flash exploit.
Figure 6: Rig EK sending the malware payload.
The post-infection traffic for CryptoBit has a fake user-agent in the HTTP headers, and it also includes a fake referrer line in order to disguise the callback activity as regular web traffic.
Figure 7: Post-infection traffic caused by the CryptoBit ransomware.
The infected Windows desktop
After the infection, a window suddenly appeared on the infected host's desktop as shown in Figure 8.
Figure 8: Desktop of the Windows host shortly after the CryptoBit infection.
Figure 9: A close-up of the CryptoBit decryption instructions.
The window was immovable. After rebooting the host, that pop-up window disappeared. We were left with a text file on the desktop containing the same decryption instructions. We also say key files. So far, we have seen key files with names like HITLERSNASTYLITTLECRYPTEROMGWTFHELP.KEY23 and HITLERSNASTYLITTLECRYPTEROMGWTFHELPOHNOES.KEY24.
Figure 10: The Windows desktop after rebooting from June 23, 2016.
Figure 11: The Windows desktop after another infection on June 24, 2016.
Email addresses from the decryption instructions were:
- epiclesis[at]protonmail.ch
- kyklos[at]lelantos.org
- kyklos[at]scryptmail.com
- malakia[at]anoninbox.net
- malakia[at]openmailbox.org
- sycophant[at]sigaint.org
The bitmessage.org address from the decryption instructions was:
- BM-NAxZ29ouecw2Y7ibaXKus1vxDRDfheW6
Conclusion
As of June 27, this campaign has started distributing other malware. But from June 17 through June 27, we discovered at least 8 samples of this updated CryptoBit variant communicating to laoismacau[.]com on 58.64.142[.]89. SHA256 hashes for these samples follow:
- 2477db8c1a6882212921ce396d85964d182f9993a0786fb7ccc497b0af78fd3b
- 4eb75511b34cc276251dff1007328477836da59458e1f89c607c2590fe2ebdaf
- 5351c106e578453993d20b10bd71301c831a2a0cea3aa45d911fde7a94b9247a
- 642a3067a35348a833e82e7c08eb53c27f6d2bc68c61bc6e81f135e9927969c7
- 6cb7ceca202fccbb8592728b030127eff7a5661b80131d2a40dc637b76d82fa8
- 8fe6b7f52033794d97aa58605ba3eb306c537abeeaf6d14f45ba3204bf112f70
- 90e1ea707f97105a99cd7e960fc26deb91aba68f50ec80e40bf915822c4e3998
- bd7e11ecdf7308a4173bdaff82b38c2fba47939ac0356a1878a52fff203656ab
Palo Alto Networks customers are protected from Rig EK and CryptoBit ransomware through our next-generation security platform. WildFire detects CryptoBit files as malicious, and AutoFocus users can identify them with the CryptoBit tag.
Text extracted automatically; images, tables and formatting may be missing. Original: https://unit42.paloaltonetworks.com/unit42-cryptobit-another-ransomware-family-gets-an-update/