Angler Exploit Kit
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2015-0311 | Use-After-Free Remote Code Execution in Adobe Flash Player CVE-2015-0311 is a use-after-free memory corruption flaw in Adobe Flash Player that Adobe patched in an emergency January 2015 release (APSB15-02); CISA catalogs it generically as an unspecified remote code execution vulnerability. It is triggered when a victim's Flash plugin processes maliciously crafted SWF content, typically embedded in a web page or delivered via malvertising and exploit kits such as Angler, and requires no authentication. A successful attacker gains arbitrary code execution in the context of the logged-in user, enabling malware installation; contemporaneous 2015 reporting tied Flash 0-day malvertising campaigns (e.g., Fessleak) to ransomware such as TeslaCrypt. Anyone running an affected Flash Player version in a browser or standalone install was exposed, but Flash Player has been end-of-life since the end of 2020, so the exposed population today consists of legacy, unmaintained systems. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2022-04-13 and carries an EPSS of 85.8% (100th percentile), although no public proof-of-concept is tracked. Do: Upgrade to the patched release from Adobe's January 2015 advisory — 16.0.0.296 (with 13.0.0.262 for the extended-support 13.x branch) — or, preferably, remove Flash entirely since it reached end-of-life on December 31, 2020; CISA's required action is to disconnect or retire any systems still running it. Check browsers, embedded devices, and internal applications for residual Flash plugins, and disable Flash or block SWF content as a mitigation where the plugin cannot be removed. | — | 86% | KEV |
| mass≈1 billion+ installs at the time of disclosure (near-universal desktop browser plugin); now limited to unmaintained EOL systems |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 178.32.131.248 | lder samples. IOCs IP Address: 85.25.107.126 207.182.149.14 178.32.131.248 178.32.131.185 85.25.107.127 176.103.144.48 SHA256: 56f61bd |
| ipv4 | 207.182.149.14 | s well as the older samples. IOCs IP Address: 85.25.107.126 207.182.149.14 178.32.131.248 178.32.131.185 85.25.107.127 176.103.144.48 |
| ipv4 | 85.25.107.126 | new variants as well as the older samples. IOCs IP Address: 85.25.107.126 207.182.149.14 178.32.131.248 178.32.131.185 85.25.107.127 |
| sha256 | 003156c92d99aa8bca0f7bc443a03f32a8ce5e26e940f6681747abbc44e1409c | 64c81277ed3291d79c27e0c326df43eccb050058cc3b1705ade SHA256: 003156c92d99aa8bca0f7bc443a03f32a8ce5e26e940f6681747abbc44e1409c Despite the low Anti-Virus detection rates, Cisco AMP and N |
| sha256 | 56f61bd84f6851dcd749c95ebcbc94b7814bedb12ae72db776e3c27d4be43ef8 | ilities. The first and most commonly served sample: SHA256: 56f61bd84f6851dcd749c95ebcbc94b7814bedb12ae72db776e3c27d4be43ef8 is the widely distributed version of the Flash 0-day for An |
| sha256 | 6e2d96990f92864c81277ed3291d79c27e0c326df43eccb050058cc3b1705ade | low detection rates currently (Between 1/57 - 3/57) SHA256: 6e2d96990f92864c81277ed3291d79c27e0c326df43eccb050058cc3b1705ade SHA256: 003156c92d99aa8bca0f7bc443a03f32a8ce5e26e940f668174 |
| sha256 | ca0cd15e28620dcb1b2fb5d29fb6daaa88346d8775139607bd9d2f583415e7b8 | the Angler EK, as Talos has discussed previously . SHA256: ca0cd15e28620dcb1b2fb5d29fb6daaa88346d8775139607bd9d2f583415e7b8 There is an additional group of hashes that are all variant |
Full article616 words · extracted from blog.talosintelligence.com · click to collapse
Tuesday, February 3, 2015 02:49
This post was authored by Nick Biasini
On January 27th, Talos researchers began observing a new Angler Exploit Kit (EK) campaign using new variants associated with (CVE-2015-0311). Based on our telemetry data the campaign lasted from January 26th until January 30th with the majority of the events occurring on January 28th & 29th.
Researchers detected the new campaign when referencing a known hash that was delivering the recent Flash 0-day (CVE-2015-0311). During this investigation several layers of subdomains are being used to avoid detection. As of the writing of this blog ~1800 domains have been seen being used by the following IP addresses:
- 85.25.107.126
- 207.182.149.14
- 178.32.131.248
- 178.32.131.185
- 85.25.107.127
These domains are associated with the landing page and exploits. None of the actual root domains appear to be compromised and are legitimately registered to owners. It appears that the actors have managed to compromise a large group of registrant accounts and have set up subdomains (i.e. acfbbfhdahfeh.legitdomain.info). There are enough of these domains that some of them are only seen once before being abandoned. The majority of the compromised domains are registered through GoDaddy and it appears that 50+ accounts have been compromised. Many of these accounts control multiple domains with some controlling 45+ unique domains. Below is a sample showing a small portion of the subdomains that were registered to a single domain all resolving to a single IP address.
To take the approach a step further these actors have utilized another tier of the subdomains to serve as the initial redirection page. Our telemetry data points to another ~650 of these subdomains linked back to a single IP address, 176.103.144.48. The main distribution method is malvertising with the malicious advertisement pointing to an initial tier of compromised subdomains. These sites then redirect to another subdomain delivering landing page and exploitation. These actors have been seen serving both Adobe Flash and Silverlight exploits, which will be discussed in more detail below.
|
| Click to Enlarge |
Exploit Details
The exploits that are being served are a combination of known and new variants of existing vulnerabilities. The first and most commonly served sample:
SHA256: 56f61bd84f6851dcd749c95ebcbc94b7814bedb12ae72db776e3c27d4be43ef8
is the widely distributed version of the Flash 0-day for Angler Exploit Kit (details). The second groups of samples were Silverlight based, which are known to be part of the Angler EK, as Talos has discussed previously.
SHA256: ca0cd15e28620dcb1b2fb5d29fb6daaa88346d8775139607bd9d2f583415e7b8
There is an additional group of hashes that are all variants of CVE-2015-0311 but have very low detection rates currently (Between 1/57 - 3/57)
SHA256: 6e2d96990f92864c81277ed3291d79c27e0c326df43eccb050058cc3b1705ade
SHA256: 003156c92d99aa8bca0f7bc443a03f32a8ce5e26e940f6681747abbc44e1409c
Despite the low Anti-Virus detection rates, Cisco AMP and Network Security IDS & NGFW successfully detected and blocked the new variants as well as the older samples.
IOCs
IP Address:
85.25.107.126
207.182.149.14
178.32.131.248
178.32.131.185
85.25.107.127
176.103.144.48
SHA256:
56f61bd84f6851dcd749c95ebcbc94b7814bedb12ae72db776e3c27d4be43ef8
6e2d96990f92864c81277ed3291d79c27e0c326df43eccb050058cc3b1705ade
003156c92d99aa8bca0f7bc443a03f32a8ce5e26e940f6681747abbc44e1409c
ca0cd15e28620dcb1b2fb5d29fb6daaa88346d8775139607bd9d2f583415e7b8
Conclusion
This is another example of how Angler Exploit Kit continues to differentiate itself. It changes and evolves on a constant basis producing new variation on the existing exploits as well as providing enough customization on the recent vulnerability (CVE-2015-0311) to effectively avoid reliable detection. If the first month of 2015 is any indication, the Angler Exploit Kit could have a big year.
Snort Rules: 33271-33274, 33286 for the most up to date list please refer to Defense Center
Protecting Users Against These Threats
Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors.
CWS or WSA web scanning prevents access to malicious websites, including the downloading of the malware downloaded during these attacks.
The Network Security protection of IPS and NGFW have up-to-date signatures to detect malicious network activity by threat actors.
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/angler-exploit-kit-new-variants/