{"id":15657,"date":"2019-06-26T11:10:05","date_gmt":"2019-06-26T19:10:05","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2019\/06\/26\/news-9405\/"},"modified":"2019-06-26T11:10:05","modified_gmt":"2019-06-26T19:10:05","slug":"news-9405","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/06\/26\/news-9405\/","title":{"rendered":"GreenFlash Sundown exploit kit expands via large malvertising campaign"},"content":{"rendered":"

Credit to Author: J\u00e9r\u00f4me Segura| Date: Wed, 26 Jun 2019 18:30:48 +0000<\/strong><\/p>\n

Exploit kit activity has been relatively quiet for some time, with the occasional malvertising campaign reminding us that drive-by downloads are still a threat.<\/p>\n

However, during the past few days we noticed a spike in our telemetry for what appeared to be a new exploit kit. Upon closer inspection we realized it was actually the very elusive GreenFlash Sundown EK.<\/p>\n

The threat actors behind it have a unique modus operandi that consists of compromising ad servers that are run by website owners. In essence, they are able to poison the ads served by the affected publisher via this unique kind of malvertising.<\/p>\n

In this blog, we review their latest compromise responsible for pushing ransomware, Pony and a coin miner onto a large number of victims.<\/p>\n

Stealthy compromise<\/h3>\n

At first, we believed the attack originated from one ad network, but we were able to pinpoint where it came from by reviewing traffic captures. The affected publisher is onlinevideoconverter[.]com, one of the most popular sites to convert videos. According to SimilarWeb<\/a>, it drives 200 million visitors per month:<\/p>\n

\"\"<\/a><\/figure>\n

People navigating to the page to convert YouTube videos into the MP4 format will be sent to the exploit kit, but only after some very careful fingerprinting. The full redirection sequence is shown below:<\/p>\n

\n
\"\"<\/a><\/figure>\n<\/div>\n

The redirection mechanism is cleverly hidden within a fake GIF image that actually contains a well obfuscated piece of JavaScript:<\/p>\n

\n
\"\"<\/a><\/figure>\n<\/div>\n

After some painful debugging, we can see that it links to fastimage[.]site:<\/p>\n

\n
\"\"<\/a><\/figure>\n<\/div>\n

The next few sessions contain more interesting code including a file loaded from fastimage[.]site\/uptime.js which is actually a Flash object.<\/p>\n

\"\"<\/a><\/figure>\n

This performs the redirection to adsfast[.]site which we recognize as being part of the GreenFlash Sundown exploit kit. It uses a Flash Exploit to deliver its encoded payload via PowerShell:<\/p>\n

\n
\"\"<\/a><\/figure>\n<\/div>\n

Leveraging PowerShell is interesting because it allows to do some pre-checks before deciding to drop the payload or not. For example, in this case it will check that the environment is not a Virtual Machine. If the environment is acceptable, it will deliver a very visible payload in SEON ransomware:<\/p>\n

\n
\"\"<\/a><\/figure>\n<\/div>\n

The ransomware uses a batch script to perform some of its duties, such as deleting shadow copies:<\/p>\n

\"\"<\/figure>\n

GreenFlash Sundown EK will also drop Pony and a coin miner while victims struggle to decide the best course of action in order to recover their files.<\/p>\n

Wider campaign<\/h3>\n

Our previous encounters with GreenFlash Sundown EK, for example during our winter 2019 exploit kits review<\/a>, were always limited to South Korea. However, based on our telemetry this campaign is affecting people all over the globe, which is an interesting departure for this threat group.<\/p>\n

Malwarebytes users were already protected against this drive-by attack and we have informed the publisher about the compromise so that they can take action.<\/p>\n

Indicators of Compromise<\/h3>\n

GreenFlash Sundown infrastructure:<\/strong>
hxxps[:\/\/]fastimage[.]site\/
hxxp[:\/\/]adsfast[.]site\/
hxxp[:\/\/]accomplishedsettings[.]cdn-cloud[.]club\/
104.248.42[.]143
172.105.66[.]231
198.211.126[.]118<\/p>\n

Seon ransomware:<\/strong>
a89591555b9acb65353c2b854e582bc41db2fbc0eda2210b89a877d1862084df
591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b<\/p>\n

Pony:<\/strong>
c772bdf4bd05ab63d90f4399e97a1d7eec2891c221739e3b843f9a8c9eddf4d3
9ff00b46b949bd76923137c0b0ed3cd4e252d6e88a55e9b4798525fa40164850<\/p>\n

Coin miner:<\/strong>
58002d0b8acd1a539503d8ea02ff398e7ad079e0b856087f0ca30d767588be4e<\/p>\n

The post GreenFlash Sundown exploit kit expands via large malvertising campaign<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n

https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit to Author: J\u00e9r\u00f4me Segura| Date: Wed, 26 Jun 2019 18:30:48 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
The GreenFlash exploit kit, which we typically saw targeting South Korean users, reaches globally with a large malvertising campaign via a popular website.<\/p>\n

Categories: <\/p>\n