{"id":5870,"date":"2017-01-18T22:53:20","date_gmt":"2017-01-18T22:53:20","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/01\/18\/news-75\/"},"modified":"2017-01-18T22:53:20","modified_gmt":"2017-01-18T22:53:20","slug":"news-75","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/01\/18\/news-75\/","title":{"rendered":"The curious case of a Sundown EK variant dropping a Cryptocurrency Miner (updated)"},"content":{"rendered":"

This post was authored by\u00a0@hasherezade<\/a>\u00a0and\u00a0J\u00e9r\u00f4me Segura<\/a><\/span><\/em><\/p>\n

We recently\u00a0encountered an atypical case of Sundown EK in the wild – usually the landing page is\u00a0obfuscated, but in this case there was plain JavaScript. The exploit was dropping some malicious payloads that we took for further analysis. It turned out that they are also atypical by many means. In this article, we will describe the details of our investigation.<\/p>\n

Exploit Kit<\/h3>\n

[Edit] SpiderLabs has written<\/a> about this EK and calls it Terror EK.<\/em><\/p>\n

This exploit kit has a different serving infrastructure than what we are used to seeing, but it is\u00a0essentially the same Sundown EK codebase that we know.<\/p>\n

\"sundown_variant_\"<\/a><\/p>\n

In comparison, here’s a fresh Sundown EK, using steganography<\/a>\u00a0where we can see that both EKs share the same Flash exploit.<\/p>\n

\"fresh_sundown\"<\/a><\/p>\n

The landing page for this variant has almost no obfuscation, which was a bit of an oddity<\/a>:<\/p>\n

\"code\"<\/a><\/p>\n

The infrastructure for pushing this EK\u00a0relies on a few domains all hosted on the same IP address:<\/p>\n

\"149-202-164-86\"<\/a><\/p>\n

The payload URL (pastetext.biz<\/em>) is also tied to\u00a0the same EK distributor, hinting at a single actor operation.<\/p>\n

Payload – Cryptocurrency miner<\/h3>\n

Analyzed samples<\/em><\/p>\n