{"id":7450,"date":"2017-04-26T06:10:05","date_gmt":"2017-04-26T14:10:05","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/04\/26\/news-1241\/"},"modified":"2017-04-26T06:10:05","modified_gmt":"2017-04-26T14:10:05","slug":"news-1241","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2017\/04\/26\/news-1241\/","title":{"rendered":"Terror EK going &#8216;pro&#8217;? Not quite yet"},"content":{"rendered":"<p><strong>Credit to Author: J\u00e9r\u00f4me Segura| Date: Wed, 26 Apr 2017 13:00:46 +0000<\/strong><\/p>\n<p>Since our <a href=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2017\/04\/sundown-ek-gone-missing-terror-ek-flavours-seen-in-active-drive-by-campaigns\/\" target=\"_blank\">last post<\/a> on Terror EK, we haven&#8217;t really seen much activity from this exploit kit. However, in recent days it popped back up again with a slightly new format.<\/p>\n<p>One thing that seemed consistent with Terror EK was the use of a plain IP address in its URL structure:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-17725\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/Terror_IP.png\" alt=\"\" width=\"692\" height=\"151\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/Terror_IP.png 1302w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/Terror_IP-300x65.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/Terror_IP-600x131.png 600w\" sizes=\"auto, (max-width: 692px) 100vw, 692px\" \/><\/p>\n<p>Now we are starting to see it using a domain name (with the <em>.pro<\/em> TLD).<\/p>\n<h2>The campaigns<\/h2>\n<p>We are seeing the usual suspects via\u00a0malvertising from low quality traffic as well as decoy sites. The same\u00a0<a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/redir.png\" target=\"_blank\" data-rel=\"lightbox-0\" title=\"\">obfuscation<\/a>\u00a0technique we talked about in our last post can still be found on\u00a0domains registered by\u00a0a Brian Krebs admirer, unlikely to be his son though.<\/p>\n<h2>Traffic overview<\/h2>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/newpattern.png\" data-rel=\"lightbox-1\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-17719\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/newpattern.png\" alt=\"\" width=\"779\" height=\"248\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/newpattern.png 779w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/newpattern-300x96.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/newpattern-600x191.png 600w\" sizes=\"auto, (max-width: 779px) 100vw, 779px\" \/><\/a><\/p>\n<h2>EK artifacts<\/h2>\n<h3><strong>Initial landing<\/strong><\/h3>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/landing1.png\" data-rel=\"lightbox-2\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-17720\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/landing1.png\" alt=\"\" width=\"730\" height=\"609\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/landing1.png 730w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/landing1-300x250.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/landing1-600x501.png 600w\" sizes=\"auto, (max-width: 730px) 100vw, 730px\" \/><\/a><\/p>\n<h3><strong>Flash calls<\/strong><\/h3>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/flash.png\" data-rel=\"lightbox-3\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-17721\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/flash.png\" alt=\"\" width=\"778\" height=\"735\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/flash.png 778w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/flash-300x283.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/flash-600x567.png 600w\" sizes=\"auto, (max-width: 778px) 100vw, 778px\" \/><\/a><\/p>\n<h3><strong>Silverlight calls<\/strong><\/h3>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/silverlight.png\" data-rel=\"lightbox-4\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-17722\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/silverlight.png\" alt=\"\" width=\"778\" height=\"378\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/silverlight.png 778w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/silverlight-300x146.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/silverlight-600x292.png 600w\" sizes=\"auto, (max-width: 778px) 100vw, 778px\" \/><\/a><\/p>\n<h3><strong>IE exploits<\/strong><\/h3>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/iexploits.png\" data-rel=\"lightbox-5\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-17723\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/iexploits.png\" alt=\"\" width=\"1111\" height=\"835\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/iexploits.png 1111w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/iexploits-300x225.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/iexploits-600x451.png 600w\" sizes=\"auto, (max-width: 1111px) 100vw, 1111px\" \/><\/a><\/p>\n<p>The landing page and associated calls to IE, Flash, and Silverlight exploits are still in plain text. The exploits also appear to be the same old Sundown EK ones.<\/p>\n<p>The developer of this exploit kit has been experimenting and making\u00a0tweaks for a while now. While there are a few malvertising campaigns leading to Terror EK, the lion share still belongs to\u00a0RIG EK.<\/p>\n<h3>IOCs:<\/h3>\n<p>Domain name:<\/p>\n<pre>whereareyou.pro<\/pre>\n<p>IP address:<\/p>\n<pre>178.62.219.246<\/pre>\n<p>URLs:<\/p>\n<pre>whereareyou.pro\/phRUoB0EEKe0c7hebuFTmeWb\/LtTZ9w1Mje7E.php  whereareyou.pro\/phRUoB0EEKe0c7hebuFTmeWb\/VQa0OExKRPgO\/FHS7JFjfW9Vl.html  whereareyou.pro\/phRUoB0EEKe0c7hebuFTmeWb\/tvUNJV6Uhzvn\/ZNPIoaQXLkkU.html  whereareyou.pro\/phRUoB0EEKe0c7hebuFTmeWb\/6godVZHnf7eO\/7Fpp4MHUZXcE.html  whereareyou.pro\/phRUoB0EEKe0c7hebuFTmeWb\/6godVZHnf7eO\/xtc8UCTRj7u5.html  whereareyou.pro\/phRUoB0EEKe0c7hebuFTmeWb\/6godVZHnf7eO\/9kYZ81evk6u5.html  whereareyou.pro\/phRUoB0EEKe0c7hebuFTmeWb\/VQa0OExKRPgO\/xMxzOxKKP4j3.swf  whereareyou.pro\/phRUoB0EEKe0c7hebuFTmeWb\/tvUNJV6Uhzvn\/RFz1s9kbszgb.xap  whereareyou.pro\/phRUoB0EEKe0c7hebuFTmeWb\/5buZoKiY2Bxl.php<\/pre>\n<p>Flash exploit:<\/p>\n<pre>c843959ebeb6f72481849cb0f905ae30694b0dc2dbb0d125f32fb9060c15bc04<\/pre>\n<p>Silverlight exploit:<\/p>\n<pre>9eb1e6bfed606da3ee6b2529915134ecf58ac983316549c9c038a757d07e0aed<\/pre>\n<p>Payload:<\/p>\n<pre>7b08251eb81e11e6f7d43b5287afa43bed6737766753128c70049b7126763dc6<\/pre>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/04\/terror-ek-going-pro-not-quite\/\">Terror EK going &#8216;pro&#8217;? Not quite yet<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/04\/terror-ek-going-pro-not-quite\/\" target=\"bwo\" >https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><strong>Credit to Author: J\u00e9r\u00f4me Segura| Date: Wed, 26 Apr 2017 13:00:46 +0000<\/strong><\/p>\n<table cellpadding='10'>\n<tr>\n<td valign='top' align='center'><a href='https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/04\/terror-ek-going-pro-not-quite\/' title='Terror EK going 'pro'? Not quite yet'><img src='https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/suit.jpg' border='0'  width='300px'  \/><\/a><\/td>\n<\/tr>\n<tr>\n<td valign='top' align='left'>A quick peek into some changes to Terror EK, an underdog exploit kit in development.<\/p>\n<p>Categories: <\/p>\n<ul class=\"post-categories\">\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/cybercrime\/\" rel=\"category tag\">Cybercrime<\/a><\/li>\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/cybercrime\/exploits\/\" rel=\"category tag\">Exploits<\/a><\/li>\n<\/ul>\n<p>Tags: <a href=\"https:\/\/blog.malwarebytes.com\/tag\/exploit-kits\/\" rel=\"tag\">exploit kits<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/sundown-ek\/\" rel=\"tag\">Sundown EK<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/terror-ek\/\" rel=\"tag\">Terror EK<\/a><\/p>\n<table width='100%'>\n<tr>\n<td align=right>\n<p><b>(<a href='https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/04\/terror-ek-going-pro-not-quite\/' title='Terror EK going 'pro'? Not quite yet'>Read more&#8230;<\/a>)<\/b><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/cybercrime\/2017\/04\/terror-ek-going-pro-not-quite\/\">Terror EK going &#8216;pro&#8217;? Not quite yet<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[4503,10528,10987,10539,11945],"class_list":["post-7450","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-cybercrime","tag-exploit-kits","tag-exploits","tag-sundown-ek","tag-terror-ek"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/7450","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=7450"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/7450\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=7450"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=7450"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=7450"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}