Posted: January 2nd, 2017 | Author: xanda | Filed under: IT Related | Tags: EK, Exploit Kit, RIG | 1 Comment »
Happy new year!
It has been a while since the last update.
Today I’ve saw an update in malware-traffic-analysis on RIG EK. Nothing new, but i asked myself if my old hunting technique is still relevant today, since i left EK hunting ‘industry’ 1 year++ ago. So i wrote a simple script to perform a quick check:
xanda:tmp xanda$ ./loop.sh 109.234.36.0
109.234.36.133
109.234.36.210
DONE!
I’ve found 2 IPs; 109.234.36.133 (currently serving RIG, mentioned in malware-traffic-analysis blog) and 109.234.36.210. 109.234.36.210 is not yet serving anything malicious, but my prediction, it will be serving RIG EK in/within the next 7 days.
Some tips on this fingerprinting technique:
- Based on the initial IP found, look for the IP range assigned to the same ASN, in this case 109.234.36.0/24
- Identify the HTTP header response from the known bad IP, and use it to fingerprint the rest.
- Based from my experience, 1 batch of EK server setup will have similar (or almost similar) HTTP header response, and some EK will use 1 subnet for 1 batch (but not necessarily)
- EK server will always (mostly) be dedicated. If you found historical pDNS record on that IP, verify (with dig/nslookup) for the current IP resolved by the domain(s). For example; 109.234.36.210 has 3 historical pDNS record, but at the moment, 1 of the domain has expired, and another 2 domains are now pointing to different IP(s).
- This method will only works if the “scanned” hosts are alive at that particular moment
Hope it helps. Happy hunting
Posted: December 12th, 2012 | Author: xanda | Filed under: IT Related | Tags: Exploit Kit, pattern, redkit, regex | 4 Comments »
It’s been a while since the last time I logged in into my WordPress. I’ve jumped on BlueCoat System‘s bandwagon (and left MyCERT earlier), so I’ve to spent some time to make myself familiar with this new environment and job 🙂
Last week, @fknsec, in his blog, wrote a very good article about RedKit Exploit Kit. But here I would like to add few more interesting facts on the RedKit patterns
- @fknsec did mention about “/hmiq.htm” in his blog, but from my observation, beside Porche and Ferari, the RedKit author also like the letter H. The naming convention for the HTML file will always start from H and ended with .htm (everything in small case). So a working regex for this pattern world be:
** updated on 14 Feb 2013 **
Look like this portion is no longer valid at the moment. You can replace it with:
- 887.jar and 332.jar is quite unique to RedKit. Go hunt them!
- Same goes to 987.pdf
- c.htm as mentioned by @fknsec can be in 1 char (letter) file name (in small case), or it can also be in 2 digit (number) and ended with .htm.
/\/([a-z]{1}|\d{2})\.htm$/ |
/\/([a-z]{1}|\d{2})\.htm$/
- Unlike BlackHole and Cool exploit kit, RedKit will usually be hosted on compromised websites and not having his own special subdomain. Most of the time, RedKit files will be in the main directory of a website/domain
- From my observation, among the famous tricks to lure victim to RedKit are:
- Redirector script planted in jquery JS file
- Redirector in “Domain to sell” placeholder
I think that’s all for today. I don’t know when is the next time to update my blog, since will keep my self busy in these coming weeks, with my first baby is going to execute /h(is|er)/ first version of “Hello World” script in near soon.
Till then, stay safe everyone & happy hunting!
Reference:
- http://fortknoxnetworks.blogspot.com/2012/12/exploit-medfos-url-detection-with-drop.html
- http://malware.dontneedcoffee.com/2012/08/cve-2012-4681-redkit-exploit-kit-i-want.html