Exploit Kit  - AecFF1536271400 - Hackers Launching GandCrab Ransomware via New Fallout Exploit Kit
Exploit Kit

Cybercriminals now using new Exploit Kit for launching GandCrab Ransomware via Malvertising Campaign that targets many victims around the world.

This malvertising campaign mainly affected users in  Japan, Korea, the Middle East, Southern Europe, Asia Pacific region and other countries.

Along with this Exploit kit, there are additional domains, regions, and payloads associated with the campaign that helps to successfully deliver the GandCrab ransomware.

Attacker carefully picking up the victims to delivering the malicious content to the target users, if the profile matchs then the users redirected from a genuine advertiser page and finally reaching the EK landing page via multiple 302 redirections.

- landing page 1 - Hackers Launching GandCrab Ransomware via New Fallout Exploit Kit

Attackers keep changing the Exploit kit (EK) landing page to evade the IDS detection based on the pattern and other methods.

Other then this, malvertisement either delivers the exploit kit or it tries to reroute the user to other social engineering campaigns based on the browser/OS profiles and user location.

Social Engineering campaigns & Exploit Kit Landing Page

AV prompt for Mac users to download the new file by posted as  a legitimate update by saying “Your Mac might be infected with latest viruses”

- Picture6 - Hackers Launching GandCrab Ransomware via New Fallout Exploit Kit

An initial stage of landing page contains a  VBScript vulnerability (CVE-2018-8174) code later embedded code will be added for further more reliable payload execution.

Later the next stage of VBScript code will be decoded by keeps the VBScript code as Base64 encoded text in the ‘<span>’ tag where it loads the Jscript code when pages loads.

- Picture8 - Hackers Launching GandCrab Ransomware via New Fallout Exploit Kit

The decoded VBScript code the CVE-2018-8174 vulnerability and executes shellcode and the shellcode downloads a XOR’d payload at %temp% location, decrypts it, and executes it.

Its initial loading and final payload execution will be done by malware contain using PE loader code.

According to FireEye Researchers, request sequence leads to GandCrab ransomware being fetched and manually loaded into memory by the malware.

- Picture21 - Hackers Launching GandCrab Ransomware via New Fallout Exploit KitIn recent years, arrests and distruptions of underground operations have led to exploit kit activity declining heavily. Still, exploit kits pose a significant to users who are not running fully patched systems. FireEye Said.



Source link

LEAVE A REPLY

Please enter your comment!
Please enter your name here