#RIGEK

PROPagate Code Injection Technique Detected in the Wild for the First Time https://www.bleepingcomputer.com/news/security/propagate-code-injection-technique-detected-in-the-wild-for-the-first-time/ … #malware #RIGEK #coinminer pic.twitter.com/RVdE98irSD

[2018-06-30] #Slyip -> #RigEK -> #Ursnif https://traffic.moe/2018/06/30/ pic.twitter.com/hPUTIG4wg2

2018-06-29 - Data Dump: fake Flash update and #RigEK - https://www.malware-traffic-analysis.net/2018/06/29/index.html …pic.twitter.com/xzqpoaCkNp

[2018-06-25] Unknown Campaign -> #RigEK -> Dropper -> Miner https://traffic.moe/2018/06/25/index.html … https://traffic.moe/2018/06/25/index2.html …pic.twitter.com/BmHwkWMNeB

Exploit kits: Spring 2018 review. Featuring #RIGEK, #GrandSoftEK, #MagnitudeEK and #GreenFlashSundownEK. https://blog.malwarebytes.com/cybercrime/2018/06/exploit-kits-spring-2018-review/ …pic.twitter.com/wllWEyVSZH

#RIGEK adds CVE-2018-8174 (source: https://malware.dontneedcoffee.com/2018/05/CVE-2018-8174.html …). Blog post updated: https://blog.malwarebytes.com/threat-analysis/2018/05/internet-explorer-zero-day-browser-attack/ …pic.twitter.com/yKWcyxWJTy

Now you can open malicious link in the default browser at http://ANY.RUN  without downloading HTML files. Very useful for researching exploits. And it is already available on FREE plans! #RigEK example: https://app.any.run/tasks/768af0f8-3754-4f8f-b47e-2a5b9eed011c …pic.twitter.com/xifIg8cUCo

#malvertising to #rigek then by exploiting Flash vulnerability CVE-2018-4878 (other runs seen by @nao_sec and @kafeine earlier today) drops #GandCrab #ransomware. Using Flash 28,0,0,126 and fully patched Win 7 64 bit. I blogged! Files and such on -> https://zerophagemalware.com/2018/04/09/rig-ek-drops-gandcrab-ransomware-via-fcve-2018-4878/ …pic.twitter.com/iYRNAEQxQU

#RigEK began using CVE-2018-4878 https://traffic.moe/2018/04/10/  https://www.virustotal.com/#/file/437520117f4deb7691bc0975e413b72c862aef8b18851930f515a385a6a3d54f/detection … (CC: @malware_traffic @jeromesegura)pic.twitter.com/6GIVBdtGUw

2018-03-14 - freegogpcgames[.]pro is a fake domain that led to #HookAds campaign #RigEK pushing #Bunitu - 53hshshshs[.]info is the gate and #RigEK was on 46.229.213.39 when I checked - #Bunitu sample: https://www.virustotal.com/#/file/1f47dda pic.twitter.com/Mff7X7SPG7

3-11-2018: #Seamless -> #RigEK Landing 92.53.127[.101 (AS9123) Decrypt payload key "uDoW4P6LPK" cmd.exe (char obfuscation/split/XOR) Possible sequence detection on RigEK drops: 'cmd.exe /q /c cd /d "%tmp%"' & 'start wscript //B //E:JScript' Paste: https://pastebin.com/54EMgP1d  pic.twitter.com/v4URMoh8aN

2-15-2018: via #RigEK -> #Ramnit banker #malware -> #ISFB gang's hidden VNC module Tested: exports & hidden session via another explorer.exe Hash: 5ae2ad8f0be144ce732badf7dec0a16e Still a formidable weapon for #Ramnit (Demetra) crooks to control a remote PC for carding/ATO pic.twitter.com/UFhlsbWrEQ

2018-02-12 - #Seamless campaign #RigEK sends #Ramnit - pcap/malware/more info at: http://malware-traffic-analysis.net/2018/02/12/index.html …pic.twitter.com/ufJYwyYVJX

2018-01-30 - #RigEK sends #Ramnit, follow-up malware: #AZORult - pcaps/malware/more info at http://malware-traffic-analysis.net/2018/01/30/index.html … - possibly the #Ngay campaign but cannot confirmpic.twitter.com/bBCl1bnylN

2018-01-29 - Three days of #Seamless campaign #RigEK pushing #GandCrab #Ransomware - pcaps/malware samples at: http://malware-traffic-analysis.net/2018/01/29/index.html … - Wikipedia tells me "Gand" is an Indian slang term for the buttocks, so you might hear me refer to "GandCrab" as "ButtCrab" ransomware.pic.twitter.com/qJPfE2cVUR

2018-01-19 - Three recent examples of #Ngay campaign #RigEK - pcap and malware samples at: http://malware-traffic-analysis.net/2018/01/19/index.html …pic.twitter.com/9YwUAXwKZs

Let's Learn: Dissect Rig Exploit Kit Anti-Bot Filter Gate Malchain: Seamless Gate -> #RigEK Anti-Bot Filter Gate -> #RigEK Landing Page -> Flash Exploit CVE-2015-8651 -> #Ramnit Banking #Malware Source: http://www.vkremez.com/2018/01/lets-learn-dissect-rig-exploit-kit-anti.html …pic.twitter.com/vjq5WlZfag

2018-01-11 - #RigEK (probably the #Ngay campaign) sends #SmokeLoader/#Sharik which grabs #Monero #coinminer - pcap/malware available at: http://malware-traffic-analysis.net/2018/01/11/index.html …pic.twitter.com/T3QbrZANwF

2018-01-09 - #Seamless campaign continues using #RigEK to send #Ramnit #bankingTrojan - pcap/malware/artifacts at: http://malware-traffic-analysis.net/2018/01/09/index2.html … - @nao_sec also has a recent example at https://traffic.moe/2018/01/09/index.html … - Thanks to @jeromesegura for his help!pic.twitter.com/bpMAmJhPcd