EITest-tools-scripts-IOCs

IOCs EITestキャンペーンに関連する侵害指標（IOCs）は30分ごとに更新されます。 EITestのDGAアルゴリズムで使用されていたドメイン stat-dns.com はシンクホール化されました。その結果、EITestキャンペーンは2018-03-15以降、停止されたようです。 backend-decipher.py EITestスクリプトを介して感染したWebサイトからEITest C2へ送信されたデータをデコードします。 infolDecrypter.py 被害者によって help.php および download.php に送信されたデータをデコードします。...

GandCrab ransomware distributed by RIG and GrandSoft exploit kits (updated)

This post was authored by Vasilios Hioueras and Jérôme Segura Update 2018-02-02: GandCrab is delivered via Necurs malicious spam 1. Update 2018-02-01: GandCrab is now also spread via the EITest campaign 2 3. - - Late last week saw the appearance of a new ransomware called GandCrab. Surprisingly, ...

'HoeflerText' Popups Target Browsers With RAT and Locky Ransomware

A malware campaign utilizing bogus popups that alert users to a missing web-font is targeting Google Chrome and Firefox browser users. The popups contain a malicious JavaScript file that initiates the download of either the NetSupport Manager remote access tool RAT or Locky ransomware. The...

CryptoShield Infections from RIG EK Picking Up

The RIG Exploit Kit remains fairly active despite an overall decline in such activity, and of late, it’s been spreading a fairly new variant of ransomware called CryptoShield. The main culprit is an attack group known for using EITest to deliver malware; it has been infecting victims’ machines vi...

Persistent EITest Malware Campaign Jumps from Angler to Neutrino

A two-year-old EITest malware campaign is still going strong, fueled by the fact it has shifted its distribution technique over time. Now, researchers at the SANS Institute’s Internet Storm Center, are reporting EITest is morphing again based on analysis of the malware campaign conducted earlier...