Meet CottonCastle EK

Pamukkale  (source image: sina.com)

Thanks to an Independant researcher from Russia who shared some referer driving to an Exploit Kit on tcp 27005, I was able to meet again the "Unknow EK" that was first spotted by EKWatcher in September 2013.


Pattern for this EK were like :

Custom TDS then CottonCastle - 2013-09-16 from GB

GET http://alabamarog.socket-render.info:5125/h2x/3/a627d480c37cfaf6f3634150496340ed/http%3A%2F%2Fgoo.gl%2FoYb4sq
207 Multi-Status (text/html)

GET http://alabamarog.socket-render.info:5125/h2p/3/BG/f444ab1cfeb2945d149c03508367776f.dts
200 OK (application/octed-stream)

GET http://alabamarog.socket-render.info:5125/h2i/3/BG/c708c60762f6a35c5fce213eb840ce51
200 OK (application/octed-stream)

GET http://alabamarog.socket-render.info:5125/callme?r=111
200 OK (text/html)

------------------------------------------
OT: that infection chain was really interesting.
Out of Topic 1 : the redirecting js on the compromised website is quite interesting

js  ( http://pastebin.com/T4RLpFuN 2014-06-05) in front of the first TDS seems to give a weight to the event and will fire only for IE and Firefox Not sure how effective is this (i mean compared to basic onmouse move) Reference to Justin Bourque Reload: 2014-06-06 http://pastebin.com/XeHfVTKU Reference now to "Michelle reporter"

Out of Topic 2 : the first TDS will drive you to Angler EK from US :

Angler EK after first TDS in US

Payload 270fd28f3b9ae3ad071468ec0c03c83d is Vawtrak

and from DE in some case:

Angler EK after first TDS in DE (in the night) By day it was redirecting to CottonCastle Fully working on the 2014-06-05 but 409 on the 2014-06-06

Payload  6f56f55c38be1cdad7ca498f4e93e219 fire some Glupteba rules by Emerging Threats

Suricata with ET rules alerts on traffic generated by 6f56f55c38be1cdad7ca498f4e93e219

In some case from Russia i got both CottonCastle's TDS and a Nuclear Pack

First TDS redirecting to both CottonCastle's TDS and Nuclear Pack From Russia 2014-06-06

Payload was : b8d913208d4230b2ff7ddc01a1ddef07
Now back to CottonCastle.
------------------------------------------
Pattern did not change that much, it now looks like :

2 TDS then CottonCastle 2014-06-05 from DE Note the c.hit.ua counter both on the second TDS and in the landing. Note the reverse 2letter country code in many calls.

There are points that i have trouble to explain.
The day after the Counter have disappeared and the Exploit Kit seems not replying to hosts from RU/UA. Really strange when we see what those counter were like on the 5th :

Distribution of Countries hiting the Exploit Kit landing 2014-06-05

Todo. 

CVE-2011-3544 ?? -- Didn't have the opportunity to check the EK with Java6 < 27 or at least < 18.
AV Process name Callback test. CVE-2013-2551 path.

Exploitation Graph :



This Exploit Kit is not widely used (maybe only by the operators Corkow botnet - and 2nd TDS).

Files: Here