Silence Exploit Kit new brows.....oh wait !

Silence Exploit Kit Logo

A "new" Exploit Kit is advertised since one month underground. Thanks @UnicornSec for spotting the advert. But if you are busy...just jump to the end.. :) not worth your time.

Thread title :
★♛★NEW ★Silence Exploit  Private Exploit Pack   High Rates   FUD ★ NEW★♛★

Screenshot of the advert

When you click on the Vouches : Spoiler

Silence Exploit Kit - "Vouches"

And the bottom logo in the sig is animated.

Silence Exploit Kit animated logo in "The Silence" signature.

Usually it's the moment where you have to try to find something new...and then make sure it match. But seeing this :

Invitation to register

It tried...but the IP of that domain was already familiar

Silence Exploit Kit Login/Register Screen

Now i'll show the registering process and inside...but you should better fly fast over it cause you may waste your time.

Register - Step 1 - User infos

Register - Step 2 - Verify Data

Register - Step 3 - Finish

Silence Exploit Kit - Home - Dashboard

Silence Exploit Kit - Home - My Profile

Silence Exploit Kit - Exploit - My Files

www.toptonic .bz

At that exact moment I knew almost for sure what was all this about and why first IP was familiar.
Note that going on : www.toptonic .bz you see


And that was familiar too.

Part of the source code of toptonic .bz index.

Note : www.revolutionmt2 .net
I was hoping not finding evident link..but so obvious that i can't ignore....see later...

Silence Exploit Kit - Exploit - My Thread

Silence Exploit Kit - Exploit - My Stats. Empty...no active thread...but what is worth noticing is that it's a Popup And that does not fit with the other part of the user interface (but perfectly stick to my deep feeling).

Silence Exploit Kit - Scan Service

Silence Exploit Kit - Crypt Service

Silence Exploit Kit - Traffic Service

Silence Exploit Kit - Buy Services

And now...Here was my feeling. All this is just Blackhole subletting ! 
5.45.179.44 is an IP of a bad bad range that I associate to a Blackhole that appear on my radar (but was surely operationnal before) on the 2013-05-08  with landing : /transport/posted-sorts.php on TCP port 5555 of IP 5.45.176.207

Checking a the server a little I was able to figure out that the mothership (that I usually never disclose - but in that case that serve the explanation) was : 174.120.184.68
Original config was like :

bhadmin : progress
bhstat : service
links : transport
library : fatal
data : continuous
files : locked

We could think it's a shared server...but one user of the forum posted his stats :

Silence...euh Blackhole Exploit Kit Stats with some cosmetics. And the popup embed in fact the "bhstats" (see the scroll bar). While writing : bhstat = service

And that also explain why this Blackhole is so active. I have seen at least 46 distinct file threads in one month. Few blackhole have such an activity. And also a good number of reverse proxy.
Right now :

Positive IP to "The Silence" Blackhole in  5.45.176.0/21

On the mother range :

Positive IP to "The Silence" Blackhole in his mothership Range... 70...oh  noze...Jo !

This one is also the same owner :

In my opinion 2 real server. One by softlayer with (at least) 5 ips, and one by BKGV with two range acting as a proxy.


For the activity you can see on Urlquery :

Cuted PrintScreen of Urlquery /transport/ search

Some files gathered from this Blackhole - http://pastebin.com/xXaV1Hae :

Some payload from BH EK /transport/

Won't spend time in studying that. Many Bitcoin miner. But we could have guess :

Comment about "The Silence"

And in fact...we could have guess more far earlier...

The Silence trying to Rent his Rented Blackhole

At that time someone asked him, and it's still a valid question:

Question about his blackhole subletting back in november

We could have a lot of smile reviewing the 29 pages (2013-06-01) thread...but let's finish that.

"this pack really is the best of the best when it comes to exploit packs" - The Silence

And now embarrassed silence...