To illustrate a post to come on Blackhole Transition here are some numbers for the /home/ aka q.php Blackhole aka Darkleech fuelled.
Note : Darkleech module filter user-agent. Infection tried only on IE (so Opera/Mozilla and others are researchers or honeyclient etcs). Then Blackhole also filter on IE (so 0 infections for others)
.png) |
| Note : Thread Name. Number of Loads. Browser Filter on blackhole side too. |
.png) |
| File : q.php = Pony - Thread mod1 Lock : a.php = Nymain.a - Thread adult (inactive since december) |
They were pushing Pony which was then (depending of your country) pushing Urausy or Nymaim.b (which itself was loading Zaccess or Nymaim.a Ransomware). Sébastien Duquette from Eset wrote a nice post about that.
 |
| Nymaim.A - Urausy Variant with B&W Zoo/CP images (Careful : this design has also been used by Bomba Locker) |
 |
| Nymaim.A -US Design |
2013-04-09 - 20:17 (RU Time) - 31081 infections in 20 hours
.png) |
| q.php Blackhole - 2013-04-09 - 20:17 RU Time Note the thread name : mod1 |
.png) |
| 2013-04-09 - 21:07 (since monday (day before - 45 hours) numbers) |
2013-04-11 - 22:22 - 29398 infections in around 22 hours
.png) |
| q.php Blackhole - 2013-04-11 - 22:22 RU Time |
2013-04-12 - 20:29 - 26319 infections in 20.5 hours
.png) |
| q.php Blackhole - 2013-04-12 - 20:29 RU Time |
Note : Reveton group were doing as good as this (at least in oct/nov 2012) with Cool EK
Read more :
There are a huge number of posts about this group so i made a selection.
Dissecting FireEye's Career Web Site Compromise 2013-09-18 Dancho Danchev
The Home Campaign: overstaying its welcome 2013-07-02 Sébastien Duquette - Eset
The Evil Came Back: Darkleech's Apache Malware Module - 2013-03-24 -Hendrik Adrian - MalwareMustDie
1940 IPs for a BHEK/ULocker server - Nexcess-Net - 2012-09-14
Post Publication Reading :
Nymaim: Browsing for trouble - 2013-10-23 - Jean-Iain Boutin - Eset