Skip to main content

Dropnote 1 Sweet Orange EK rental

Dropnote 1 Sweet Orange EK rental


"Dropnotes" are mainly an "online notebook" to share my notes as I go along

So I was checking my honeypot logs and was noticing C2-traffic towards the domain doubleclick-ads.pw, being a .pw-domain and all, I started investigating the event.

The traffic seen was POST requests directed to doubleclick-ads.pw/js/order.php, the sample itself was initially found on fatburrito.pw/GameHacks.exe [VT].

As with all C2-traffic, it would be interesting to identify the panel as well as any other artifacts hosted on the server.

Resolving doubleclick-ads.pw (doubleclick-ads.pw)... 162.248.166.113
Connecting to doubleclick-ads.pw (doubleclick-ads.pw)|162.248.166.113|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: ./blah.php [following]
--2014-02-16 12:21:03--  h00p://doubleclick-ads.pw/js/blah.php
Connecting to doubleclick-ads.pw (doubleclick-ads.pw)|162.248.166.113|:80... connected.
HTTP request sent, awaiting response... 200 OK



This resulted in a picture being showed ment as a "joke" to for example researchers. The pictures are located in doubleclick-ads.pw/js/img/bp/[0-10].jpg. As I was browsing around checking for indexes I was always presented with a random image. Moving on...

While requesting the root-page, this is when it got interesting as it was loading an iframe:


Which lead to yet another iframe:
A few things to note regarding the above shots. All of the pages is being reported as malicious, including the last one which points to Sweet Orange Exploit Kit (same pattern as published by @kafeine)
The reason why I wanted to highlight the URL is due to the digit /spot8/, this speaks "There is more here!" to me so I started changing the numbers and found that 1-9 are valid folders and all generated an iframe which pointed to Sweet Orange (number 9 generated two iframes, same domain, but different URLs).

Searching urlquery revealed another pattern xxxpass.info/spota/index.php which generated results(!):

Sadly, only /spota/ was found to be a valid folder, but as the pattern /spotX/ repeats, I found that once again 1-9 was valid and allowing directory indexing:

The files are quite self-explained:
getnewlink.php - Generate a new link and saves it to link.txt.
link.txt - Holds the link to where the iframe on xxxpass.info should point.
stats.php - Administration and statistics for Sweet Orange Exploit kit.

Misc
While I was monitoring the iframes generated I found that a new URI is generated every 60 seconds and a new domain/subdomain is generated every 60 minutes [Pastebin]
Hosts involved - urlquery (@urlquery)
botnethosting.com on cybercrime-tracker.net - Cybercrime-tracker.net (@Xylit0l) 

download file now

Labels:

Popular posts from this blog

DVD Review Midsomer Murders Tom Barnabys Last Cases

DVD Review Midsomer Murders Tom Barnabys Last Cases Midsomer Murders: Tom Barnaby�s Last Cases DVD 15-Discs (24 hours) Released by Acorn Media on March 26, 2013. SRP $149.99 (DVD) Subtitles: English SDH 16:9 �I�m going to have my cake and eat it.� I was reading my review I did last year for the DVD set Midsomer Murders: Mayhem & Mystery Files and I was thinking how strange it was to have a period of my life without having this series I could go back to again and again. When I wrote the first review for this series, I knew I was going to like it but I was really surprised by how much I liked it. That DVD set is one that I go back to often. Luckily I have a short-term memory so I am not always sure who the murderer was but I really enjoy the settings and main characters. Purchasing this title from the link above directly helps my site! When I was able to review this new set, Midsomer Murders: Tom Barnaby�s Last Cases , I was very happy because I was able to see more great episod...
Read more

DVD Review Three Classic Charles Dickens BBC Productions

DVD Review Three Classic Charles Dickens BBC Productions As a fan of British television, especially programs from the 1960s & 1970s, I have been keeping my eye on what Simply Media has been outputting especially over the last couple of years. I have seen programs such as Softly, Softly: Taskforce , Doomwatch , Hugh and I , and Dr. Finlay�s Casebook get a DVD release.  Pretty much all of the releases above, I would have never thought any of those would have received a release in a physical format. It�s great to be wrong about this sort of thing because Simply Media keeps putting out content that features some of the heyday of BBC production. Monday, July 03 sees the release of the first set of Charles Dickens classics all produced by the BBC. Three separate titles have been released for the first time on DVD and it has been a treat to watch these: Our Mutual Friend (1958), Great Expectations (1967) & Dombey And Son (1969). I guess what I am really pleased about with this ...
Read more

DVD Review The Ice Warriors

DVD Review The Ice Warriors Doctor Who: The Ice Warriors Special Edition 2-DVD Set   (Main Feature: 143 min) Released by BBC Home Entertainment on September 17, 2013. SRP $34.98 (DVD) Subtitles: English SDH 4:3 Mono black & white (Main Feature) For those who do not want to believe a large cache of missing Doctor Who episodes have been returned, we get another release that takes missing episodes and gives it new lease on life by being animated. This time we look at the very first story to feature that race from Mars known as the Ice Warriors. It supports a tremendous guest cast, generally looks really good and is considered an all-time classic from the famous Season 5 �Monster Season� of Doctor Who . This seems to have everything but yet I find that I have always been underwhelmed by the story. I go a long way back with The Ice Warriors . When I was younger and was into the whole video tape-trading culture, we were extremely happy when we heard the discovery of Episodes 1,4,5,6...
Read more