Insights and Research
Anatomy Of An On-going Malvertising Campaign
During the course of investigating an open incident ticket with a customer, we uncovered what is a common occurrence on the web - legitimate sites linking in third-party content (often advertisements or banners) that ultimately drives the victim browser to an exploit kit.
Here is the chain of events that we observed:
- User browsed to: www.thenewsvault.com
- The site included content from: www.tvshark.com/read/?art=arc8755
- Which included content from: www.tvshark.com/abritebtm300.html
- Which linked in what appears to be an advertisement iframe: ads-svx.httpads.com/adserver/cached_iframe?guid=16ce4035-ded0-49c8-8515-8e234cbb2b8b
- That loaded the "advertisement" rotator from: c1.zxxds.net, which includes a number of pages, the main one being: /jsc/c1/ff2.html?n=1721;c=3;s=4;d=9;w=300;h=250. Some online references show c1.zxxds.net as having a poor reputation, including involvement with adware.
- The c1.zxxds.net site then loaded: chgdjk.info/nw87b6rh/counter.php?id=5 and a number of other pages on this domain which are allegedly exploit kit driven.
- From the response size in the logs, we can see that the exploit kit payload page was: chgdjk.info/nw87b6rh/?11ecfa793c76017554490058535a0301030355535d5555090a05035456510f0a00;1;10
At the time of the transactions, chgdjk.info resolved to 208.76.54.210. Doing some Google searching, we found that the site TheTVDB.com linked in content (probably in the same way) to an exploit kit hosted on behtyg.info (208.76.54.210) - the same IP, reported March 12, 2012.
Looking up other domains that resolved to this same IP shows an interesting history of this recent, on-going campaign. These are some of the domains that resolved to this IP - most/all registered within the last few days, all have the same registrant info, but the emails vary (presumably to get around bulk registration checks):
| Domain | Registrant Email |
|---|---|
| behtyg.info | [email protected] |
| beokjr.info | [email protected] |
| bikegf.info | [email protected] |
| byjeik.info | [email protected] |
| cehrty.info | [email protected] |
| cekioj.info | [email protected] |
| cekuij.info | [email protected] |
| chertyu.info | [email protected] |
| chgdjk.info | [email protected] |
| chtygf.info | [email protected] |
| cmuijy.info | [email protected] |
| dgeryt.info | [email protected] |
| ggtyut.info | [email protected] |
| nehuikj.info | [email protected] |
| nuekhg.info | [email protected] |
| vejuyt.info | [email protected] |
| zehryu.info | [email protected] |
Registrant Information:
Registrant Name:Filippovskiy Aleksandr
Registrant Organization:DOM
Registrant Street1:ylica Baymana. dom 9.korpys A. kvartira 106
Registrant Street2:
Registrant Street3:
Registrant City:yoshkar ola
Registrant State/Province:yoshkar ola
Registrant Postal Code:42400
Registrant Country:RU
Registrant Phone:+7.79276827596
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
DomainTools shows that there have been about 1200 domains registered with this whois information (e.g., search by phone number). We're now seeing 199.59.166.86 used for resolution of the chgdjk.info domain (part of a Black Lotus Communications /24 netblock). Clearly a decent-sized and dynamic malware campaign currently leveraging malvertising to redirect to exploit kit sites.
Unfortunately our replay attempts have been unsuccessful at pulling down the malware content- to include using forged headers (such as user-agent and referrer) as well as beginning from the initial transaction chain. This is a common problem when analyzing malvertising incidents - since the malware is injected as part of an advertisement rotator site, it is difficult to replay as the advertisements and key variables used to drive the advertisement (in this case malware) may change. We will update if there are additional details.