In our recent post covering CVE-2015-0311
, two of the Command and Control (C&C) domains used in the Domain Generation Algorithm (DGA), mapped back to the same Server IP address - 188.8.131.52.
They were also using the same nameservers for resolution:
We took a closer look at the domains using these nameservers and found a distinct correlation between the C&C servers being used in this and other, possibly unrelated campaigns. In the past month, we've tracked over 70 domains involved in malware C&C or other malicious activity involving Click Fraud & Ransomware campaigns. These domains were registered via "Domain Context"
and use "Regway.com"
nameservers for resolution.
To recap, we saw the initial binary was executed via the CVE-2015-0311 exploit, which then attempted resolution of multiple domains that were generated through a DGA:
Below is partial whois information for the two domains that resolved at that time:
Taking a closer look at these domains, we noticed that they share some commonalities, specifically their nameservers and IPs:
Comparison of C2 Domains
|Domain ||IP ||Observed Method ||Registrar ||Creation Date ||Contact ||Nameserver(s) |
|gaabbezrezrhe1k.com ||184.108.40.206 ||POST / ||domaincontext ||2015-01-19 ||contact @privacyprotect.org ||ns1.regway.com, ns2.regway.com |
|wzrdirqvrh07.com ||220.127.116.11 ||POST / ||domaincontext ||2015-01-21 ||yingw90 @yahoo.com ||ns1.regway.com, ns2.regway.com |
Taking a look at other domains registered around that time via "Domain Context"
by '[email protected]
' and also utilizing "regway.com"
for resolution, we find the following 39 domains: aslfnsdifhsfdsa.com avzxpjvrndi6g.com bnxjgqotkqaftj.com cavnplxhlwjzld.com dtnvleoidsncuz7i.com ggrdyqtlgdbpkkjf0e.com gqzrdawmmvaalpevd0.com grqtnsmqveprdc8f.com jacafyfugdnvoov.com jdioermutrealo.com jxouhxclhzdlwa1d.com jzkebkiznfttde.com kdioqw873-kioas.com koslnotreamouyer.com krbewsoiitaciki2s.com mcoihsopejaue.com mlhxqydhcjqvei.com nertafopadertam.com noieutrabchpowewa.com nwlxjqxstxclgngbw7.com nyrtazolas.com piragikolos.com pndrdbgijushci.com qhmbdzygdevxk0m.com qvllupuqjknz5.com roppsanaukpovtrwl.com rwermezqpnf4.com tuchrtwsabl7b.com uowcvvknkrtipj.com vsdylqjfrdqaxzyd.com vucjunrhckgaiyae.com vxmsrlsanrcilyb7o.com vxuiweipowe92j.com xgihfqovzurg8.com xmoqu38hasdf0opw.com xqirefjyjkcn7u.com yoksfffhvizk8z.com yyfaimjmocdu.com zmbkfrdpnaec.com
Looking at the same time period for domains registered through "Domain Context"
, using "Privacy Protect"
, and using "regway.com"
for resolution, we find an additional 32 domains, which also seem to fit the general theme of a DGA: 394iopwekmcopw.com agdedopribili.com asop83uyteramxop.com balamodaevi.com cawnqrvbmfgfysdb.com deertraefople.com gpsnypbnygqidxj.com gurtgusinoi.com gypqlkwgkmzapx33.com iludyamdostaetsya.com iqjlyjxplidpbbpuh.com istinuskazat.com itdlwcwonkhjrxlzuh.com jddhbxrssjgqlsr.com jyjhsvgkpeni0g.com kbazarnomuondnu.com kosnetsyanetolko.com muzhikgusei.com nabarishispeshil.com neochenvezhlivo.com predlinnoihvorostinoi.com prodavatipravdu.com retravopoytem.com sokgtxioqzxvuksf1.com tamgusyam.com tuzlynlyvrbrdhrpx.com vpsbxfdyphdykmlct.com xnanomailing.com yamuzhikainevenu.com ytpliogapddu5.com zhcjrjolbeuiylkyzx.com zoidpyjhij36.com
The vast majority of these domains were resolving to Bedep's C&C servers. The following is a POST request to a C&C server from a Bedep infected system containing base64 encoded data:
However, some of the domains are being used in other seemingly unrelated malicious campaigns. For example the domain 'xmoqu38hasdf0opw.com
' was identifed by Kafeine
as hosting a Reveton ransom page.
Other domains being used to monetize Bedep infections via click fraud include: 394iopwekmcopw.com/ads.php 394iopwekmcopw.com/r.php?key=41c7eed67784325bb935f2b6543ff37d asop83uyteramxop.com/ads.php?sid=1910 asop83uyteramxop.com/r.php?key=c8a0293dce08d582ca645449d849543d koslnotreamouyer.com/ads.php?sid=1905 koslnotreamouyer.com/r.php?key=666fe962677224b1799919a70c7c2c9e
And the following domains are intermediaries hosting encrypted files: kosnetsyanetolko.com/slwsbpetw.eqmh kdioqw873-kioas.com/asdfsfsdf1.php nertafopadertam.com/2/showthread.php nyrtazolas.com/1/search.php piragikolos.com/asdfsfsdf1.php
Unfortunately, there are several different IPs in use on various ASNs:
C2 IP Information
|IP ||Netblock ||ASN |
|18.104.22.168 ||22.214.171.124/16 OVH ISPOVH_65488197 OVH Static IP ||AS16276 |
|126.96.36.199 ||188.8.131.52/16AS16276FR-OVH-20120706 OVH SAS ||AS16276 |
|184.108.40.206 ||220.127.116.11/16 OVH ISPOVH OVH SAS Dedicated Servers ||AS16276 |
|18.104.22.168 ||22.214.171.124/22AS197890FR-OVH-20120823 OVH SAS ||AS16276 |
|126.96.36.199 ||188.8.131.52/16 OVH ISPOVH_65488197 OVH Static IP ||AS16276 |
|184.108.40.206 ||220.127.116.11/16 OVHOVH OVH SAS Dedicated servers ||AS16276 |
|18.104.22.168 ||22.214.171.124/19 RR-RC-Enet-ColumbusEE3-DOM ||AS10297 |
|126.96.36.199 ||188.8.131.52/19184.108.40.206/13Route for Nobis Technology Group, LLCNETBLK-NOBIS-TECHNOLOGY-GROUP-18 ||AS15003 |
|220.127.116.11 ||18.104.22.168/1922.214.171.124/13Route for Nobis Technology Group, LLCNETBLK-NOBIS-TECHNOLOGY-GROUP-18 ||AS15003 |
|126.96.36.199 ||188.8.131.52/16184.108.40.206/17 OVHIUNET-BNET80 OVH SAS ||AS1267 |
|220.127.116.11 ||18.104.22.168/24 AS29073 Route objectNL-ECATEL-20100816 Ecatel LTD ||AS29073 |
|22.214.171.124 ||126.96.36.199/22Redstation LimitedRSDEDI-KBPNNOIL Dedicated Server Hosting ||AS35662 |
|188.8.131.52 ||184.108.40.206/22220.127.116.11/24Proxy-registered route objectRSDEDI-IBOBAPEP Dedicated Server Hosting ||AS35662 |
|18.104.22.168 ||22.214.171.124/20WORLDSTREAM-BLK-217-23-0-0WORLDSTREAM WorldStream IPv4.19 ||AS49981 |
|126.96.36.199 ||188.8.131.52/20Hosting Solutions InternationalHSI-3 ||AS30083 |
|184.108.40.206 ||220.127.116.11/20Hosting Solutions InternationalHSI-3 ||AS30083 |
|18.104.22.168 ||22.214.171.124/20Hosting Solutions InternationalHSI-4 ||AS30083 |
|126.96.36.199 ||188.8.131.52/20184.108.40.206/24Proxy-registered routeHSI-2 ||AS30083 |
Attackers continue to move away from single IPs and small IP pools, preferring to distribute the infrastructure across multiple netblocks. This ensures their infrastructure is more resilient to blocks and takedown attempts allowing the attackers to continue to profit from compromised devices. Likewise, if a registrar or nameserver with poor reputation is found, specific actors will continue to leverage them until mitigations are put in place.