RIG exploit kit
Researchers at 比特衛士 have discovered a new campaign of cybercriminals using the RIG exploit kit to distribute the famous RedLine malware, which aims to steal victims’ data and transfer it to operators.
Interestingly, exploit kits like RIG, which used to be quite popular, are now increasingly fading into the shadows. And all thanks to improved browser protection mechanisms and the rejection of “leaky” technologies like Flash Player and Microsoft Silverlight.
然而, attackers using exploit kits can still break through individual users who are used to not updating their browser. 例如, in the campaign described by Bitdefender, RIG delivers an info-stealer by exploiting a bug in Internet Explorer.
We are talking about a vulnerability under the identifier CVE-2021-26411, which leads to memory corruption when viewing a specially crafted website. If a user is lured to such a resource, the RedLine malware will be installed on their system.
巴巴病毒 (..baa 文件) 勒索軟體
The Baaa virus belongs to the STOP/Djvu ransomware group and targets Windows computers. 它的工作原理是對這些計算機上的文件進行加密, 將它們更改為文件 “.Baaa” 擴大,…
BGZQ病毒 (.bgzq 文件) 勒索軟體
Bgzq 病毒屬於 STOP/Djvu 勒索軟體群組，目標為 Windows 計算機. 它的工作原理是對這些計算機上的文件進行加密, 將它們更改為文件 “.巴格茲克” 擴大,…
Having dug into the system, RedLine collects and sends confidential information to operators: keys from crypto wallets, bank card data, logins, and passwords saved in browsers.
According to Bitdefender researchers, the exploit first dumps a JavaScript file into the system (placed in a temporary directory), downloading and running an encrypted RC4 payload.
Decompressing RedLine is a six-step process consisting of decompression, key extraction, assembly, etc. 因此, files in the DLL format can successfully avoid detection by antivirus tools. The malware connects to the command and control server at 185.215.113.121 on port 15386. Data collected from VPN and FTP clients, Discord, Telegram, Steam, and crypto-wallets are also sent there.