"value":"As I've discussed before, EKs are merely a method to distribute malware. Criminal groups establish campaigns utilizing EKs to distribute their malware. I often see indicators of campaigns that use Magnitude EK or Rig EK to distribute Cerber ransomware.\r\n\r\nIn my lab environment, I generally don't generate much Magnitude EK. Why? Because Magnitude usually happens through a malvertising campaign, and that's quite difficult to replicate. By the time any particular malvertisement's indicators are known, the criminals have moved to a new malvertisement.\r\n\r\nSince early October 2016, I've typically seen Cerber ransomware from the pseudoDarkleech campaign using Rig EK. PseudoDarkleech currently uses a variant of Rig EK that researcher Kafeine has designated as Rig-V, because it's a \"vip\" version that's evolved from the old Rig EK.\r\n\r\nEITest is another major campaign that utilizes EKs to distribute malware. Although EITest distributes a variety of malware, I'll occasionally see Cerber sent by this campaign."
},
{
"category":"Network activity",
"comment":"Rig-V from the EITest campaign",
"deleted":false,
"disable_correlation":false,
"timestamp":"1481870563",
"to_ids":true,
"type":"ip-dst",
"uuid":"58538ce3-601c-4716-bb6f-417b02de0b81",
"value":"195.133.49.182"
},
{
"category":"Network activity",
"comment":"Rig-V from the EITest campaign",
"deleted":false,
"disable_correlation":false,
"timestamp":"1481870564",
"to_ids":true,
"type":"hostname",
"uuid":"58538ce4-7814-4334-8180-418102de0b81",
"value":"hit.thincoachmd.com"
},
{
"category":"Network activity",
"comment":"Rig-V from the pseudoDarkleech campaign",
"deleted":false,
"disable_correlation":false,
"timestamp":"1481870564",
"to_ids":true,
"type":"hostname",
"uuid":"58538ce4-7bec-4498-b89a-445302de0b81",
"value":"new.slimcoachmd.com"
},
{
"category":"Network activity",
"comment":"1.11.32.0 to 1.11.32.31 (1.11.32.0/27) UDP port 6892 - Cerber post-infection UDP traffic",
"deleted":false,
"disable_correlation":false,
"timestamp":"1481870565",
"to_ids":true,
"type":"ip-dst",
"uuid":"58538ce5-3240-4327-bcc6-4e1a02de0b81",
"value":"1.11.32.0"
},
{
"category":"Network activity",
"comment":"1.11.32.0 to 1.11.32.31 (1.11.32.0/27) UDP port 6892 - Cerber post-infection UDP traffic",
"deleted":false,
"disable_correlation":false,
"timestamp":"1481870566",
"to_ids":true,
"type":"ip-dst",
"uuid":"58538ce6-3e80-4e94-8ab8-46fe02de0b81",
"value":"55.15.15.0"
},
{
"category":"Network activity",
"comment":"194.165.16.0/23) UDP port 6892 - Cerber post-infection UDP traffic",
"deleted":false,
"disable_correlation":false,
"timestamp":"1481870568",
"to_ids":true,
"type":"ip-dst",
"uuid":"58538ce8-2d7c-49ca-89ae-48bd02de0b81",
"value":"194.165.16.0"
},
{
"category":"Network activity",
"comment":"attempted HTTP connections by Cerber from pseudoDarkleech campaign",
"deleted":false,
"disable_correlation":false,
"timestamp":"1481870570",
"to_ids":true,
"type":"ip-dst",
"uuid":"58538cea-d9f0-4ef3-8d22-453e02de0b81",
"value":"185.45.192.155"
},
{
"category":"Network activity",
"comment":"",
"deleted":false,
"disable_correlation":false,
"timestamp":"1481870570",
"to_ids":true,
"type":"hostname",
"uuid":"58538cea-4fe0-4dca-b42e-450802de0b81",
"value":"ftoxmpdipwobp4qy.19dmua.top"
},
{
"category":"Network activity",
"comment":"attempted HTTP connections by Cerber from EITest campaign",
"deleted":false,
"disable_correlation":false,
"timestamp":"1481870571",
"to_ids":true,
"type":"hostname",
"uuid":"58538ceb-a834-43a4-aa47-4a9802de0b81",
"value":"ffoqr3ug7m726zou.19dmua.top"
},
{
"category":"Payload delivery",
"comment":"Rig-V Flash exploit seen on 2016-12-15",
