Catching ransomware is pretty easy these days. I setup a procmail filter that will extract all e-mails with compressed JavaScript attachments. Whatever is left in the morning after AV decimated the folder I will usually take a quick look at.
Today, I got a bunch of e-mails with the subject office equipment" />
This time, the malware doesnt even try to hide. One of the hostnames used by this run is brothermalw.ws. In addition, the samples all use the exact same user agent string, which doesn .NET CLR 3.5.30729)
So pretty easy to now pull out the URLs that the malware connect to from bro:
zcat http* | bro-cut method host uri user_agent | grep .NET CLR 3.5.30729) | awk {print $1 , $2 , $3} | sort -u
GET 210.240.104.2 /upp0nqa
GET brothermalw.ws /06qbbzy7 -)
POST 51.254.55.171 /data/info.php
GET baer-afc2.homepage.t-online.de /4yhgvna
GET realm-of-rage.heimat.eu /ut1s5
GET rejoincomp2.in /1tdqo6
GET www.dsalchi.org /uk0lo
GET www.galleriacolonna.org /yhcx6y
POST 138.201.191.196 /data/info.php
POST 188.127.249.203 /data/info.php
POST 51.254.55.171 /data/info.php
POST nkyhrjiaeqcmtqth.pw /data/info.php
As so often, /data/info.php may actually also do a pretty good job in detecting these infections. Snort already alerts on the requests to .pw hosts.
Indicators of compromise: The IPs and the host names appear to be too ephemeral to be useful as IoCs. I would suggest the /data/info.php URL. I dont see that used a lot in non-malicious requests.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.