MalwareUsed by 1 actorExploits 2 CVEs

Angler EK

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2015-0311Adobe Flash Player remote code execution vulnerability (CVE-2015-0311)Exploited in the wild

Conclusion : xxx is what we call Angler EK and Angler EK (indexm instance) is not that young! | This indexm.html variant of Angler EK is most probably still being used in RU/UA and was one of the early adopter of CVE-2015-0311 (a flash 0day from January) before many "standard" instances of Angler.

via malware dontneedcoffeemalware.dontneedcoffee.com

CVE-2015-2551Type Confusion in Microsoft Internet Explorer JScript9Exploited in the wild

Conclusion : xxx is what we call Angler EK and Angler EK (indexm instance) is not that young! | 2015-01-27 - Angler EK "indexm" exploiting CVE-2015-2551 and firing Java exploits [Payload here is most probably Lurk]

via malware dontneedcoffeemalware.dontneedcoffee.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Reveton Team

Conclusion : xxx is what we call Angler EK and Angler EK (indexm instance) is not that young!

via malware dontneedcoffeemalware.dontneedcoffee.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583.008MalvertisingEvidence1

One of the reasons that malvertising is appealing to threat actors is that the ad agency / network itself performs a significant portion of the targeting, including geo, browser and other options.

T1584.001DomainsEvidence1

Domain shadowing is a technique for generating malicious subdomains from a legitimate domain, typically using stolen registration credentials for the domain owner.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

XXX is Angler EK ... Angler EK / XXX IE sploit only ... Here is one used against Ukrainian that i captured in August 2013

T1190Exploit Public-Facing ApplicationEvidence1

Check the system using two information disclosure bugs in Microsoft Internet Explorer to avoid researchers, sandboxes and some security products.

Execution

1 technique

T1203Exploitation for Client ExecutionEvidence2

Land the browser on Angler EK without a referrer.

Stealth

2 techniques

T1497.001System ChecksEvidence1

The decoded JavaScript function leverages two information disclosure bugs in Internet Explorer in order to filtering potential victims.

T1620Reflective Code LoadingEvidence2

All replay attempts of this threat revealed fileless Angler EK [4] [5] threads loading Bedep in memory.

Discovery

2 techniques

T1083File and Directory DiscoveryEvidence1

A MimeType check in order to filter certain shellex associations, including .py, .pcap and .saz.

T1497.001System ChecksEvidence1

The decoded JavaScript function leverages two information disclosure bugs in Internet Explorer in order to filtering potential victims.

Command and Control

1 technique

T1102.003One-Way CommunicationEvidence1

Abuse an HTTPS open redirect by DoubleClick. [2] Land the browser on Angler EK without a referrer.

INDICATORS OF COMPROMISE

IOCs tracked for this family

13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

12 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app11 years ago

ip.v4●●●●●●●●●●●●View more in app11 years ago

domain●●●●●●●●●●●●View more in app11 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

malware dontneedcoffeeNews

Mar 16, 2012

XXX is Angler EK

An exploit kit discussed as having early fileless capabilities, multiple documented instances including an 'indexm' variant, and use of browser and Flash/Java exploits to deliver payloads.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching13

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actorExploits 2 CVEs

Angler EK

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2015-0311Adobe Flash Player remote code execution vulnerability (CVE-2015-0311)Exploited in the wild

via malware dontneedcoffeemalware.dontneedcoffee.com

CVE-2015-2551Type Confusion in Microsoft Internet Explorer JScript9Exploited in the wild

via malware dontneedcoffeemalware.dontneedcoffee.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Reveton Team

Conclusion : xxx is what we call Angler EK and Angler EK (indexm instance) is not that young!

via malware dontneedcoffeemalware.dontneedcoffee.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583.008MalvertisingEvidence1

One of the reasons that malvertising is appealing to threat actors is that the ad agency / network itself performs a significant portion of the targeting, including geo, browser and other options.

T1584.001DomainsEvidence1

Domain shadowing is a technique for generating malicious subdomains from a legitimate domain, typically using stolen registration credentials for the domain owner.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

XXX is Angler EK ... Angler EK / XXX IE sploit only ... Here is one used against Ukrainian that i captured in August 2013

T1190Exploit Public-Facing ApplicationEvidence1

Check the system using two information disclosure bugs in Microsoft Internet Explorer to avoid researchers, sandboxes and some security products.

Execution

1 technique

T1203Exploitation for Client ExecutionEvidence2

Land the browser on Angler EK without a referrer.

Stealth

2 techniques

T1497.001System ChecksEvidence1

The decoded JavaScript function leverages two information disclosure bugs in Internet Explorer in order to filtering potential victims.

T1620Reflective Code LoadingEvidence2

All replay attempts of this threat revealed fileless Angler EK [4] [5] threads loading Bedep in memory.

Discovery

2 techniques

T1083File and Directory DiscoveryEvidence1

A MimeType check in order to filter certain shellex associations, including .py, .pcap and .saz.

T1497.001System ChecksEvidence1

The decoded JavaScript function leverages two information disclosure bugs in Internet Explorer in order to filtering potential victims.

Command and Control

1 technique

T1102.003One-Way CommunicationEvidence1

Abuse an HTTPS open redirect by DoubleClick. [2] Land the browser on Angler EK without a referrer.

INDICATORS OF COMPROMISE

IOCs tracked for this family

13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

12 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app11 years ago

ip.v4●●●●●●●●●●●●View more in app11 years ago

domain●●●●●●●●●●●●View more in app11 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

malware dontneedcoffeeNews

Mar 16, 2012

XXX is Angler EK

An exploit kit discussed as having early fileless capabilities, multiple documented instances including an 'indexm' variant, and use of browser and Flash/Java exploits to deliver payloads.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching13

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.