Let’s Learn: Dissect Rig Exploit Kit Anti-Bot Filter Gate

Background:

• While analyzing the latest malvertising campaign leading to the Rig Exploit Kit (EK), I observed an interesting anti-bot gate filter script that is used by the Rig EK to filter out bot requests and/or ensure browsers and their objects are genuine. Otherwise, the script would not redirect to the eventual Rig landing page. It appears the Rig EK operator implemented it to filter out automated bot crawlers and bad browsers in order to provide better traffic quality for malicious installs.

Indicators of Compromise:

Summary:

• The malvertising campaign leads to Seamless gate hosted at the Punycode represented domain with the prefix xn--. The gate iframe script redirects to the seemingly new Rig anti-bot filter gate that eventually leads to the landing page serving its usual Flash exploit CVE-2015-8651 that drops Ramnit banking malware on the vulnerable machines.

II. Essentially, the script parses the visitor for the following browsers and versions:

III. Then, the script checks if the visit comes from a mobile device as follows:

IV. Notably, the Rig anti-bot gate also performs the so-called browser quality check essentially verifying by running browser-specific value checks and filtering mobile agents. Finally, the script runs checks to verify the aforementioned browser object ‘browser_real‘ matches ‘browser_quality.’
The script checks for the following browser objects:

The relevant script is as follows:

V. If the browser object is_bot is not to “true,” the script reaches out to the usual RIG Exploit Kit landing pages that ultimately serves Ramnit banking malware via the Flash SWF CVE-2015-8651 exploit; otherwise, the script runs document.write() and dies.

p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 8.5px Helvetica} p.p2 {margin: 0.0px 0.0px 0.0px 0.0px; font: 8.5px Helvetica; min-height: 11.0px}
p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 8.5px Helvetica} p.p2 {margin: 0.0px 0.0px 0.0px 0.0px; font: 8.5px Helvetica; min-height: 11.0px}