Wednesday, October 2, 2013

Sweet Orange - Update

This content has moved to

After 48h of monitoring the Sweet Orange EK noted in our previous post some of the indicators have changed. Now that we know what changes and what doesn't we can refactor our previous indicators and make them more robust.

We now know the refresh rate for the domain generation and url parameter changes. The EK changes url parameters every minute while the domain is changed ever 6 minutes.

What Has Changed

The strings used to obfuscate the applet parameters have been changed and the applet has been recompiled to adapt the decryption/de-obfuscation algorithm.


The port that the malware host is using has changed so the URL regex indicators need to change.


The IP address is now fluctuating within the same (AS12695) the IPs seen include

What Has Stayed The Same

The exploits and the general frame of the exploit landing page have stayed the same.

No-ip dynamic DNS is still being used with the domain "".

The binary exploit remains the same, it has been repacked but I wrote a terrible python script that is able to identify it based on a unique pattern of strings in the binary.

You can download the bin checker script here.

Once I get some free time I'll post about the second Java exploit and reverse the payload.

No comments:

Post a Comment