Steady Evolution of Fallout v4

This report analyzes Fallout Exploit Kit v4, documenting its upgraded delivery chain using Diffie-Hellman key exchange, layered AES encryption, browser/Flash checks, and anti-analysis (VM and process) detections to deliver exploits for CVE-2018-8174 and CVE-2018-15982. The chain ultimately launches obfuscated PowerShell that fetches and executes a payload (observed delivering Raccoon Stealer) from beahero4u.com, with examples drawn from a PopAds → KeitaroTDS → Fallout campaign. The report provides technical details of the traffic, cryptography, shellcode behavior, and select IOCs (e.g., download URL and user agent) to aid detection and hunting.