Locky "8t76v45"

2016-08-05 #locky email phishing campaign "8t76v45" / "Emailing: ...."

Email sample (sender is random name from recepient's own domain, differ from email to mail):
--------------------------------------------------------------------------------------------
From: "Shauna" <Shauna9@[REDACTED]>
To: [REDACTED]
Subject: Emailing: IMG(58).JPEG

[No email body]
--------------------------------------------------------------------------------------------
Attachment "IMG(58).JPEG.zip" (corresponds to email Subject), contains "19302707007_93664.wsf" containing a JScript downloader

Download sites:
http://alpestradition.com/8t76v45
http://atleco.ru/8t76v45
http://chanen1.com/8t76v45
http://chicharito14.c0.pl/8t76v45
http://commentaborderunefille.fr/8t76v45
http://drenkelford.net/8t76v45
http://esting.es/8t76v45
http://heidechopper.de/8t76v45
http://ishinomakicatering.web.fc2.com/8t76v45
http://kenspensuk.co.uk/8t76v45
http://listanegra.xxxxxxxx.jp/8t76v45
http://nakip.com.ua/8t76v45
http://naturopathiesante.fr/8t76v45
http://nickvero.3x.ro/8t76v45
http://osarunoyakata.web.fc2.com/8t76v45
http://peloteros1.50webs.com/8t76v45
http://portalcerrado.com.br/8t76v45
http://rbrandi.interfree.it/8t76v45
http://seagullob.web.fc2.com/8t76v45
http://spkoszewo.strefa.pl/8t76v45
http://tiefthalerhof.it/8t76v45
http://www.dedycker.be/8t76v45
http://www.filix.it/8t76v45
http://www.hotellaconchiglialmd.com/8t76v45
http://www.isolatelematica.org/8t76v45
http://www.leonardopivi.it/8t76v45
http://www.netsyscom.it/8t76v45
http://www.pharaonenshop.de/8t76v45
http://www.robertogori.it/8t76v45

Added:
http://edetoate.home.ro/8t76v45
http://www.robertogori.it/8t76v4

encrypted malware filesize 279552 bytes, d4ced686252e30ece55f0d5d676ddee30bf31742130ba594633ee71b9ac4de29
decrypted malware cba9d74b6a959a685279636b86dae7214f7b0822bbe7ef35bfe2475f08695f8a

https://www.reverse.it/sample/165e6cf5a8bb569362a7334d4a53a71f054ccdd76580bad6c8dab15c26968b88?environmentId=100
https://www.reverse.it/sample/3851ecf00efa1940db597d1a2d18d1093fc009f76c2f79329fc82f1217c862ee?environmentId=100
https://www.reverse.it/sample/ac35dc7dfe8c23b451c7132446e4a7f1c78a58e2d539ff19aaac2b4fb7fcfbfc?environmentId=100

C2:
185.129.148.19:80/php/upload.php

Full URLs (the parameters do not have influence on the downloads)
http://alpestradition.com/8t76v45?FNAhFXy=WoKysR
http://alpestradition.com/8t76v45?koNkXlB=FpykYARkd
http://alpestradition.com/8t76v45?QMOtErjmxaU=tYXtUpGueVI
http://alpestradition.com/8t76v45?vKPUBSmroGP=mCDYowUkre
http://alpestradition.com/8t76v45?yeJodhJEc=QuteTnLqO
http://atleco.ru/8t76v45?cqpsochq=sgfyRyCMY
http://atleco.ru/8t76v45?DAoKWttXVzA=kfeAnLiCdpG
http://atleco.ru/8t76v45?KPNzwpvxl=fcKOLheT
http://atleco.ru/8t76v45?meWCIsgIryG=mEOkPmksSUb
http://atleco.ru/8t76v45?oFfjkX=dQreoGMLjS
http://atleco.ru/8t76v45?PqcLtPsIL=lykxft
http://chanen1.com/8t76v45?ElxnNRgJmx=dzomdqzHzi
http://chanen1.com/8t76v45?RJXTuIdt=RWaovC
http://chicharito14.c0.pl/8t76v45?ahpAAK=UdVRduUlz
http://chicharito14.c0.pl/8t76v45?akGOlqfkW=yvIxfXuWuSL
http://chicharito14.c0.pl/8t76v45?dmHlujtoII=SmSBNQkGt
http://commentaborderunefille.fr/8t76v45?BfKSfbxP=GxzOdS
http://drenkelford.net/8t76v45?BLYPCimQ=fdFwEiynv
http://drenkelford.net/8t76v45?foQgXfl=HrEkMiN
http://drenkelford.net/8t76v45?RvriRUceI=arCkVlWHw
http://drenkelford.net/8t76v45?viIQFkOy=AHrNoIB
http://drenkelford.net/8t76v45?YfIDApDz=CiUAlzWIB
http://esting.es/8t76v45?txDxxTIT=QoKXQY
http://esting.es/8t76v45?XJmFjAWUt=TswkXwC
http://heidechopper.de/8t76v45?cBUXABEiAc=dDfGgBnlwYb
http://heidechopper.de/8t76v45?ejAhviBsC=gsNWBT
http://heidechopper.de/8t76v45?ejwmYpX=LUFCxOuuax
http://heidechopper.de/8t76v45?jqIYhq=BhIRpJo
http://heidechopper.de/8t76v45?RdlxnmQu=kHiQWaw
http://ishinomakicatering.web.fc2.com/8t76v45?XPmAWk=OoPhiMHLE
http://ishinomakicatering.web.fc2.com/8t76v45?ylcGaoQh=bSczeWSb
http://kenspensuk.co.uk/8t76v45?BRPNUNTMPB=qOfFIeAssB
http://kenspensuk.co.uk/8t76v45?MwoyGcmS=jLJHdpLAp
http://kenspensuk.co.uk/8t76v45?ynGFCRBXFTY=eGSLEHA
http://kenspensuk.co.uk/8t76v45?zyPDGtMqLQn=SoYMUHPp
http://listanegra.xxxxxxxx.jp/8t76v45?cNimssIr=DUcbuyUQVRA
http://listanegra.xxxxxxxx.jp/8t76v45?JvQndIuP=QFtYKVdmez
http://listanegra.xxxxxxxx.jp/8t76v45?LsPPlkW=bkWHdlH
http://listanegra.xxxxxxxx.jp/8t76v45?MaywSPBn=dIgAvn
http://listanegra.xxxxxxxx.jp/8t76v45?uhnGbAypTCY=gvjhbCvzMa
http://listanegra.xxxxxxxx.jp/8t76v45?XWoGBe=jLsjzxE
http://nakip.com.ua/8t76v45?aJLYHAo=GALndXReR
http://nakip.com.ua/8t76v45?GxxGIXz=jaXWziWC
http://nakip.com.ua/8t76v45?mgmmhIK=ojFwQwuM
http://nakip.com.ua/8t76v45?OIKbMomCAJq=UTleKwqtEd
http://nakip.com.ua/8t76v45?YYqQgzneLdP=sikWIpHRRA
http://naturopathiesante.fr/8t76v45?fMSXsb=TsRugyVSwdA
http://naturopathiesante.fr/8t76v45?WbctMr=UsHxRDdms
http://nickvero.3x.ro/8t76v45?mVCqGmYz=waOCVXXIo
http://nickvero.3x.ro/8t76v45?nyRAHHv=LxYsBeolCp
http://nickvero.3x.ro/8t76v45?RaPlwqO=MiIzPtdSI
http://nickvero.3x.ro/8t76v45?uJzplXQO=eIUsveMGolK
http://nickvero.3x.ro/8t76v45?WKODrhmh=MXJfwhkpoO
http://nickvero.3x.ro/8t76v45?YljboDXMooK=McwhHEEhLwn
http://osarunoyakata.web.fc2.com/8t76v45?JTmRgdie=mCjodRNSsbX
http://osarunoyakata.web.fc2.com/8t76v45?qwKJGUsmfu=mKbwzGIV
http://osarunoyakata.web.fc2.com/8t76v45?zGGAuYzmSSp=nEUWnBmAUpw
http://peloteros1.50webs.com/8t76v45?bThyYkypV=LvxkcmwGoF
http://peloteros1.50webs.com/8t76v45?pQwjyoJiW=iRVzAzIIdXK
http://peloteros1.50webs.com/8t76v45?rLiWJgBm=rsVpRbiQ
http://portalcerrado.com.br/8t76v45?argdOKL=ewOoeUf
http://rbrandi.interfree.it/8t76v45?fOqoobnbqcv=UfPmSLHfb
http://rbrandi.interfree.it/8t76v45?GLItzDJeB=uWzArysxn
http://rbrandi.interfree.it/8t76v45?hlCPMHyV=NJmswzANV
http://seagullob.web.fc2.com/8t76v45?igxOuarvm=xTwqezih
http://seagullob.web.fc2.com/8t76v45?OtBBGLewoGL=ghTbKvQnNy
http://spkoszewo.strefa.pl/8t76v45?BSBNecQIK=NaHcTWt
http://spkoszewo.strefa.pl/8t76v45?CHzxorfEAzJ=pHpEoPEEi
http://spkoszewo.strefa.pl/8t76v45?KFAKNbzIV=oStdlUc
http://spkoszewo.strefa.pl/8t76v45?OaCQMHMf=nSUzfGqBhe
http://tiefthalerhof.it/8t76v45?ipTCFF=GsBXFJB
http://tiefthalerhof.it/8t76v45?PhXSpWs=HWdLOcrHx
http://tiefthalerhof.it/8t76v45?QDCXecNu=HRRLDMIVA
http://tiefthalerhof.it/8t76v45?rvzubBW=nEarlpx
http://www.dedycker.be/8t76v45?jMqxjKxU=XwfsGfdQaUm
http://www.dedycker.be/8t76v45?SCJWnF=mrOXIfBjX
http://www.dedycker.be/8t76v45?wBIEBCFW=rzbKyBEU
http://www.filix.it/8t76v45?gGvHRcxmY=BWMzTuDo
http://www.hotellaconchiglialmd.com/8t76v45?imjHVPUCWu=ieTqtWk
http://www.hotellaconchiglialmd.com/8t76v45?qNfVYMpGRO=iboimtbQBq
http://www.hotellaconchiglialmd.com/8t76v45?zFIJbGLq=vgmKBYdJsg
http://www.isolatelematica.org/8t76v45?DtjCtiKjcg=mLnhsj
http://www.isolatelematica.org/8t76v45?lUOensER=eGXXSLJ
http://www.isolatelematica.org/8t76v45?rhHaFieOezu=PaPuFjhdFPU
http://www.isolatelematica.org/8t76v45?UjuPnRFE=VyqouIgtEqG
http://www.leonardopivi.it/8t76v45?bHkNox=KjdFgP
http://www.leonardopivi.it/8t76v45?MQCKmoyenI=VIwrkBuPo
http://www.leonardopivi.it/8t76v45?qacLjmc=FHlANEnFvv
http://www.leonardopivi.it/8t76v45?tzmLEVY=laqghuQPkKu
http://www.leonardopivi.it/8t76v45?xGvGjdwJEmF=BIsHFoGx
http://www.netsyscom.it/8t76v45?dBjMaV=luskYAfTt
http://www.netsyscom.it/8t76v45?JAmyHyzcdIL=EBbWTNPNSYt
http://www.netsyscom.it/8t76v45?jRXtHaTgD=RTbtEC
http://www.netsyscom.it/8t76v45?qnoMnt=LbvDhBro
http://www.pharaonenshop.de/8t76v45?eQOSxLsK=ghXlFIss
http://www.pharaonenshop.de/8t76v45?IkfnMxs=vOtqhKkGWCg
http://www.pharaonenshop.de/8t76v45?LncFcBzuPh=iRcrGnqMGYa
http://www.pharaonenshop.de/8t76v45?sENyLzY=OoKazvnf
http://www.robertogori.it/8t76v45?hhlManY=XIkFROgj