2016-11-28 Locky "Urgent Alert"

2016-11-28 #locky email phisshing campaign "Urgent Alert"

Email sample:
-----------------------------------------------------------------------------------------------------------
From: "Lucille Munoz" <Munoz.Lucille@airtelbroadband.in>
To: [REDACTED]
Subject: Urgent Alert
Date: Mon, 28 Nov 2016 15:09:35 +0530

Dear [REDACTED], we have detected a suspicious money ATM withdrawal from your card.
For your security, we have temporarily blocked the card.
All the details are in the attachment. Please open it when possible.

Attachment: ATM_[REDACTED].zip -> HQ42vm3d.js
-----------------------------------------------------------------------------------------------------------
- sender varies between emails
- subject is "Urgent Alert"
- attached file "ATM_<recipient name>.zip" contains file "HQ<6-10 random lowercase chars and digits>.js", a JScript downloader

Download sites:
http://cadgewigan.net/1l7zisxsqy
http://cadgewigan.net/b6ib4i
http://cadgewigan.net/lcbjuhbkz
http://cadgewigan.net/oakdsrzi9
http://ChinaFireExpo.com/ek0rmfs
http://dodowiz.com/6udquj
http://dodowiz.com/if0buyzso
http://dodowiz.com/ynux4ac
http://firstscog.net/2hd0sxoga
http://firstscog.net/fygmen86lq
http://firstscog.net/gitra3
http://firstscog.net/llag3hkx
http://holzschnitzereibinder.de/lajqgm3
http://huishow.net/oqk0cd08k
http://imagine-hawaii.com/o5jjsbx
http://innogenap.com/epn3r
http://irenta.lt/6bmqpuxc
http://isidore.be/hbxieu
http://itemweb.fr/38r7hzts4i
http://jawar.eu/kysr5c
http://jobgroup.it/078cprm
http://kaozheng.info/9plkidz
http://kiminsitesi.com/lxmub7y
http://kitapportal.com/mqtc8rbu
http://koguciuk.pl/d8usfpameg
http://kuszowka.pl/bumq1
http://kwlbroadcast.com/ok9mnd
http://lecengwang.com/0r5lbas0
http://lejiasheji.com/bqlwk
http://lojaodaconstrucao.com/nrospop86
http://loraycomunicaciones.com.ar/ib5ai
http://lordalexleon.com/a6tqjgygw
http://lv-nexis.com/fy1hxzmxi
http://mainlandfishfarm.com/ms21hvyw
http://mainlinecarriers.co.tz/fs8eet
http://mainsl.es/mqhr0
http://maximumauction.com/2httguh
http://mib.tn/3vn98emgio
http://milliner.ca/lpaeibpto
http://mingxingjx.com/dawbvh
http://misaho.com.ar/pklixzxgib
http://mizhibuluo.com/kpgv0nhtm
http://modepiraten.com/fka7stw
http://momsonlymall.com/mhqqngfd
http://moni.sk/ekbmt3kmg
http://moymir58.ru/ga2qrlipnc
http://m.sxbdf.com/vebwdlh
http://myphychoice.com/8m97wj
http://ruf.com.ar/txmlj
http://sam31.ru/3nrlin9xlc
http://sandiegoblindandshade.com/refzmrf
http://satiliksanat.com/v5nvkwd7
http://sexexpo.ro/q1tdahxd
http://sinklinga.com/grdjik
http://sinklinga.com/ihydkc
http://sinklinga.com/s0iuo7f
http://sinklinga.com/yuhkri
http://statikwerk.de/pqkdqpo
http://stazilivio.it/xtyl9ho5yc
http://stellaar.com/xbxac4
http://stream-renshosting.tk/unlx2
http://taotao500.cn/x73qbgv
http://trinechina.com/weqblvlv
http://TruePublish.de/ps8w8kqy
http://unykmodels.com/vpjuwe
http://wavearni.com/ad0pqg
http://wavearni.com/p0awxfblau
http://wavearni.com/wifloy2heg
http://wavearni.com/zumq01
http://www.iweiboclub.com/jgymxjkydu

Malware:
- encoded on download:
e7e658b067021ea39fb20888d94d18253eb8e0e80c79f3a8a125b1877c959a5f  http___cadgewigan.net_1l7zisxsqy
3d736015c7adf4c33f6c8cb5751373c4d5b0dac180a1ca099f2414e6c9b3cbc0  http___cadgewigan.net_b6ib4i
02a18f0a5752df8d7e79c2ea6cd1562de56ea362364c4e2d5cd3d00465e5ce12  http___cadgewigan.net_lcbjuhbkz
0b123c2086825b272fca0e834179a5e836682c7a704a16b1ab9acc8e8fc043d3  http___cadgewigan.net_oakdsrzi9
dc3e3c621488f9eddf199ff6a93dda9146577b8dd463d92d32af4d07b6d9faea  http___dodowiz.com_6udquj
20da7c1d48ecab12254292b967596be875281463f919737ab49c3c27591bea8a  http___dodowiz.com_if0buyzso
f3b8ddea03fb9f74d7cea59fd5dcaab0acfa4fd7f63c7bc4f5ebb5b677186d89  http___dodowiz.com_ynux4ac
e9c15577dbe0a24df02047659059c53ea3bfa0726d27dc483767641b7cc4ab45  http___firstscog.net_2hd0sxoga
02e6370023a1fccf030c3f44e01fe147488770a527335fd2abbf6e1569d06704  http___firstscog.net_fygmen86lq
c39961cef76d12b37cf4a70431477a33d510541da7b781670de5909b82740493  http___firstscog.net_gitra3
70dd8d00024c9130c8c23c3c10b3ece8b0f79b2f04fe02ff68f55891750e09f8  http___firstscog.net_llag3hkx
2c74ed3ca40293db48e5112ff07dbf5ce43a1c9bf65d0333091c92d8ffbe35f1  http___holzschnitzereibinder.de_lajqgm3
194334156f4e373bd6caf117b330cbdae8f6420398f4373ffaecdc7f988a03d2  http___huishow.net_oqk0cd08k
737bf0d762b3882552668f2ddb056f43d7d6ae238e6050516e7cadb74d580ca1  http___imagine-hawaii.com_o5jjsbx
ca2decf22618d16447e238db665ce0ca513e9d53194d0ea164a57524c828d3a5  http___innogenap.com_epn3r
a2a0cb4a3de47f9c3bf36ab2c13e3ea3fd0f509dff41a4517e28a922a11bab22  http___isidore.be_hbxieu
e3e0e811163ad64dce63a2ddbfdaa06638a27f73ff911604fa4aa637d53b0697  http___itemweb.fr_38r7hzts4i
fdfd62d166f367725d398abd158ba4537379ba09d1b2d3b32f1c31fb99d5d867  http___jawar.eu_kysr5c
d6d6327630f31c8f4383eb17c82355b8fd2e908dcef6512ff071945007ebc4a5  http___jobgroup.it_078cprm [1]
c47d2f6f74978a51fac1ae0264a5ebd8b7266a51a264f987a5abef8b8dd43765  http___kaozheng.info_9plkidz
46c1ca99d3bc5a35c36839190ade2f832c3bb07e9dba50bbf1012d2b6fc7524f  http___kiminsitesi.com_lxmub7y
b09bc26e5e1130c17eadc21de4fddb6a0f641db1eee9855422289b499beff521  http___koguciuk.pl_d8usfpameg
fcb1f40494d6227185b2c31eebcbdc4795a92422526d6c3e4c033faeec943cff  http___kuszowka.pl_bumq1
19cbea5f4ae2d4cbadbacdf921e8c142a2dc8eea85c38035fabd12f9094b3c5e  http___kwlbroadcast.com_ok9mnd
27e5fdd752bce8e30ec313e07c8edc16b95d3afc3e70cbe7c12a961f595755f2  http___lecengwang.com_0r5lbas0 [4]
dd1d4173eddd03de5231310fed285ab552b334011ea0e594797eac15d9c4309a  http___lejiasheji.com_bqlwk
48e65de019ea6ebff06140867471d28617852303b0f3c5e9ce93ce51d4f2fe3a  http___lojaodaconstrucao.com_nrospop86
fa4a8dd40ef2e2600b4eb0e6c4a018304d200ae282046d1506f0782069beecba  http___loraycomunicaciones.com.ar_ib5ai
49dadae71947566f037bdb413b3f7525b1ed70e267a938f4682d68c3e5bd7c15  http___lordalexleon.com_a6tqjgygw
42d0b31e66003149e78ea46f2bb87ab8eba9189b32311464ca41bcfa25d60e4b  http___lv-nexis.com_fy1hxzmxi
17a50c6768fc2213cf4496e245dea3cf47c33300f48834ad4ed5a1232c0ffeae  http___mainlandfishfarm.com_ms21hvyw
593985bf571f43749592c097e9ed8ddba629476301d83a6fd3b84230dfb32ba5  http___mainlinecarriers.co.tz_fs8eet
fb5f3ca2008c5b5f65dd6bc9e6c0aed7b3e610cc975be7efdcc918a717e2b061  http___mainsl.es_mqhr0
10a46166a61d74e120fc6d38939ea1f328d16d20fdaeb36866e492c89091c033  http___maximumauction.com_2httguh
ed5cc9fd91a8529bdcd16e85f1148f6f0a57264be84637eaf023a4b74d59c4ee  http___mib.tn_3vn98emgio
afa8b27728617e0792d913a97cc9540cdb250e2a3d9739ccb89e19543b276687  http___milliner.ca_lpaeibpto
e01aa7b517161082ec25af35d8a61768df7348a38e98df1f24b7b83d17ca4416  http___mingxingjx.com_dawbvh
69afc17d4d36bb735b93f7f0f4d0142685563cb28fe729bdc87b3dbcd576d068  http___misaho.com.ar_pklixzxgib
e47503c9a4d0ec12ca92c322de9ea480a63e027522444ea238d70c3a1dbe09da  http___mizhibuluo.com_kpgv0nhtm
ce4a60864bc5dcff3673d4386de36969eb2845c1c514aadb42e9c6aec8dd62a1  http___momsonlymall.com_mhqqngfd
f0ee7b250984f28fc85c826fbabf3270a3486cee28b79b07fdc740508dd5374d  http___moni.sk_ekbmt3kmg
d1c173e4cc61de5b9d5309f2443edcf73d065ea1bfa51a1dfbbf15e581e8bdbd  http___moymir58.ru_ga2qrlipnc
04a5c2eee4e965a6a646cafcc229c3935f1bb5d863b425812ec5c7d1ca6eda48  http___myphychoice.com_8m97wj
8778821311c11a5b04b8cf81e150178f1b5f6b814f97ff5225d798b392eb0380  http___ruf.com.ar_txmlj
4db8685cbefceaab089cd8c8453eca6fe2c104688a1ddbdfae3df13065404574  http___sandiegoblindandshade.com_refzmrf
440bbe9191e4d513fe8b8c37e2e6f0fde9e491241c2a35cb6b8ffdea425bfaab  http___satiliksanat.com_v5nvkwd7
d58a44635df8077524bc3b337c3702aca3b30b8589092ea5d57be15dc3897078  http___sexexpo.ro_q1tdahxd
16e002e7d94d041c69db6342737fc7d258aea42e30dd5616ab0b9b8f3d113ce0  http___sinklinga.com_grdjik
95b1d191375e36d3118488a1b3c329817068e56b968f111799a245d5ec2677ec  http___sinklinga.com_ihydkc
100049e51a2d73fdfde2ba592c6d31482a58a514d432e2090fa0dd5527ea01b6  http___sinklinga.com_s0iuo7f
b75c4c13ba9d13b7b3fbb517b034173f59e762d574001bf3f81985b324606192  http___sinklinga.com_yuhkri
953e0053f4bcc7ee175be4a8775c45c8c00ba9ec73c226d6222f50d5f2a2c0ea  http___statikwerk.de_pqkdqpo
40fc74e52625e278e706138724fc22cb220fc01cbf6716014c8f83f747554a9e  http___stellaar.com_xbxac4
180fb109cf7b8bff97567e82ee484acfe5a06480d45916fce948742ca4a5532b  http___stream-renshosting.tk_unlx2 [2]
ccf7bed5018fdb779131493e68fe68f028c612c9ff569f7ca1042fd692f4416e  http___trinechina.com_weqblvlv
fce8a2f19e117f24c772bf93bf4d3d634836308f89654a329648625820c19352  http___TruePublish.de_ps8w8kqy
cfa8ee4dd53166ade12696bd54f11e13a5eefc2c6b004c9de02c5ce488e71e3d  http___unykmodels.com_vpjuwe
03ba17ea42afe1d3d703aab3e5a8e95946e8f7b3445f0a2356008218bcc2dfbb  http___wavearni.com_ad0pqg
9e401f9dccb1b0b8337091ca309c4e978912e4c9f4892c5a960c7e0b3ed51682  http___wavearni.com_p0awxfblau [3]
602d6ec82fe84a5f63202a5208be3b8d3331aeb42f6f4c5a6a12e007dbd5069e  http___wavearni.com_wifloy2heg
85a27eec502e5a0f3384eff7286a4056fda0bd2473c24cb4d4b0b8dcdfcb280f  http___wavearni.com_zumq01
90e111b9ba5c3cb43e134027f38c8803161c9f8c86355a7e1b7d378966c6e21c  http___www.iweiboclub.com_jgymxjkydu
- decoded
6447983ed1a28d709c1322e88f42a6824357feabfb1e4a788a53e1cb78a9debf [1]
45d0060c79073680e5404e41c0b32826d43616a6df19ce21aaaf793dd7fb686c [2]
f0b53712738e21470ee16bef546718c9aca0cbd492d55677e30cab07c7ef6699 [3]
55eef02bd845e680ae6a536b9a207e34558bc6f93eeb1e1b2edfd9f43b796e2b [4]
- executed by "rundll32.exe %TEMP%\<filename>.tdl,XXvyHp3iGz5U"

C2:
POST http://185.146.171.180/information.cgi
POST http://213.32.66.16/information.cgi
POST http://91.201.42.83/information.cgi
POST http://aqywxbydjguf.pw/information.cgi
POST http://bmcessbokus.work/information.cgi
POST http://cooqhqljudfgoann.org/information.cgi
POST http://jtkvngdpkvvuw.pl/information.cgi
POST http://kllnmybclxvwyysi.ru/information.cgi
POST http://ledyury.info/information.cgi
POST http://ninqnfurim.pl/information.cgi
POST http://qxtbmraigtiecy.info/information.cgi
POST http://rldtmruliuen.work/information.cgi
POST http://tsushhwhfe.biz/information.cgi
POST http://wboxusonewxvl.info/information.cgi