Locky "Travel expense sheet"

2016-09-01 #locky email phishing campaign "Travel expense sheet"

Email sample:
--------------------------------------------------------------------------------
From: "Melisa Chandler"
To: [REDACTED]
Subject: Travel expense sheet

Dear [REDACTED],

Here is the travel expense sheet for your upcoming company field trip. Please write down the approximate costs in the attachment.



Warm wishes,
Melisa Chandler
--------------------------------------------------------------------------------
Attached file "<randomchars>.zip" contains 2 files "Travel_expense_sheet_[randomhexa].js" and "Travel_expense_sheet_[randomhexa] - 1.js", a JScript downloaders

Download sites:
http://194.28.172.166/~triera/95osasmx
http://209.41.183.242/jf64xt
http://6rota.costav.edusite.ru/vwr48ixt
http://abcbureautique.abc.perso.neuf.fr/u8utmw
http://aivee.koiwazurai.com/d6eop
http://andante-co.jp/uqv75
http://atomtyann.web.fc2.com/ixxvnw
http://bajkowestokrotki.cba.pl/ngwe7tl3
http://bookinghotworld.ws/03zc97f
http://capannoneinliguria.com/fol3um
http://compitrade.ru/v5ihaq00
http://danzig.vtrbandaancha.net/w51kt0h
http://foerschl.gmxhome.de/grvoq
http://golfteam.fr/wpj3lkrc
http://joe9099.byethost7.com/irrlqu
http://josemedina.com/segdoco
http://malwinstall.wang/3qk9n3
http://mambarambaro.ws/3s7d7
http://matsumotokoichi.web.fc2.com/qfwkp
http://michik.web.fc2.com/57h8t6it
http://mixup0813.web.fc2.com/e5858qb
http://namadol.x.fc2.com/bjwmu
http://news.oboyle.ro/lb2w7g4
http://onlybest76.xyz/3sdq0
http://pennylanecupcakes.com.au/n2s6c
http://portadeenrolar.ind.br/rbfr26
http://quinteam.com/~caldea/f0fj1
http://savuchtettu.xyz/4u5s6iy
http://timetobuymlw.in/57h8t6it
http://toukontoutaukaiazalea.web.fc2.com/fjrxden
http://t-schoener.de/kslq1vx
http://unimet.tmhandel.com/s4qiyk1x
http://vicariassicurazioni.it/w4n0lvk
http://vimp.hi2.ro/ttuwgf
http://virmalw.name/95osasmx
http://www.aktion-zukunft-gestalten.info/hfgo3x
http://www.alpstaxi.co.jp/tm7zp
http://www.automac.it/udg6z3q
http://www.beniculturali.org/afx399
http://www.carloabati.com/yrho8jo
http://www.cortesidesign.com/v1vmxyj
http://www.dietmar-bernhard.de/lbnd61
http://www.empolio.com/ud5iqwcb
http://www.erretisnc.it/r7ok8msi
http://www.gsprzemkow.neostrada.pl/j1f692s
http://www.john.edmunds.talktalk.net/in9x7
http://www.kgv-seelrode.de/rm9ax
http://www.ladymusic.it/wqsbvd3y
http://www.malicioso.net/vzpi2sbd
http://www.meallservice.it/xxudl5
http://www.plumbntile.talktalk.net/aap94p8
http://www.porchettadicolledara.com/brqtvtar
http://www.saumi.jazztel.es/v0p2o92f
http://www.trauchgauer-weihnachtsmarkt.de/nslun7x
http://www.vanhoenacker.net/ygz0f9
http://yggithuq.utawebhost.at/it03z1pc

Malware encoded on download, filesize 160260 bytes
6107fa2232944581ccd79cbdd9226e662e3f71a4422f782e3747d1faf23e348e  http___194.28.172.166_~triera_95osasmx
b05c14fda717d6c67e701a9307e88f35ca7744e09ac2a7a200af35d6d35990f8  http___209.41.183.242_jf64xt
a26708ea70b7bc08bc7a4fb9da074e852f6831432ef5677ffa94ecce27d1f5cd  http___6rota.costav.edusite.ru_vwr48ixt
0fd8a5c8f2681dbdab0e2f8fa39a72efee3c5ce102165967b3cb82188ba5cd1e  http___abcbureautique.abc.perso.neuf.fr_u8utmw
eba5e2a30579cf56fd352fd74d7a5410a87a9ee67faf36272ff5b86a48c1e4d8  http___aivee.koiwazurai.com_d6eop
229762d1a23a3da604c28250c57c948c078b08fda3f1538d689ec4d2ab27aeea  http___andante-co.jp_uqv75
206ecbd29318c954e7b7419e23e6da8f0c50b4fe0583945a5535666c69a7ef19  http___bajkowestokrotki.cba.pl_ngwe7tl3
a8c69ef42811df55c56e5f51d0949e73a484b4ecff05f73d276a47741a615865  http___bookinghotworld.ws_03zc97f
08865c247d0aee0b0a091013c2973b219939b2354b4acc9d4613d0554b321423  http___capannoneinliguria.com_fol3um
8fb5da035c3471e8c12f72fe3f80ab15b9f590ee092dcf97b1dbc84ff16a6367  http___compitrade.ru_v5ihaq00
a3ce44a4a33d52d61f4571f65d8791da368d1b22534cbf847c137c1994d468d7  http___danzig.vtrbandaancha.net_w51kt0h
2b20f66b124277d0ef0ededcbae6d24b9584858f2eb8fa13dd035229902df9cc  http___foerschl.gmxhome.de_grvoq
aef2ba87636e3a05fefdd580e8852b0010bdeadc46c4c8a7c1169f25ca550f4a  http___joe9099.byethost7.com_irrlqu
dd820d19dc4601bc18a03ee58aaad80a7d9fa8ec53d45fa82fb3b89ea8d1a97a  http___josemedina.com_segdoco
4dab4f963e5ffd39dd73f9464ebf469585f93c8423eaf2d7245b018292e59214  http___malwinstall.wang_3qk9n3
ae604d1499c72cca4bb5d9a64a659e560044f5919945f794a7044d748a5ca0f8  http___mambarambaro.ws_3s7d7
6cc4afd03b288ac719d520288218fa470f9c60ca1391a392e0aac92193732c28  http___matsumotokoichi.web.fc2.com_qfwkp
bf7b182effee19d4dee03c55598e4d8621b2e48af50ec7ec73669cb8ed32d579  http___michik.web.fc2.com_57h8t6it
5fc5e390759fe0bf8f45d3d56400bb8120fa78bd8df77cb95e463c461a2b9342  http___mixup0813.web.fc2.com_e5858qb
8b2471750b2d0eaa8752460876236f56b02efbb44904970fbe2cc6dda0a7f290  http___namadol.x.fc2.com_bjwmu
8b96dd2345e90ae516bca781aac6d736a53c7b5c6b9a56f2c03f67ee3d25ff41  http___news.oboyle.ro_lb2w7g4
98ba6318efd03ac8df26e78f39379cac87a5f945c67ba3d3032f01b4efd8abf6  http___pennylanecupcakes.com.au_n2s6c
458778b8249487bdd3137a21193019abe160726210b79c38f482a967281b4350  http___portadeenrolar.ind.br_rbfr26
32ed8e24b695468ed0b513a892798400f74a9d54d5a30985e946e00d83d3e2c3  http___quinteam.com_~caldea_f0fj1
bf7b182effee19d4dee03c55598e4d8621b2e48af50ec7ec73669cb8ed32d579  http___timetobuymlw.in_57h8t6it
3ced1d62f60cab0faf6ae551c394bb6a2bb8b571f40687fbfb602cf632bdf810  http___toukontoutaukaiazalea.web.fc2.com_fjrxden
891a2185786a2a7377d0fc4d4f04164c38959ad9e3b7f35595e8014120b0d5c6  http___t-schoener.de_kslq1vx
e93754ddac4679baa4b75045b4fd6d53c865003b510ff20756c4bca33565fc6d  http___unimet.tmhandel.com_s4qiyk1x
9617a0efd51d3f41ab7d1a057d55e7b8d02105350ca034966c91bddebfd35cf8  http___vicariassicurazioni.it_w4n0lvk
138679685350a317b8a12367f088c88109af7180829a63b3f3e4e659d2ad9163  http___vimp.hi2.ro_ttuwgf
3b673eb44e562c98b4707bebf1bb757cc34292c73c87cc74b1afe7331a96b9dc  http___www.aktion-zukunft-gestalten.info_hfgo3x
bcc23aa1f8e51b0a70dbda904a90f7ba0a666162bad8fab695214dd1ee623856  http___www.alpstaxi.co.jp_tm7zp
44aa33941627b7d703a7fc184eb2aae2250194396acd1198d3ab0761c32a0c1d  http___www.automac.it_udg6z3q
a8f200d4e2b35c4598f4d374b9c3e32be6e7b4da5f0f2223ee70c801c703f040  http___www.beniculturali.org_afx399
8b70d89393b18ba3392960c5226eb85a7d8d277558db340dc2297a9848a5b887  http___www.carloabati.com_yrho8jo
20dea991393f1ba1848c2668149fef00a6077230e23aff724e5ffbab307cac88  http___www.cortesidesign.com_v1vmxyj
b369654b53d5afefa3868cff3d71879b2e4751e2ca1d80ad079a1db3dd795925  http___www.dietmar-bernhard.de_lbnd61
38401c5982aad091a4980c63411cc105c3e0113af694e3aaf8ab835517735451  http___www.empolio.com_ud5iqwcb
71f29bc113e51e47f4ecb22ac2543abefe537624ca8fd66e195d8c46bf2ae748  http___www.erretisnc.it_r7ok8msi
bb3c4ca1789a73431d26c9c0960bbd1700cd3ba3a2a4bbab03c1d308c54251e0  http___www.gsprzemkow.neostrada.pl_j1f692s
d01c42f86ec4a17baaab80be906646044bf2c1dc67d440ad6a8b6f4482c9078a  http___www.john.edmunds.talktalk.net_in9x7
75d900bda307bf82a183c0d55947ec082f6852c4003f04b88fc5f74e4ace406f  http___www.ladymusic.it_wqsbvd3y
6af7783a4043846261bcbcaf12fa3166c3253720ac6ccd302d2396ccf74071de  http___www.malicioso.net_vzpi2sbd
29c29578aa46e7dfc91bb8511a1182600cdb6e229ce9494ef62cfd0f11fbcf3a  http___www.meallservice.it_xxudl5
14e47774f45e29304d5a34365f00ad46d3926907cf32c6155aa55797bb6b5b1e  http___www.plumbntile.talktalk.net_aap94p8
0cd40f88209542625c33af6514f42687bce85a00ca2d930752ecab927f161b70  http___www.porchettadicolledara.com_brqtvtar
240be8907d33565515d6e42cf9d153ef8d5828d9e8da274f84e821c23ac6cfcb  http___www.saumi.jazztel.es_v0p2o92f
9f19c50d940751aea744a4ec4d87e4b4d8aa3a442041c0058cecbbf8ddaf67e4  http___www.trauchgauer-weihnachtsmarkt.de_nslun7x
de20301e5f0f889ae23168af057222185ce88f5633df5565c31f89408cb9dc99  http___www.vanhoenacker.net_ygz0f9
eaea7843487d5f8dbdff7ecf82e72eb9c20fd159fea03c63035c5b6c63f4b284  http___yggithuq.utawebhost.at_it03z1pc

https://www.reverse.it/sample/5bf5957ad2627874fdd3951db56374c33397c809d02f3e7a71a4bcd33866683d?environmentId=100
https://www.reverse.it/sample/8f5de7c92febc16978dbfa61a933169226d033eb8779010b98f90b05e1471a41?environmentId=100
https://www.reverse.it/sample/ebb9e624cade1886c31eb7a4c32d7682b9ed99856a24fab6bcdebac163530170?environmentId=100
https://www.reverse.it/sample/513b843365909c1b5a979b60c0d2c4180e3cd73ef17712a897aad342ea57b6c6?environmentId=100
https://www.reverse.it/sample/f1ff2ad3bcc44da10dac524cecfda5aa529bad10dcac48329910d564eb25d3cf?environmentId=100

C2:
212.109.192.235:80/data/info.php
(xattllfuayehhmpnx.pw) 91.223.180.66:80/data/info.php