2016-12-16 Locky "Subscription Details"

2016-12-16: #locky email phishing campaign "Subscription Details"

Email sample:
-------------------------------------------------------------------------------------------------------------------
From: "Jannie Mclean" <Mclean.Jannie@emailland.worldonline.co.uk>
To: [REDACTED]
Subject: Subscription Details
Date: Fri, 16 Dec 2016 18:11:51 +0700

Dear [REDACTED], thank for you for subscribing to our service!
All payment and ID details are in the attachment.

Attachment: user5532298.zip -> ~_0BN7RGB_~.js
-------------------------------------------------------------------------------------------------------------------
- sender varies between emails
- subject is "Subscription Details"
- attached file "user<7 digits>.zip" contains file "~_<5-7 uppercase chars and digits>_~.js", a JScript downloader

Download sites:
http://2picme.com/jxiatuol
http://aacom.pl/rgk4aoc
http://agyemang.com/9drunmpi
http://analypia.com/21cm54hm
http://banhang123.com/kscg7
http://brighttrading.net/a7uszjh3o
http://brookstonemanuals.com/ycabkjgdv
http://calderon.com.mx/qwpnqxwkl
http://dcareug.com/3ts0v
http://easylation.com/wekocn6kmg
http://ecnffa.za.pl/yslx59h
http://facerecognition.com.ba/fjem4
http://fiddlefire.net/hvkoxidq
http://gallery.mohammadtarighi.ir/gdiclpgq
http://gunungsari.co.id/9ssqssvnw
http://image.ddianle.com/g56bmsie3h
http://inside.dljtjt.com/0gufg
http://inzt.net/rba6g3nnxq
http://ivibohoc.url.ph/xqkoziuxvk
http://kathymerrill.com/hqnfsc
http://kh2.co.uk/5sibczx4gx
http://kirulya.com/scfv1ofdh
http://kserwis.pl/lozyg
http://ktlelektro.cz/1jenzg25wy
http://kurou.bokunenjin.com/undi59e
http://medianisprint.com/woarfryxsw
http://minis2.com/yrjwmun8
http://mprotectcorp.com/opudc
http://msveletiny.cz/ftcvd
http://pcflame.com.au/ngihv
http://perspektive-fuer-kinder.de/1e1dip
http://promgazenergo34.ru/onlj99szd
http://rdsc-seminar.com/jlb4fdxt
http://rondurkin.com/c6w5pscmc
http://s393640255.onlinehome.us/ygls8gycs
http://seaf.ch/s7lyen4j
http://shomesofa.com/jnobn54
http://stoneofliberty.com/fvjhcy
http://taladm.ru/myqqrzzndi
http://v-english.com/gfnb3r
http://vivvn.com/rafd5un
http://webfutures.net/cuxdyilq
http://weegee.fr/2d3xb74cif
http://www.dazzle-events.be/qal8lxme
http://www.enhansit.com/z2lgjv
http://www.lauraleedonnelly.com/qjiwhmrx
http://www.mywoc.ca/p29t8
http://www.ninthdistrict.org/wkvmds
http://www.servipisos.com.ar/sn2ugvyws
http://www.sitivisibili.it/jckudg0
http://www.stavros.ca/4woi2zlse
http://www.stavros.ca/c1ehjm
http://www.thepasobueno.com/usrcgntw
http://www.tourist-car.ru/v0uiwotu
http://www.zscio.com/uutfjime
http://xiaojinsong.com/0igjg
http://yellowstudio.pl/u7ky2cyi

Malware:
- encoded on download
38bb8b18491c56b7f1273abd07898c91466506043bbc218d174121a4503cdd8f  http___2picme.com_jxiatuol
c46833c1da432a21198e6ad39b570457a7bb1c5855bfd5867ff324dd609a9fc9  http___agyemang.com_9drunmpi
3f106de384b8c5c335169162fbb6964967c682b32b611f2626748ed04111ddf8  http___analypia.com_21cm54hm
6381dd3ee58c3fe718edb8daf372bb8f78a81bd6eead864f75a32f4055c2b508  http___banhang123.com_kscg7
70f77228a85a3b99320663ed5da81e8eeec875b5e7c1a81abcdbdf127f061a4e  http___brookstonemanuals.com_ycabkjgdv
563fd681f256b89937cbba86011768cba316aa53cf25e4465d6d6dd32fc5faa9  http___calderon.com.mx_qwpnqxwkl
52f8d69b3c6663e33d48fe28715a006a5a85616bca7223bd9a8fd6672a0d1afb  http___easylation.com_wekocn6kmg
c79463ed7bb3dd3454cd0882b5ce874bbfc3cca4bc649d64a5a288169dac36c8  http___facerecognition.com.ba_fjem4
051d9c8d521b035d5c83a56a9c82efefadbf00bf06f15faba48953751da01bb1  http___fiddlefire.net_hvkoxidq
5a888b453d9391661e12bcd70d9ad9efb1313e68f3f8402ec6a203e2db1e0749  http___gallery.mohammadtarighi.ir_gdiclpgq
3ba8e6dee40995c20ea7ac5d1e955a6ebf753ee0e53847b73910ed1ee2d4a8ba  http___gunungsari.co.id_9ssqssvnw
d00f6105bb4fd735b9b265c3b6cfad846284dd4841fda17720ad585d4596c802  http___image.ddianle.com_g56bmsie3h [4]
248170ffdc031a62635c35d05a049919cd8bab3838cf67cbe04053935927bf1d  http___inside.dljtjt.com_0gufg [6]
cfb1874527f2bbeb708d9470e3ec586f1939d9c4f97f812fb0400db6c38da912  http___inzt.net_rba6g3nnxq
9fb164f44c9b78c8ba96e1af0084acfc714789ecc635e02fe4e5e937d07c1d44  http___kathymerrill.com_hqnfsc
21232fda5192f9802f7a3515e2ac806ff9335dfd71b90d35df84a141bcd41519  http___kh2.co.uk_5sibczx4gx
8409d004dcee3b2a569f84ed2eeb244a0dcbe32828a7a1416f7c80641714c73a  http___kirulya.com_scfv1ofdh
9d9cfdea6437efad02bbae08e20dbccaa8c4129a5110dc7aa0e8331060d651f1  http___kserwis.pl_lozyg
8b50ad3642efb7093eef3a8916fee6f901995ff89802d973ed0475cd0e1cd546  http___ktlelektro.cz_1jenzg25wy [3]
e856a302261d293e750a54a9a323d79acb5befc32ac2e8a363c0242e01fa007f  http___kurou.bokunenjin.com_undi59e
8edcf8f62678e2dbfee243523d2df7259bb2a6fd813fa515d8bfc5d98062bd59  http___medianisprint.com_woarfryxsw
08e2628d0cf85e020e161ada7c0f0c009be4590940aef412f81641be0d7c609b  http___minis2.com_yrjwmun8
35df8a88fa8bd8343e97da1b396916695e6ee4a114fba26b13635ee3a1173952  http___mprotectcorp.com_opudc
b0484548b5174a127b0f1efbc1080410016d774845f54084db1bfd36f6cde54e  http___pcflame.com.au_ngihv
f3dc0e61590ff55d0c564bb181d6d2b0f27fe6702579e3dfcd10762ea7e03e61  http___perspektive-fuer-kinder.de_1e1dip
47e2289bf78b6f9ce653215f520cbea2b580d4a49dabdbc02d0264c3edadbde4  http___promgazenergo34.ru_onlj99szd
a5fa1f5b7ac00bc6ad41797e3c878b987e3ef498adc7e288b6ed33bd4ab173a7  http___rdsc-seminar.com_jlb4fdxt
4156a19772b65efaf81ebf25b2db977389c04d0424a150e4e289544e46a94761  http___rondurkin.com_c6w5pscmc
2579861043d9a045327f987fad07d2ba9961bffe3ffcb6001ad1068e8c422b91  http___s393640255.onlinehome.us_ygls8gycs
cfe25a30a3e387f50e3ff4b5e8ca33c15c5de85cc5ed1d4397cce4c0b829b19e  http___seaf.ch_s7lyen4j
b62512a51c63a85b0b674d2800fb68579bfd2ff364ca4be6debdc3e581b3d6cd  http___shomesofa.com_jnobn54 [5]
36f2808090a679130dd9cf2c4e88bf7657f3a84f07eb8a1050d7242baf4f6a2d  http___stoneofliberty.com_fvjhcy [1]
a1230526836ae5e88d4dc106838b9bd0657d7272082c7fe2db62ba238dc73266  http___taladm.ru_myqqrzzndi
ec603e5b385baf25bcf9f766a7c294c19602c06d2d5cf63b064c0e53cefc3460  http___v-english.com_gfnb3r
10d8fd5cd80e4f290aab3061efc0966bd56241667d515015b9c69ca233b79c3c  http___vivvn.com_rafd5un
bb9e9be4d33f5092a7faf967437293bac8478a38c91383514799a65ddeecbbed  http___webfutures.net_cuxdyilq
dc73f63fc6075b3985190ab9633f662cfb92407f60e44c390ee54b9d74ef6d39  http___weegee.fr_2d3xb74cif
c3b777cb817cf5785c589bd08432d8e466f92f8cb23c4cfcf7407f61fdf732cb  http___www.dazzle-events.be_qal8lxme
97b95e14bdd6890f2aeb9d730bcedc86e17aae181ad4039f07b00675a1569a0e  http___www.enhansit.com_z2lgjv
e651644bb90c84d682f48a91d84617a99035d4e1d1dec477bb6fe50f244e8d0c  http___www.lauraleedonnelly.com_qjiwhmrx
ce5fc1fe43fab3494c383d9374dc88ee9c86c06f90e6f0891feeb72b20f780d2  http___www.mywoc.ca_p29t8
2f519292cde78c075c5a0bd28d744a945669e5d42010a5473b00af1d79d2dcc0  http___www.ninthdistrict.org_wkvmds
4ba5fecd779e5fff8702a5ad1d4a4d89d107f7e7d7bfa7c89c73304e19224624  http___www.servipisos.com.ar_sn2ugvyws
12b377a9bd819105a51aa9aab5522e4a2ac802cc00bc811a25758b7bdfcea55d  http___www.stavros.ca_4woi2zlse
6c8dc070346dcdf5048987f3e346f8ca4fcdddde984a563abd25359216db792d  http___www.stavros.ca_c1ehjm [2]
eb2dae77c46345f717d1534631a8b37172db39b1b933fa5a3d363874c107533f  http___www.thepasobueno.com_usrcgntw
895f09d1c6da4ff8b9786cfa8b999652f86292f9fc27d04bc7461d3f328da121  http___www.tourist-car.ru_v0uiwotu
e5b7dc13c4d88299793b41ee20b3a787bffbeaa6eda5ea15281767edd3a8a444  http___www.zscio.com_uutfjime
d5f3e4c0b7f98d07138ac60a7b6cb6b6427e19b08ab1a016e77b2878c6f0213d  http___xiaojinsong.com_0igjg
a9d1604b2b2e8ec56695bb05a14609e7e4ff8540d932c81e72b083a743fb1583  http___yellowstudio.pl_u7ky2cyi
- decoded
d48c5242f2c264829ef2acf7b2dd9567125c0602baaf23b8c21a014e1c8247e6 [1]
1af3dfa7989e1081c99e6b2a676d0ada2808ca9758f2dbc6e1eadb76a5c80970 [2]
2dc5b81fd272de4b0c06ec725bda86320f5fa5558e5b9ff19b9c319627349ab0 [3]
1b4294dfd90a073ae4a1820db9127fc562448160a4a53b56db9abffb6a7ee3d6 [4]
ae1ade6559d774dc9103ed9da3ac8d454bd6e612dd9b66711e39eec33bbda0d9 [5]
184d0e4a0d8e07ea9a7ea8323fbc5a121004619f0c3810ebb1314c5464a83af6 [6]
- executed by "rundll32.exe %TEMP%\<filename>.ZK,ss4UauNfMNMcIepOTL3ZMr"
- samples
https://www.virustotal.com/file/d48c5242f2c264829ef2acf7b2dd9567125c0602baaf23b8c21a014e1c8247e6/analysis/1481890123/ [1]
https://www.virustotal.com/file/1af3dfa7989e1081c99e6b2a676d0ada2808ca9758f2dbc6e1eadb76a5c80970/analysis/1481890141/ [2]
https://www.virustotal.com/file/2dc5b81fd272de4b0c06ec725bda86320f5fa5558e5b9ff19b9c319627349ab0/analysis/1481890158/ [3]
https://www.virustotal.com/file/1b4294dfd90a073ae4a1820db9127fc562448160a4a53b56db9abffb6a7ee3d6/analysis/1481890176/ [4]
https://www.virustotal.com/file/ae1ade6559d774dc9103ed9da3ac8d454bd6e612dd9b66711e39eec33bbda0d9/analysis/1481890190/ [5]
https://www.virustotal.com/file/184d0e4a0d8e07ea9a7ea8323fbc5a121004619f0c3810ebb1314c5464a83af6/analysis/1481890204/ [6]

C2:
POST http://178.209.51.223/checkupdate
POST http://37.235.50.119/checkupdate
POST http://91.226.93.111/checkupdate