2017-10-02 Locky "Emailed Invoice - NNNNNN"

2017-10-02: #locky email plhishing campaign "Emailed Invoice - NNNNNN"

Email sample:
----------------------------------------------------------------------------------------------------------------------------
From: Carey Burnaby <Carey@[REDACTED]>
To: [REDACTED]
Subject: Emailed Invoice - 371744
Date: Mon, 02 Oct 2017 10:47:02 -0500

As requested

regards
Carey Burnaby

--
Carey Burnaby

Attachment: I_371744.7z -> I_538446.js
----------------------------------------------------------------------------------------------------------------------------
- sender address is forged to look like coming from domain of recipient
- subject is "Emailed Invoice - <6 digits>"
- attached file "I_<6 digits>.7z contains file "I_<6 digits>.js", a JScript downloder which downloads from:

Download sites:
http://alexandradickman.com/873gfhi3f3r
http://goliathstoneindustries.com/873gfhi3f3r
http://honeypot.egdevcenter.com/873gfhi3f3r
http://ichinose.de/873gfhi3f3r
http://jeangurunlian.com/873gfhi3f3r
http://kartprinterleri.com/873gfhi3f3r
http://leightonbrothers.co.uk/873gfhi3f3r
http://missiegeslaagd.nl/873gfhi3f3r
http://motifahsap.com/873gfhi3f3r
http://pacalik.net/873gfhi3f3r
http://petrochemus.com/873gfhi3f3r
http://robsacks.com/873gfhi3f3r
http://schwellenwertdaten.de/873gfhi3f3r
http://shamanic-extracts.biz/873gfhi3f3r
http://skyehoppus.com/873gfhi3f3r
http://theceocforeporter.com/873gfhi3f3r
http://wallstproperties.com/873gfhi3f3r

Malware:
- Locky, offline yckol variant
- SHA256: 02defb0346aebb019053937cff0a3ee10ee51d3396e0c065f723694554ccf447, MD5: 52bc22f77e8091bd59635d481c9512f9
- VT: https://www.virustotal.com/en/file/02defb0346aebb019053937cff0a3ee10ee51d3396e0c065f723694554ccf447/analysis/1506965734/
- HA: https://www.reverse.it/sample/02defb0346aebb019053937cff0a3ee10ee51d3396e0c065f723694554ccf447?environmentId=100