2016-11-07 Locky "Health insurance"

2016-11-07: #locky email phishing campaign "Health insurance"

Email sample:
-------------------------------------------------------------------------------------------------------------------
From: "Gail Michael" <Michael195@operations-tech.com>
To: [REDACTED]
Subject: Health Insurance
Date: Mon, 07 Nov 2016 22:52:34 +0100

Dear [REDACTED], this is from the insurance company concerning with your health insurance.
The new insurance contract is attached.
Please look over it and let us know if you have questions.

Best Wishes,
Gail Michael

Attachment: insurance_f57672432.zip
-------------------------------------------------------------------------------------------------------------------
- sender address varies between emails
- subject is "Health insurance"
- attached file "insurance_<random chars>.zip" contains file "NRV_<random char>.js", a JScript downloader

Download sites:
http://50engineersroad.com/ovr9t4gh
http://aloneadage.com/022mwu
http://aloneadage.com/2jonq
http://aloneadage.com/3z2390i
http://aloneadage.com/5vxsiir
http://breepes.com/2g7bwc2
http://breepes.com/3ql7b0m
http://breepes.com/5kjcg
http://breepes.com/8d14skoi
http://broonquipo.net/1to1o
http://broonquipo.net/3f6wvc0
http://broonquipo.net/59hxkliz
http://broonquipo.net/802z6
http://carindoauto.net/tmbqhc
http://carrier-spb.ru/wafxdfc
http://cetinakademi.com/jh018hr0
http://choopchirk.net/0d5ak
http://choopchirk.net/349u8
http://choopchirk.net/4bkz3b
http://choopchirk.net/7cxd7eq0
http://coilgalvalumemurah.com/ka85ho0
http://coilgalvalumemurah.com/qk1zs
http://copperblues.ca/mxf79
http://environment.ae/dycuhk
http://eyzimo.ru/ejz2xd
http://filomak.com/aa0249dz
http://fitnesstips.dk/oltvv9
http://fkhate.wz.cz/uq5dh1
http://florindumitrescu.ro/aoqsww
http://fordcmaxclub.nl/smt82
http://fototour.pl/hv9wgx80
http://fuatbilgin.com/p1zikf8a
http://funeralcars.eu/i2suor
http://gallato.com/59hxkliz
http://gaoqing8.net/d7g17
http://gardencreation.be/bc368
http://gastradebg.com/q3caw
http://gcw123.net/dsdgs
http://gelecekdiyarbakirsigorta.com/bnm4y
http://genelev.net/slzk0i9
http://ghaemshahr.net/ykzt4wdy
http://giadinh24.com/pzkvod1t
http://giesn.nl/aw392
http://gizlot.com/e5gdr
http://gloriajeanscoffees.co.th/cheqoqwj
http://gogeshop.com/m5mog1m1
http://goltest10.com/wr73amy
http://goodcatch.com/rvndfri
http://greatbi.nl/zqap33
http://grittivn.com/o8hnt
http://gwyhome.net/cvs6j8dn
http://harmat.pt/r1q2lu0c
http://harpen.nl/twtsp
http://hassyuu.com/rw96x1
http://hdmedia.pl/802z6
http://healthbynature.co.nz/owtf1
http://heederik.eu/ro2jtu
http://henanbusiness.net/xzwl8m2b
http://hentai.tc/bmctehb
http://hetmangniew.friko.pl/tijwn65r
http://hg-bikes.de/eigvqz7
http://highlakehill.be/omgfcbmn
http://himichesko-varna.com/fzqrolxe
http://hiro-eki.com/rfa5p
http://hksv.jp/nc1qq
http://hkyidianyuan.com/f14bs3
http://hockeyboy.ru/aopodhpv
http://hockeylavalest.com/tkaxy
http://infodoza.biz/wiyqhtxn
http://jcereza.com/ydpjch
http://maxhotel.it/349u8
http://model-meister.com/zvxvod5o
http://pornovizion.com/kv79cx
http://rokematin.com/0et8v
http://rokematin.com/3ekauq6y
http://rokematin.com/4ofajt
http://rokematin.com/7ntqf4
http://test.gotoweb.pro/v9dotj
http://waag-azhar.com/ug4qr8h
http://westprod.fr/y18b6d5k

Malware:
- encoded on download
826d824586c7416ee80e9ff8f3b1a1e72c8c780fd23d434fba78809344a251ce  http___50engineersroad.com_ovr9t4gh
c0dc30df61cb68e5abffb1f1c58f6145ff6cfae17a415eef827874908a476fbc  http___aloneadage.com_022mwu
91ac45f2fa465f50dc7ed49cec361f294f5ab467bdda136d093fa6813ff30888  http___aloneadage.com_2jonq
1b10d027198207e82b2f21dd5e7483d03194f577c8c05d7bf582e568c64a05fb  http___aloneadage.com_3z2390i
c973aba37d7f6e6c85b5a2691eaad1424f278f6864a83cca46ef6b6f85d98d3c  http___aloneadage.com_5vxsiir
77dbf23fef93c82e1f2db694b12fa97d8d0c9d3c87348ee54a3c3f3d3efeb8d3  http___breepes.com_2g7bwc2
bca6299cbe2df3d260c37a29b353aeb4c11394ce9c3abe61c8fdf8aaac1296dc  http___breepes.com_3ql7b0m
36731cb1c938ccb6733e291d10038dd8e3e1d2a5a991bae3df6992b6f3ae2b28  http___breepes.com_5kjcg
29172bda6c793465dc8b897a70f98ab087ef098647d3da4e49925bfead58bd57  http___breepes.com_8d14skoi
86a4f93354ffead76531779c4d32273d621214602822408bfa9c966ba6ef8f9e  http___broonquipo.net_1to1o
4b37f4dfa279fc9f13900557ff2d992161ecac58b0aea5f98d0b2a655bee7779  http___broonquipo.net_3f6wvc0
ba9f6a11e04b0da6b9ceb4b4dc8681056880420c22764a6a3668502f19c2f04c  http___broonquipo.net_59hxkliz
89ba584726d3903b259c705dca1e1b251e66b111c5c199dc8950173e00771fd7  http___broonquipo.net_802z6
f1e640d3694c99c02c82a714f2e91c7f26dc629d1f9156b09bba190280b43762  http___carindoauto.net_tmbqhc
1215ec7def02c2ab9b840f5325184c51e72b02b512cae78c14dce1dcb1615b01  http___carrier-spb.ru_wafxdfc [2]
57c54e2f7a855c3a5b6c6575b6f782bdd5cd0d01a46661673e9e380effab0558  http___cetinakademi.com_jh018hr0
ba7b5c3143b08e6c08a062d6e472a86fd728fe7dc7b28667953eb3aa9e92f3ef  http___choopchirk.net_0d5ak
dd852805f638c67e56ef6942d86a306407018733fbcc44ac5d82deeb06439c0d  http___choopchirk.net_349u8
ba86f8ede9e4bd182f1656bbe58fce1c0217a348fa1c23bf4ab82fd8c6fe7ffc  http___choopchirk.net_4bkz3b
b6aeac4ad5725a9908d95b497351f1fcc1df89e9a1dd458677370289f7e7d210  http___choopchirk.net_7cxd7eq0
aedf7e53395d1e2a4a464ee797d14adcb3f1ab20003e161b5ce93dd343e5f720  http___coilgalvalumemurah.com_ka85ho0
72e0fe8e4cce2aabb11fd1a709b0ab9b1d74ab6b407f0b2e339d67239c762031  http___coilgalvalumemurah.com_qk1zs
00e02090c668cf211efd31cbcffe11e5c3929998ec0f21ba056673102990a0f1  http___copperblues.ca_mxf79
8ba2f03a1d8091029925f95ab0cc8af6198af9fad4308f630e20a61f95b8a410  http___environment.ae_dycuhk
dbb57ecdd0c583c5ee1a4b6da0d5aad8d719e9641a8078da4000873f3e247f50  http___eyzimo.ru_ejz2xd
f6b7dda7d3101a52c59efd54afb20372bc0c15c955239d7d23b994094c5f5b50  http___filomak.com_aa0249dz
341a4a0e31f98bfab001b5f1fc593f3286bcc2c41187eb2ba9f9302ca7772f55  http___fitnesstips.dk_oltvv9
6412939a45d30f82827334b96f49e1d0a578fd7ca90e446d14a62f7f7ab30bca  http___fkhate.wz.cz_uq5dh1
bd6e19ca9520f924efaec85ca06c1498e6cf3fabd491090172f845a1827d60c0  http___florindumitrescu.ro_aoqsww
32ae064e6224f4e0b31379bdc9adac672c6942e21c428c164602cfa48e45a0ed  http___fordcmaxclub.nl_smt82
262626518925126b3d4ff62a4ad90f5c411789e7ec55a38f323596e953efa487  http___fototour.pl_hv9wgx80
46dc45eefcd826255cf9cd96785795e1e3fa0926778e4d99eca8dc3c42c54550  http___fuatbilgin.com_p1zikf8a
cc41b46168abf83df2c573a15deb010b467740edd131bc1cc2b2868a7102b0b7  http___funeralcars.eu_i2suor
ba9f6a11e04b0da6b9ceb4b4dc8681056880420c22764a6a3668502f19c2f04c  http___gallato.com_59hxkliz
e307336bd932b953b931e39d795f1904e9f6ad2b8c0e06b063941ea620255af6  http___gaoqing8.net_d7g17
c14867b8e6e515131f4797543e595ec8b6abb5da2de2693be7610ec6e496b715  http___gardencreation.be_bc368
9645014215adf8dfdf2a5e6589b11bacf4172e513daacc27c729614c774a3e77  http___gastradebg.com_q3caw
6a25eb5df3215c241fb88bdb227ef7e635082cb25d39bfd8a75162e977c493b7  http___gcw123.net_dsdgs
298b82c562086b733f7a5eab23c57131467d89fefb102b704b8d850e5672ba27  http___gelecekdiyarbakirsigorta.com_bnm4y
ad6c8c6a823a9e2b3350cd788db3b275f3ac78d056093ea7fcc8187122622d91  http___genelev.net_slzk0i9
c818d3c2b5f3a17ed7b41a669956c8c83baff12f9bd1585e5b463f047289f700  http___ghaemshahr.net_ykzt4wdy
4403ba5462b9e8b80d2f9adbec21b586ede9736cbe50be18947b0bbe78c2483e  http___giadinh24.com_pzkvod1t
e6805d6be075c6b357c0ddbdd5cbf1b8e6545fb67a4b4dbdccdc0398950df7a3  http___giesn.nl_aw392
d7752c7b886f1b7d6efa7ecb5f7b15b40d377cf97149d69c8f8d43b54b9c0198  http___gizlot.com_e5gdr [1]
06bcf14f510a32686dd31baf7233cb7ea5d2c0b755f8546b5a62d365318afe0c  http___gloriajeanscoffees.co.th_cheqoqwj
ca5f700feedd050c2058c8d50b2839ec28e24b47c22bbbee885475346038e55a  http___gogeshop.com_m5mog1m1
3aa5078011c331749a5a2b4ceff942a1e212e59fc2f77a544736cb316bc4e997  http___goltest10.com_wr73amy
538f9d0b4d23d838d46b745adbdd622a875f2e3ddf4fa76c56a4d3ab9744cf1e  http___goodcatch.com_rvndfri
82c74bb7cbd81f4a27d392603cab755d7971afa099b81bab8094d1ef70246913  http___greatbi.nl_zqap33
30aa1b7032dbbdb56ac527cf6a8c9091216d4f227696e5042d6fb2d3e3e1924b  http___grittivn.com_o8hnt
bf5e0bb8b0fa72148fd08f869e2a2ff25bf3ab54b72d46258287901aa76da626  http___harmat.pt_r1q2lu0c
4b1035092f001654f7703e9c76ecc38431e0b402d7caf8ce3f49c39a45087d68  http___harpen.nl_twtsp
c8e405edd6c12dd7b5ce77a6d70c8a3b5dbe104e3d9939136ab050bbfd7c3bfa  http___hassyuu.com_rw96x1
89ba584726d3903b259c705dca1e1b251e66b111c5c199dc8950173e00771fd7  http___hdmedia.pl_802z6
310c16a134ccf8b01584643c9fd619a5a4936155403504fc83a6e1d548c69e75  http___healthbynature.co.nz_owtf1
1258fc4a8325212fbcfcccd68bfecb5e73361c4bb445e39ecc241c9878252640  http___heederik.eu_ro2jtu
bc0d98b9413d64bc393c9d6bce7a64fdddae2328bc8a7e945367b745179dd993  http___henanbusiness.net_xzwl8m2b
723261187e88cc37b5c65416e892b1e034666ea8cf0dc4ea96c8848683ee4ac1  http___hentai.tc_bmctehb
ab0a7fc336240a3749b8c346cceef4757f4cc45b53aa6f1f33d3f3d78226f6e1  http___hetmangniew.friko.pl_tijwn65r
88f1a9ac536517a6ec30e8bd03fd602a8753d5ff701e706099636025e002b4d1  http___hg-bikes.de_eigvqz7
d6b0889e72d2b4ce3fece396b229ca619146b2efe9df8257cdab0a927a2269b9  http___highlakehill.be_omgfcbmn
7d6afdd16be010dc5937ee608454801e2385339c6729f88f0287e2e53a0fe6b4  http___himichesko-varna.com_fzqrolxe
4184a11e70e44064ed6a043b6852a3113125abab23902c28130314b5e0153da0  http___hiro-eki.com_rfa5p
f20bb9780e67a4e70d176070484fdc17a305dfe911b32de2b089ae13cafd6fbb  http___hksv.jp_nc1qq
e654f877f3f544d8df79f52c27134c59778c0d6bb3deac4a30714791058a72e7  http___hkyidianyuan.com_f14bs3
c4bc6385bfa719efb5a490cbaa3700985dcbd227a2d93e589101919eb1a4f268  http___hockeyboy.ru_aopodhpv
957e34f9d471d9838601cef112d167c435eb7dfada6f13892e21609b39709aad  http___hockeylavalest.com_tkaxy
d234a1e037e595d6b0bf1b780195611f74409b7e1a8c288f11c90bde0a763545  http___infodoza.biz_wiyqhtxn
72d8ac092daaac35725ac94b57f5307aa3a370e6ec44e8a912aec246ab7b391c  http___jcereza.com_ydpjch
dd852805f638c67e56ef6942d86a306407018733fbcc44ac5d82deeb06439c0d  http___maxhotel.it_349u8
770133d54966151dd7202ab11a88e136b2932d27827781f2aa74496f9c4a2345  http___model-meister.com_zvxvod5o
abc22427774779030f7d12b648f35868c4a427e4c16acf66da4cadc52d44f4a5  http___pornovizion.com_kv79cx
5211c3dec01d0692867162d6adef1a42205aa65fe2af1927c1b85d34b3928a77  http___rokematin.com_0et8v
f3984627eaced5e246bfddf737eed0fbb0eb561669987d44521f7947cd627f27  http___rokematin.com_3ekauq6y
97dc745d23012122dd2fe24a0ed01a8d32f99ac624749d241b9207b0110ea5c2  http___rokematin.com_4ofajt
d7c2c3f59d88b1c35958b4f4afd9ccf658f0366a29e43ad496c906813efd1f1b  http___rokematin.com_7ntqf4
ad776ad31836404cf80c3d651682a340ebf7a56da822dd73dea8b88b988a4578  http___test.gotoweb.pro_v9dotj
241c9351c7a33773f9e076c611c600890ee4b6fabc8b3eb620e388251c617199  http___waag-azhar.com_ug4qr8h
67c5b585877586b7334e44dfb6626993e73e42b1acbadc48db378de01f855719  http___westprod.fr_y18b6d5k

- decoded
SHS256 1215ec7def02c2ab9b840f5325184c51e72b02b512cae78c14dce1dcb1615b01, MD5 8c49f01bc6c10c99de89815b43cac087 [2]
SHA256 d7752c7b886f1b7d6efa7ecb5f7b15b40d377cf97149d69c8f8d43b54b9c0198, MD5 1d827a9701c1f7d251bf4492728c33ad [1]
- executed by "rundll32.exe %TEMP%\<dll_name>,woody"
- samples
https://www.reverse.it/sample/75b8eedf7bfe5b8f7b405276505b77b544778c6cf2d342a1cf6ef2c73c4a9ef9?environmentId=100
https://www.reverse.it/sample/0a92fbb47a5f2ed11d40a5d973bf7306003131dd27ed9e44cf3769e7f979de4c?environmentId=100
https://www.reverse.it/sample/d4a4e7e2c424b44835e6fdfd905c6458de4e1ecb4283681c611b19c41897377e?environmentId=100
https://malwr.com/analysis/ZWZhNzViNjZlOTM0NGZhM2FkNDVhYjBjN2Q0MDBjOGM/

C2:
POST 185.102.136.127:80/message.php
POST 195.123.211.229:80/message.php
POST 188.65.211.181:80/message.php

bnmqkgdlotrwqym.work
dmynnrrvse.org
gccaoqb.xyz
jcbbccd.pl
ksrcvmvfbc.org
mwyryuxoyhxlk.work
ornrkiokjkkqymw.org
rqrxrivxjt.pl
ummprtrxunm.xyz
wmstntaae.su
wmcrfvhf.org
xdriwlpllshhngyc.xyz