2017-06-05 Dridex "Invoice"

2017-06-05: #dridex email phishing campaign "Invoice"

Download sites:
http://almahaconsultants.com/8yfh4gfff
http://cartus-imprimanta.ro/8yfh4gfff
http://clicburkina.com/8yfh4gfff
http://cqyssj.com/8yfh4gfff
http://luczko.pl/8yfh4gfff
http://mainlinecarriers.co.tz/8yfh4gfff
http://newserniggrofg.net/af/8yfh4gfff
http://quitecross.com/8yfh4gfff
http://resevesssetornument.com/af/8yfh4gfff
http://salonpalmareal.com/8yfh4gfff
http://servisanchez.com/8yfh4gfff
http://sethiwriting.com/8yfh4gfff
http://sonder-bar.net/8yfh4gfff
http://spaceonline.in/8yfh4gfff
http://studyineurope.in/8yfh4gfff
http://weddingphotolook.es/8yfh4gfff
http://xtramax.de/8yfh4gfff
http://ymcaonline.net/8yfh4gfff

Malware:
- encoded on download SHA256 539ca5726521381bd388dd893f618636449a5900cf43db6fdcdf9f817efd8257, MD5 8f527b08eb39578d18a3690980baf2c0
- decode by XORing the file with "bG5NeavlddlywpNO3tr8NsVNH0CBpcGi"
- decoded SHA256 c7dc1e2d1dbda6e287675160f1e96f6514b8a6f10017a1e4b76c7591c3785e97, MD5 1a18e844222a43381839d2fa95493ee3
- VT https://www.virustotal.com/file/c7dc1e2d1dbda6e287675160f1e96f6514b8a6f10017a1e4b76c7591c3785e97/analysis/1496659761/
- HA https://www.reverse.it/sample/c7dc1e2d1dbda6e287675160f1e96f6514b8a6f10017a1e4b76c7591c3785e97?environmentId=100