Locky "Fw: New invoices"

2016-08-03 #locky email phishing campaign "Fw: New invoices"

Email sample:
--------------------------------------------------------------------
From: Macdonald.06@[REDACTED]
To: [REDACTED]
Subject: Fw: New invoices

As you directed, I send the attachment containing the data about the new invoices
--------------------------------------------------------------------
Attachment: 5e422a63b988.zip, contains "data fb01c911-.js"; JScript downloader

http://210.240.104.2/8wldse8
http://allsex.atspace.com/bjagcu
http://aquatixbottle.com/yxmbfle7
http://banthaoduoc.com/ys06v
http://bgnakano.web.fc2.com/581n98q
http://biyoujuicy.web.fc2.com/1r6hs9p
http://blog-aida.cba.pl/2zensi7t
http://buntaro.web.fc2.com/nzeznx
http://calcoastlogistics.com/r26ek39
http://cbactive.com/qb0i95
http://cheremosh.chv.ukrpack.net/6elqbzaa
http://colleenthestylist.com/tjdaf
http://containermx.com/yb6wj
http://deanstum.com/dsrpfn39
http://deauville.atspace.com/eutf9d8z
http://dks357.aiq.ru/7d5ogq
http://doma10.atspace.com/41rplexz
http://eacglobal.us/lxeohcg
http://epokcomm.com/p0nsja5t
http://feepharm.greatnow.com/gpbstpww
http://foodbiz-net.com/9ocwm2l3
http://ginrockets.web.fc2.com/ntr5cygp
http://hpc.atspace.com/fzlsn
http://ilkhaberadana.com/xeny36
http://joost.standbyhosting.nl/itlorta
http://judowattrelos.perso.sfr.fr/8hnsps8a
http://networkerakademie.de/ow0fmkda
http://oabbahs.web.fc2.com/aunc3kef
http://otwayorchard.net/ydumpjt5
http://provincialpw.com/ukmia
http://proxes.50webs.com/7y1s2
http://pvdbosch.dommel.be/kwvf2xb3
http://senliheavenly.web.fc2.com/ac0tk
http://sv-handwerk.de/b8jzys
http://thecourtyardcolfaxcom.sites.qwestoffice.net/9s437a
http://travoxsb.com/sj49bk8
http://westcoastswingitaly.it/49x2nv
http://www.aaa-ch.com/p23hgn
http://www.nadelaur.com/b4xytp
http://www.nuovogarden.it/4m4vm2
http://www.ra-goebel.eu/4d71tv0m
http://www.ser-tech.com.ar/0pus3
http://www.shadyacresminis.bravepages.com/0ew2xje
http://www.totalfitness.it/394ouik
http://www.typhloshop.ru/1ql8iq
http://www.valser.onored.com/1ifq8io
http://www.zvideo.at/mz5fmn73
http://yesuzuki.web.fc2.com/heu7sqm8
http://zonabest.atspace.com/353wxy

Encrypted malware, filesize 144388
1a0fefc06a543447a34e27bc0ce3424b3d8e5619a9bf6765907f0cdbf44efae3  http___210.240.104.2_8wldse8
bb7ed1aa613fc447800d7e25cd5150e7b14875a07acae501652ffb1a8cb14f99  http___allsex.atspace.com_bjagcu
0817a6db71a789c0109ac9d18bb7a1853ba6971fc81e86ab0a9f92cddfb048ad  http___aquatixbottle.com_yxmbfle7
8e4f4bbeff007313a8636dd1183009b72643746930a884ae66c5dd2871603cd3  http___banthaoduoc.com_ys06v
715cd811dd553f180b96d9ba14b7d690efb4b257941cc62cc1ca7abe9d7a1882  http___bgnakano.web.fc2.com_581n98q
e10a86f3c2e4a9542f54f96b18126e411ef5e8d8d40fd07c728c213d1f224e06  http___biyoujuicy.web.fc2.com_1r6hs9p
10476629214eb81cdadf13e71003ad72f93c3429acb23b2a00940f96ed49de1a  http___blog-aida.cba.pl_2zensi7t
d7fb3fa30ca58419e79cd757949ab94d074f381570ae4dc71e9463b302d9ecb9  http___buntaro.web.fc2.com_nzeznx
233ba4c14c52c2fa4316c3495701ffbeeeff85c808e016b0c9845daf35957545  http___calcoastlogistics.com_r26ek39
5fd97fcf3a0f31aad810c664abda5422f4a22d094cf868eb9c9bd3b799c5e966  http___cbactive.com_qb0i95
59200f44c7048a9456d7362c0fdc8bd9be9c38411532cb2cda593e6c439ea19e  http___cheremosh.chv.ukrpack.net_6elqbzaa
50a760857dc239623c121fe987e3f221d7bfe70173ec585e926fb57bba613fbf  http___colleenthestylist.com_tjdaf
88da083d6bad97a424363e4929961582f9efec1c729e3572a42d54236402f450  http___containermx.com_yb6wj
cf45e99f9b9f8fb78a1fefc54bce5f7a8271c100c4c5451004e9f8b4be88a839  http___deanstum.com_dsrpfn39
67a2057038b5608e0c49848d4679ba62b205c80fa59dd54043e186e9df463cfe  http___deauville.atspace.com_eutf9d8z
2a200b6403c3d10e7c1b8afe6c99d148876f3ff567dcad00f272d927ebc7529c  http___dks357.aiq.ru_7d5ogq
62502397b40878fbcbedf42265c4f86cc30eb08ddd83ce3f1e87a9cafe00c6b4  http___doma10.atspace.com_41rplexz
44e8ab592bc6a01502d2c7e0e12f3a13cf819cd8b8fc14b5fa209e25a81fd782  http___eacglobal.us_lxeohcg
2fb027bd6da994a180a6da8199261e3757b48a3844bee81f16b6775a1d42a749  http___epokcomm.com_p0nsja5t
e3f6edd79d05c68c5f7c8d45c6e180576f214fe117289550845d71bf1b805829  http___feepharm.greatnow.com_gpbstpww
6398fc6ba65adb0100256a775b1366e46d1275300c01002bd7a3b59f36f6ec63  http___foodbiz-net.com_9ocwm2l3
e5f66411f91817625ef6b75bce985001828efc1f0465a95dab8e0d11c4496e5b  http___ginrockets.web.fc2.com_ntr5cygp
3ea627019a1dc2e26edcb5f0f808b3425d920abb58cd00d4f4c02da34fbfd873  http___hpc.atspace.com_fzlsn
3e9718cf028979538f1a3475a7c1ed9ed8a447c6e76f1e148aef176c126f8d62  http___ilkhaberadana.com_xeny36
8836d0cfc60221efa74c14cd222298f3cea2dc2236b8eb2f71c8baff683edde7  http___joost.standbyhosting.nl_itlorta
2c471cebce463966cb15ebc546098469eb46351054b2e0bfc10e7ad38e0a2f53  http___judowattrelos.perso.sfr.fr_8hnsps8a
f03deca711d06da4dfd5e47387eda60500263500f12fe60bf8998b4de160e030  http___networkerakademie.de_ow0fmkda
cbce1e8f017f573439473ffe1dc2c6181ae1b396b8e8ce53129f3911e19c5eda  http___oabbahs.web.fc2.com_aunc3kef
4ef5c0f75d6b467503c133a25a071b68d250ffb446992367d27872b3686b68c6  http___otwayorchard.net_ydumpjt5
685012be78a3e632c66bd7c0ec49f9a6ec2987bc793efd10bb822ce90b49acb8  http___provincialpw.com_ukmia
072459104373c1b648d9ded68e4a05cc435ddd7e54b05d511df7d0c4354dadf0  http___proxes.50webs.com_7y1s2
11ff5d42ff1983dc5bda30483c028fed9c05fc93bccf82d8e90d33c217c1e7f4  http___pvdbosch.dommel.be_kwvf2xb3
0a23a54f30431a0d12c2851d1995d4ab3388596ef9da298a2b6c8fb1423cce0d  http___senliheavenly.web.fc2.com_ac0tk
d9489bccccf070946243e00b24fda47520c30b967d7430b1bd0686de6ac90530  http___sv-handwerk.de_b8jzys
9e165d6001d88572e742f0b184420e55f5aaabfe709beac5177f29d548387a53  http___thecourtyardcolfaxcom.sites.qwestoffice.net_9s437a
f21533f5c87de58144f1a689d052c69f6cdb8ee6fc83fb2877f8565a32eb7d0e  http___travoxsb.com_sj49bk8
49da5d871b79e3347ee33e7a543846dc20ce78b9b0c7ef6f482d7e23c9bed6a5  http___www.aaa-ch.com_p23hgn
a498e674d4e4fc0945e1725ab92f5e3f3d273f650db75d0af756926c7a28512d  http___www.nadelaur.com_b4xytp
6168a83e7877ff4387be46bd3d7b8fda4362b0325dd6136dae4c07daf2facc5e  http___www.nuovogarden.it_4m4vm2
0f942860cf28feeaa59cf5c970caf3275db21b68bf6e136f475da48a64690038  http___www.ra-goebel.eu_4d71tv0m
bd43ccd1d4034a5d574f76c582fe67cca0cda46d89ced91301187e7aff5dfe36  http___www.ser-tech.com.ar_0pus3
f803f0fe3c41b53ef54522d5f4c2f0c128e69bb31f254d9d6f78f4e9f20c1a42  http___www.shadyacresminis.bravepages.com_0ew2xje
b4d04c39bdbcb62e18eebf32b0edf302159ec65fc4b4608e1c1b91300223c735  http___www.totalfitness.it_394ouik
f8ff8a3e0702d98ff9c90a5fa0d5c10e9b0b22ddc9e1156fbbc6f58a6f788690  http___www.typhloshop.ru_1ql8iq
c64ff1dba0d047e686f4196016b951b427c1d8d3b589a0be3bf89b124fd1de0f  http___www.valser.onored.com_1ifq8io
f82a840086af2746bd06c33e1ec9f3047dee1aaa66bd8d100178221b796607cb  http___www.zvideo.at_mz5fmn73
966d4896d049f4066e52b45668753188312f4a0d5ded985d9a1ffdd86accda04  http___yesuzuki.web.fc2.com_heu7sqm8
97f93eac6779658466b9225265883b266b917ab94ea04ee8a4acb5bca75fc25f  http___zonabest.atspace.com_353wxy