Advertisement
Racco42

Locky "Confirmation letter"

Aug 3rd, 2016
1,999
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.13 KB | None | 0 0
  1. 2016-08-03 #locky email phishing campaign "Confirmation letter", overlaps with "Fw: New invoices"
  2.  
  3. Email sample
  4. --------------------------------------------------------------------------
  5. From: Gates.30345@[REDACTED]
  6. To: [REDACTED]
  7. Subject: Confirmation letter
  8.  
  9. Hi [REDACTED],
  10.  
  11. I attached the employment confirmation letter I prepared.
  12. Please check it before you send it out.
  13.  
  14. Best regards
  15. Deirdre Gates
  16. --------------------------------------------------------------------------
  17. Attachment: da471bf3c02.zip, contains "data 99a38ab1-.js"; JScript downloader
  18.  
  19. Download sites:
  20. http://210.240.104.2/8wldse8
  21. http://aquatixbottle.com/yxmbfle7
  22. http://banthaoduoc.com/ys06v
  23. http://bgnakano.web.fc2.com/581n98q
  24. http://biyoujuicy.web.fc2.com/1r6hs9p
  25. http://blog-aida.cba.pl/2zensi7t
  26. http://buntaro.web.fc2.com/nzeznx
  27. http://calcoastlogistics.com/r26ek39
  28. http://cbactive.com/qb0i95
  29. http://colleenthestylist.com/tjdaf
  30. http://containermx.com/yb6wj
  31. http://darky.cba.pl/2bjwa
  32. http://deanstum.com/dsrpfn39
  33. http://dks357.aiq.ru/7d5ogq
  34. http://doma10.atspace.com/41rplexz
  35. http://eacglobal.us/lxeohcg
  36. http://epokcomm.com/p0nsja5t
  37. http://feepharm.greatnow.com/gpbstpww
  38. http://goldjinoz.com/9s437a
  39. http://hpc.atspace.com/fzlsn
  40. http://ilkhaberadana.com/xeny36
  41. http://joost.standbyhosting.nl/itlorta
  42. http://judowattrelos.perso.sfr.fr/8hnsps8a
  43. http://networkerakademie.de/ow0fmkda
  44. http://oabbahs.web.fc2.com/aunc3kef
  45. http://otwayorchard.net/ydumpjt5
  46. http://platimunjinoz.ws/41rplexz
  47. http://proxes.50webs.com/7y1s2
  48. http://senliheavenly.web.fc2.com/ac0tk
  49. http://silverjinoz.net/49x2nv
  50. http://sv-handwerk.de/b8jzys
  51. http://travoxsb.com/sj49bk8
  52. http://westcoastswingitaly.it/49x2nv
  53. http://www.aaa-ch.com/p23hgn
  54. http://www.nadelaur.com/b4xytp
  55. http://www.nuovogarden.it/4m4vm2
  56. http://www.ra-goebel.eu/4d71tv0m
  57. http://www.ser-tech.com.ar/0pus3
  58. http://www.totalfitness.it/394ouik
  59. http://www.typhloshop.ru/1ql8iq
  60. http://www.valser.onored.com/1ifq8io
  61. http://zonabest.atspace.com/353wxy
  62.  
  63. Added:
  64. http://allsex.atspace.com/bjagcu
  65. http://pvdbosch.dommel.be/kwvf2xb3
  66. http://thecourtyardcolfaxcom.sites.qwestoffice.net/9s437a
  67.  
  68. Encrypted malware, filesize 144388:
  69. 1a0fefc06a543447a34e27bc0ce3424b3d8e5619a9bf6765907f0cdbf44efae3 http___210.240.104.2_8wldse8
  70. 0817a6db71a789c0109ac9d18bb7a1853ba6971fc81e86ab0a9f92cddfb048ad http___aquatixbottle.com_yxmbfle7
  71. 8e4f4bbeff007313a8636dd1183009b72643746930a884ae66c5dd2871603cd3 http___banthaoduoc.com_ys06v
  72. 715cd811dd553f180b96d9ba14b7d690efb4b257941cc62cc1ca7abe9d7a1882 http___bgnakano.web.fc2.com_581n98q
  73. e10a86f3c2e4a9542f54f96b18126e411ef5e8d8d40fd07c728c213d1f224e06 http___biyoujuicy.web.fc2.com_1r6hs9p
  74. 10476629214eb81cdadf13e71003ad72f93c3429acb23b2a00940f96ed49de1a http___blog-aida.cba.pl_2zensi7t
  75. d7fb3fa30ca58419e79cd757949ab94d074f381570ae4dc71e9463b302d9ecb9 http___buntaro.web.fc2.com_nzeznx
  76. 233ba4c14c52c2fa4316c3495701ffbeeeff85c808e016b0c9845daf35957545 http___calcoastlogistics.com_r26ek39
  77. 5fd97fcf3a0f31aad810c664abda5422f4a22d094cf868eb9c9bd3b799c5e966 http___cbactive.com_qb0i95
  78. 50a760857dc239623c121fe987e3f221d7bfe70173ec585e926fb57bba613fbf http___colleenthestylist.com_tjdaf
  79. 88da083d6bad97a424363e4929961582f9efec1c729e3572a42d54236402f450 http___containermx.com_yb6wj
  80. 93acb8451e77ed799294a3bc7534ad39d7926119609aaa6c83494b172a5f6afc http___darky.cba.pl_2bjwa
  81. cf45e99f9b9f8fb78a1fefc54bce5f7a8271c100c4c5451004e9f8b4be88a839 http___deanstum.com_dsrpfn39
  82. 2a200b6403c3d10e7c1b8afe6c99d148876f3ff567dcad00f272d927ebc7529c http___dks357.aiq.ru_7d5ogq
  83. 62502397b40878fbcbedf42265c4f86cc30eb08ddd83ce3f1e87a9cafe00c6b4 http___doma10.atspace.com_41rplexz
  84. 44e8ab592bc6a01502d2c7e0e12f3a13cf819cd8b8fc14b5fa209e25a81fd782 http___eacglobal.us_lxeohcg
  85. 2fb027bd6da994a180a6da8199261e3757b48a3844bee81f16b6775a1d42a749 http___epokcomm.com_p0nsja5t
  86. e3f6edd79d05c68c5f7c8d45c6e180576f214fe117289550845d71bf1b805829 http___feepharm.greatnow.com_gpbstpww
  87. 9e165d6001d88572e742f0b184420e55f5aaabfe709beac5177f29d548387a53 http___goldjinoz.com_9s437a
  88. 3ea627019a1dc2e26edcb5f0f808b3425d920abb58cd00d4f4c02da34fbfd873 http___hpc.atspace.com_fzlsn
  89. 3e9718cf028979538f1a3475a7c1ed9ed8a447c6e76f1e148aef176c126f8d62 http___ilkhaberadana.com_xeny36
  90. 8836d0cfc60221efa74c14cd222298f3cea2dc2236b8eb2f71c8baff683edde7 http___joost.standbyhosting.nl_itlorta
  91. 2c471cebce463966cb15ebc546098469eb46351054b2e0bfc10e7ad38e0a2f53 http___judowattrelos.perso.sfr.fr_8hnsps8a
  92. f03deca711d06da4dfd5e47387eda60500263500f12fe60bf8998b4de160e030 http___networkerakademie.de_ow0fmkda
  93. cbce1e8f017f573439473ffe1dc2c6181ae1b396b8e8ce53129f3911e19c5eda http___oabbahs.web.fc2.com_aunc3kef
  94. 4ef5c0f75d6b467503c133a25a071b68d250ffb446992367d27872b3686b68c6 http___otwayorchard.net_ydumpjt5
  95. 62502397b40878fbcbedf42265c4f86cc30eb08ddd83ce3f1e87a9cafe00c6b4 http___platimunjinoz.ws_41rplexz
  96. 072459104373c1b648d9ded68e4a05cc435ddd7e54b05d511df7d0c4354dadf0 http___proxes.50webs.com_7y1s2
  97. 0a23a54f30431a0d12c2851d1995d4ab3388596ef9da298a2b6c8fb1423cce0d http___senliheavenly.web.fc2.com_ac0tk
  98. d9489bccccf070946243e00b24fda47520c30b967d7430b1bd0686de6ac90530 http___sv-handwerk.de_b8jzys
  99. f21533f5c87de58144f1a689d052c69f6cdb8ee6fc83fb2877f8565a32eb7d0e http___travoxsb.com_sj49bk8
  100. ad695a6149d13817bf7ab92015739f06d623137640f41cba9ec6fa0cacde1a0a http___westcoastswingitaly.it_49x2nv
  101. 49da5d871b79e3347ee33e7a543846dc20ce78b9b0c7ef6f482d7e23c9bed6a5 http___www.aaa-ch.com_p23hgn
  102. a498e674d4e4fc0945e1725ab92f5e3f3d273f650db75d0af756926c7a28512d http___www.nadelaur.com_b4xytp
  103. 6168a83e7877ff4387be46bd3d7b8fda4362b0325dd6136dae4c07daf2facc5e http___www.nuovogarden.it_4m4vm2
  104. 0f942860cf28feeaa59cf5c970caf3275db21b68bf6e136f475da48a64690038 http___www.ra-goebel.eu_4d71tv0m
  105. bd43ccd1d4034a5d574f76c582fe67cca0cda46d89ced91301187e7aff5dfe36 http___www.ser-tech.com.ar_0pus3
  106. b4d04c39bdbcb62e18eebf32b0edf302159ec65fc4b4608e1c1b91300223c735 http___www.totalfitness.it_394ouik
  107. f8ff8a3e0702d98ff9c90a5fa0d5c10e9b0b22ddc9e1156fbbc6f58a6f788690 http___www.typhloshop.ru_1ql8iq
  108. c64ff1dba0d047e686f4196016b951b427c1d8d3b589a0be3bf89b124fd1de0f http___www.valser.onored.com_1ifq8io
  109. 97f93eac6779658466b9225265883b266b917ab94ea04ee8a4acb5bca75fc25f http___zonabest.atspace.com_353wxy
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement