Advertisement
Racco42

2016-11-08 Locky "Your parcel has arrived"

Nov 8th, 2016
1,731
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 10.73 KB | None | 0 0
  1. 2016-11-08 #locky email phishing campaign "Your parcel has arrived"
  2.  
  3. Email sample:
  4. -------------------------------------------------------------------------------------------------------
  5. From: "Carmen Garcia" <Garcia.Carmen@spiekerfamily.com>
  6. To: [REDACTED]
  7. Subject: Your parcel has arrived
  8. Date: Wed, 09 Nov 2016 00:34:01 +0600
  9.  
  10. Greetings! Your parcel has arrived to your local mail office.
  11. Please claim it as soon as possible. After storage time included, charges may apply.
  12.  
  13. Attachment: parcel_e404d6caa.zip
  14. -------------------------------------------------------------------------------------------------------
  15. - sender address varies between emails
  16. - subject is "Your parcel has arrived"
  17. - attached file "parcel_<random chars>.zip" contains file "NRV_<random chars>_.js", a JScript downloader:
  18.  
  19. Download sites:
  20. http://020zz.com/cbc2u0
  21. http://0551gx.cn/ix4ae
  22. http://168big.com.tw/pecs0bu
  23. http://1kupon.com/dlxlwwju
  24. http://adj3.pt/18ljogc
  25. http://africantickets.de/93fxk05
  26. http://aizheni.cn/suyod
  27. http://ajooma.nl/rdi4fl
  28. http://akram37.com/rr8zdl
  29. http://alexandrkireev.ru/vkxsl
  30. http://append.pl/srh9xsz
  31. http://aquatica.at/ddbrfj
  32. http://armantrading.co.ir/t2w9f4o
  33. http://asaproducoes.com/dw7mt
  34. http://asianbuffet.ca/wa18rel7
  35. http://avnbook.com/0984p
  36. http://axledha.net/1i7kb
  37. http://axledha.net/3hjos
  38. http://axledha.net/6rbjg
  39. http://axledha.net/8z62l
  40. http://axwat.com/n9dse9
  41. http://balkello-accommodation.com/tx7f05n
  42. http://basarinn.is/swydciy
  43. http://baseballtivy.com/a0h6d3kx
  44. http://bbq-tech.com/box6k6q5
  45. http://belaket.nl/gwp2e
  46. http://beptucongnghiep.com/t9mr4
  47. http://bestoptic.eu/bmbq3xe
  48. http://bg-n.nl/jp9am1
  49. http://blueerdos.com/kn0jqsp6
  50. http://bradandmel.com/kvtebnbn
  51. http://butscher.co/upm89
  52. http://caballerobustamante.com.pe/qxdf89k
  53. http://campingmclaren.com/nitao
  54. http://canyinzx.com/rlozfrl
  55. http://ccilfov.ro/bsqxrpzg
  56. http://chinasymbolic.com/ct8d8a6
  57. http://chmedonline.com/yx5svu44
  58. http://cisehire.com/0984p
  59. http://cisehire.com/1qgqdy
  60. http://cisehire.com/4e0e3f
  61. http://cisehire.com/7cfykc4
  62. http://clickjv.com/cq2j7r2t
  63. http://cor-huizer.nl/9y2zo3rf
  64. http://culturallascondes.cl/ko94iclv
  65. http://dentastyle.ro/e2b2byo5
  66. http://dietafine.cz/hmlzgj
  67. http://distributorsite.com/84cnjrwk
  68. http://diwsj.com/y3s3b2
  69. http://djjaviermix.cl/ew3ptva0
  70. http://dutchcotton.nl/i7rr6r
  71. http://dwalemong.net/18ljogc
  72. http://dwalemong.net/3g9s4ef
  73. http://dwalemong.net/5zm8b
  74. http://dwalemong.net/84cnjrwk
  75. http://dwunion.com/sdcvhbq
  76. http://edumarvm.com.ar/q9q2r84b
  77. http://electron-trade.ru/ec2ya5u
  78. http://elegant-taste.com/udhljvb
  79. http://evirtualteam.com/hxnm53
  80. http://fadyacor.com/2spmb
  81. http://fadyacor.com/4ifnk
  82. http://fadyacor.com/7tzc21z5
  83. http://faiz-e-mushtaq.com/l1tg60n
  84. http://friluftsgaarden.dk/zl0vz
  85. http://shodgrat.net/05wfkn
  86. http://shodgrat.net/1kspvjd
  87. http://shodgrat.net/3xkb6
  88. http://shodgrat.net/6ucp31q
  89. http://wimaj.pl/vnahtgh
  90.  
  91. UPDATE:
  92. http://bipmwebs.com/nv2nu
  93. http://birebirpazar.com/yz1c5c
  94. http://botanasjr.com/y48g5
  95. http://britneyspears.website.pl/p72nl9es
  96. http://caballerobustamante.com.pe/oc9fxmuj
  97. http://cosywall.pl/lun8lruu
  98. http://dx-team.org/ontjy
  99. http://fadyacor.com/0pjx1b
  100.  
  101. Malware:
  102. 738b40e3ee4ea122a90cc9c5fe45b58dedfe979235aa2abddad0e347f061febf http___020zz.com_cbc2u0
  103. ee0a3ce25802e2bb3cea1fa80057a620ef11ffd8b45e1f6e21d21cf46b1f1992 http___0551gx.cn_ix4ae
  104. a154acf4985f3324047ec4aded4d5e53764e9185000c2a6c35373c093a42ff04 http___168big.com.tw_pecs0bu
  105. ff1a46699dbb6440f169233a056ff25e8e946e6ef943b3b844ef2bc673322361 http___1kupon.com_dlxlwwju
  106. 19d27266da307c841438ed9c7123c13b21e48ea1a57a840b8de8cd015e822213 http___adj3.pt_18ljogc
  107. 08be61c71ad254bade549436bfbaa57f8ac12badeedb9a76f93d3de424fa7a76 http___africantickets.de_93fxk05
  108. c987719292b93d082192ad8872d7c8a740c2d7d665f648b725dff34572624d6a http___aizheni.cn_suyod
  109. 7f8ed1969e5fbe3769637b9756f6b8e657aac0a82014ce265003ea9c572df1dd http___ajooma.nl_rdi4fl
  110. 2839dcb95f006df9ce183ea700e4912b8c23fb1dcae5364428ab0ba8f9039533 http___akram37.com_rr8zdl
  111. 4fc3cae817126652dc7b24bb9dbb550fe5836edcbc229bad783e581dd68421ce http___alexandrkireev.ru_vkxsl
  112. 5700f8fea3c82872552e99741541f396f57853d8f3287b3fc01a38a0b31134cd http___append.pl_srh9xsz
  113. 4305d80956fed689dde2dcfae7f12ecad695681206aa6bd30831b5a72c0d1733 http___aquatica.at_ddbrfj
  114. b4d46bad133528fb8694983ac52c9b9ad0dac65d2009084bbf167b17d7606054 http___armantrading.co.ir_t2w9f4o
  115. 5e124f02769092fab1a78addc93e420fab1c6b70af89129b24baf0bae6469165 http___asaproducoes.com_dw7mt
  116. a52455e2214f4b99359917b0f7a2725b62786d2c09c9b5dce4635fa7085a5036 http___asianbuffet.ca_wa18rel7
  117. 2e07acfc965d47d4ebf840e432135c090c32e6fcfd85eb8f3108c070892ffbc8 http___avnbook.com_0984p
  118. 48c81c0bf803dadc79c702dabd10df01614434897d56a28ad50bd5a607c52fd9 http___axledha.net_1i7kb
  119. d6898bb2aafc6b40a9218680eb72dc2750f10939a409963d49fea1f5e87c28b4 http___axledha.net_3hjos
  120. f1f507e1ae9d2f7a1ea91419310fd6b41aff4d76749e36282bf1515193893127 http___axledha.net_6rbjg
  121. 633b5b1f2062ced628e4826c9f8a533b7ab9ac6e9c75e6e8632dbef0b3ce932b http___axledha.net_8z62l
  122. 6d819736d21cc8c6d023898b44697d7c8f17be603077f61e81fb73ad2b48aaa6 http___axwat.com_n9dse9
  123. 0d35ab46e819e5716cbd6e88e59b7314e39b47212eab02cbde1e5ff066b4755d http___balkello-accommodation.com_tx7f05n
  124. 491f5bef8cf0d6e50dd2f1d268fba1ff41764a8768c73eff75caa2b9c954a8ba http___basarinn.is_swydciy
  125. be684b02cf385786a1f149b995a209c076b44973fd9f888fa3364aa86beae38c http___baseballtivy.com_a0h6d3kx
  126. f586890fc5720515a53e758c95cdef47f61f24f24d437742b7e2a9d63968bf8a http___bbq-tech.com_box6k6q5
  127. bc88da9d9a6c3ddda2f5eb83aaf0b4a165a615b3fe0444afcfadd3cf171a8d31 http___belaket.nl_gwp2e
  128. 45fb6cd6fc790b477757dc026afbb082bc492b48a52aee5a9504b77edf995289 http___bestoptic.eu_bmbq3xe
  129. b9ec3d7e661a847ce7f715505674467034c4958796d31d38c68365838417a4a9 http___bg-n.nl_jp9am1
  130. dd6353ec63d1e0bbc84d54a290a8617ee1ba1eadb2e576896f3318d0a4194df9 http___blueerdos.com_kn0jqsp6
  131. ece842a679ce49534b11165536fa1b6e7b33c85029fd8e37d4a5075c52d12e5a http___bradandmel.com_kvtebnbn
  132. 4a90f64ccf3a3136a19f0b6dc285c05542aa99b0b7decc8f8ba06b4b46a557fb http___butscher.co_upm89
  133. 77b5467218761309b96d4cd9177761d73747162a3b07ac32b0baaaec532eda14 http___caballerobustamante.com.pe_qxdf89k
  134. 5f01046f221e91c0f821c7ca06dfebd8b78b961fcb7a473aa7939b02e5aecd2b http___campingmclaren.com_nitao
  135. 88b02750164d844cc6e184876a76d97ba80d89a9c31cf518e1902d57c7abef2b http___canyinzx.com_rlozfrl
  136. 6ca53ae78166cacef7adac42cb7fd38db3377d9da66c63bd71357b84ab20a20d http___ccilfov.ro_bsqxrpzg
  137. d72426b532040a42af6b13aa53bcb4a74d88b0de3ce5ca6a100c84302fbd1080 http___chinasymbolic.com_ct8d8a6
  138. 3c24214944dee5f73c8663fc1c628a51039b6b97f0874090ddf25e4fb2ec0415 http___chmedonline.com_yx5svu44
  139. 2e07acfc965d47d4ebf840e432135c090c32e6fcfd85eb8f3108c070892ffbc8 http___cisehire.com_0984p
  140. d0dadfd2ecd5541fa15f3f507f1908aa29032114171ad1bdd7e0b39b25f4b337 http___cisehire.com_1qgqdy
  141. 6e2d465a16b2e45d35407cb9769ae3aee76c77ad3404024de7bd586a4c4fab84 http___cisehire.com_4e0e3f
  142. 934304f9d71e2d8aceaa03232ea00aeea6df6398ba937c3cf9019b5e3f38425a http___cisehire.com_7cfykc4
  143. ee200b085faf48c87f7c460080bfe3c177f8c167b539049508fab105c9ef57d5 http___clickjv.com_cq2j7r2t
  144. dfeda24308ddb5f0d8714edfd669c1f72fc53fc2b12ada551d799093cfdacb65 http___cor-huizer.nl_9y2zo3rf
  145. 80f5351bed09383a79cf99e48d239b4b84b95fa950a7a3c1f93867683b5b32c9 http___culturallascondes.cl_ko94iclv
  146. e9f9bf4295a0518c5510ed00d62baa0c2b053e99960af73ce8ec50d14ee3a217 http___dentastyle.ro_e2b2byo5
  147. 6011cd7f8df8eeeec2afea832bfa6239db48a1e720f13fdbbf4cc1103955c42c http___dietafine.cz_hmlzgj
  148. b265b63175046c0f94ef90c7cff0e401b7ed7f3becd6064d6f3e8cd2b775b518 http___distributorsite.com_84cnjrwk
  149. 6ed8bff35228c69be441060311fe28b563ea6237e13fc82dc06c67da3f83f9f5 http___diwsj.com_y3s3b2
  150. 4a580eaa4388140350cd6298010197ee9a01ca2cdcfabb70874f3939db3e22fd http___djjaviermix.cl_ew3ptva0
  151. 152af3e89d142742f233682db73173869f62229c58f71c33c45657894d1ef638 http___dutchcotton.nl_i7rr6r
  152. 19d27266da307c841438ed9c7123c13b21e48ea1a57a840b8de8cd015e822213 http___dwalemong.net_18ljogc
  153. b16f6f6e314bb1d4188a99d696680bbf8c59a8d39546f5f70d888e517890c94c http___dwalemong.net_3g9s4ef
  154. 26122e579547099a518775394757528fd04af8b4f23a4a9dfb33fc36350c14d0 http___dwalemong.net_5zm8b
  155. b265b63175046c0f94ef90c7cff0e401b7ed7f3becd6064d6f3e8cd2b775b518 http___dwalemong.net_84cnjrwk
  156. f91645c6db13c7c2884c0f42750303aa4fab303472770068d5ad60bb519a32b5 http___dwunion.com_sdcvhbq
  157. bf8d246af96b3fd6e1dd4b13b972b15029e8bebfae9295dc472304271393a89b http___edumarvm.com.ar_q9q2r84b
  158. ffc8efd1322a1589b3c00304b105b52946b808ade8db4147b315156c1bc1c9a1 http___electron-trade.ru_ec2ya5u
  159. 5655d91a868ff268e50f6ba0ecb7206cfd2a919f783778dc2052a193b236b11a http___elegant-taste.com_udhljvb
  160. b55404644bbc3fa5077bdb61ef0885c4e4de780e81f21cfa01a7c63c05d87dff http___evirtualteam.com_hxnm53
  161. c41ee70482a8c1d5d22b84728a0f180fd80488e5de37eb983178cbb3dbd36cee http___fadyacor.com_2spmb
  162. e299f6a8779e9c8e7fed81bdf8186d64c7572805e10fb71f5980a28499df3be0 http___fadyacor.com_4ifnk
  163. 61df75707787548d72cac28b0ce9a455015f99f28009a2ba53ebb273f64a573a http___fadyacor.com_7tzc21z5
  164. 42e61cad6f179574abbd065866e0f01bc9ef0140d8b9f6d3c3fa0b01b4aa81b3 http___faiz-e-mushtaq.com_l1tg60n
  165. 2d58c812242585a7dc2d96eb4c15f5e6da70190c9d20a63aa827d96cfa570e23 http___friluftsgaarden.dk_zl0vz
  166. a70aa4478754bb562479bcad7e7655db4bfb6e2d1858c276deddb0a1cb039545 http___shodgrat.net_05wfkn
  167. f24eac14f568489b6d8b7afb026e00369b4b3ad47e41e8595789e8c2c15e4af4 http___shodgrat.net_1kspvjd
  168. 6d353d9ffbdfba53f3e984cd775435821c8022794b06487b218fc04e73c1f948 http___shodgrat.net_3xkb6
  169. d1af5fdf34db0814d0660f7859b8a5c7132019e6f5275c5fdfddfbd9dd61c702 http___shodgrat.net_6ucp31q
  170. 6c0dbf310d208db15a5e01812c364f8c9ec6f7c30b052f383e1cc3e062b580dd http___wimaj.pl_vnahtgh
  171.  
  172. UPDATE:
  173. b38814df0e4c2872e2d9418482c7ba092569e744590bd7044f22bf94e182177c http___bipmwebs.com_nv2nu
  174. 154eef3f7e998763fb676744ce4f3a95654db7644148cdfb4122603b80230810 http___birebirpazar.com_yz1c5c
  175. a768de1c50058906eeda8746a8b0dde871cc7fc4704e08a12f768868249e2945 http___botanasjr.com_y48g5
  176. 684e68c5f1fed55c3f6fee790e19c69492794588597fbaa7a54470da6d74124a http___britneyspears.website.pl_p72nl9es
  177. c6ae291b5f0b6aa7c7d91a82a1dcedcff98d21de83d55948710e151e9fdf2303 http___caballerobustamante.com.pe_oc9fxmuj
  178. a7b75ac19d1b5d4f48d50f70020dd49af352f10ff81db2c242377ac2b78200d8 http___cosywall.pl_lun8lruu
  179. c5223a2044c1a01f60dea78a31b992390c936b4098aa73e1ae6598f36c54eda7 http___dx-team.org_ontjy
  180. c42cf11536a6c6dcca178befc9b588e255169a4688d037bc4d7effff3a4f0e2e http___fadyacor.com_0pjx1b
  181.  
  182. - executed by "rundll32 %TEMP%\<dll_name>,0001"
  183.  
  184. C2:
  185. POST http://185.118.67.204:80/message.php
  186. POST http://81.177.26.136:80/message.php
  187. POST http://185.67.0.102:80/message.php
  188.  
  189. xuotcothbuhat.pw
  190. rktjbvxjbihrqdlvh.info
  191. qyxrdhfuufn.biz
  192. gfytvimwwi.pl
  193. catejvrnxi.xyz
  194. armrcupngncgum.click
  195. npgmteapwbncfch.xyzp
  196. prdnueyhukcjy.info
  197. lanubxgujiclwvbvw.work
  198. ggcemyyajb.pl
  199. ilicnmsuferm.biz
  200. cuduqdh.pl
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement