2016-11-08 Locky "Your parcel has arrived"

2016-11-08 #locky email phishing campaign "Your parcel has arrived"

Email sample:
-------------------------------------------------------------------------------------------------------
From: "Carmen Garcia" <Garcia.Carmen@spiekerfamily.com>
To: [REDACTED]
Subject: Your parcel has arrived
Date: Wed, 09 Nov 2016 00:34:01 +0600

Greetings! Your parcel has arrived to your local mail office.
Please claim it as soon as possible. After storage time included, charges may apply.

Attachment: parcel_e404d6caa.zip
-------------------------------------------------------------------------------------------------------
- sender address varies between emails
- subject is "Your parcel has arrived"
- attached file "parcel_<random chars>.zip" contains file "NRV_<random chars>_.js", a JScript downloader:

Download sites:
http://020zz.com/cbc2u0
http://0551gx.cn/ix4ae
http://168big.com.tw/pecs0bu
http://1kupon.com/dlxlwwju
http://adj3.pt/18ljogc
http://africantickets.de/93fxk05
http://aizheni.cn/suyod
http://ajooma.nl/rdi4fl
http://akram37.com/rr8zdl
http://alexandrkireev.ru/vkxsl
http://append.pl/srh9xsz
http://aquatica.at/ddbrfj
http://armantrading.co.ir/t2w9f4o
http://asaproducoes.com/dw7mt
http://asianbuffet.ca/wa18rel7
http://avnbook.com/0984p
http://axledha.net/1i7kb
http://axledha.net/3hjos
http://axledha.net/6rbjg
http://axledha.net/8z62l
http://axwat.com/n9dse9
http://balkello-accommodation.com/tx7f05n
http://basarinn.is/swydciy
http://baseballtivy.com/a0h6d3kx
http://bbq-tech.com/box6k6q5
http://belaket.nl/gwp2e
http://beptucongnghiep.com/t9mr4
http://bestoptic.eu/bmbq3xe
http://bg-n.nl/jp9am1
http://blueerdos.com/kn0jqsp6
http://bradandmel.com/kvtebnbn
http://butscher.co/upm89
http://caballerobustamante.com.pe/qxdf89k
http://campingmclaren.com/nitao
http://canyinzx.com/rlozfrl
http://ccilfov.ro/bsqxrpzg
http://chinasymbolic.com/ct8d8a6
http://chmedonline.com/yx5svu44
http://cisehire.com/0984p
http://cisehire.com/1qgqdy
http://cisehire.com/4e0e3f
http://cisehire.com/7cfykc4
http://clickjv.com/cq2j7r2t
http://cor-huizer.nl/9y2zo3rf
http://culturallascondes.cl/ko94iclv
http://dentastyle.ro/e2b2byo5
http://dietafine.cz/hmlzgj
http://distributorsite.com/84cnjrwk
http://diwsj.com/y3s3b2
http://djjaviermix.cl/ew3ptva0
http://dutchcotton.nl/i7rr6r
http://dwalemong.net/18ljogc
http://dwalemong.net/3g9s4ef
http://dwalemong.net/5zm8b
http://dwalemong.net/84cnjrwk
http://dwunion.com/sdcvhbq
http://edumarvm.com.ar/q9q2r84b
http://electron-trade.ru/ec2ya5u
http://elegant-taste.com/udhljvb
http://evirtualteam.com/hxnm53
http://fadyacor.com/2spmb
http://fadyacor.com/4ifnk
http://fadyacor.com/7tzc21z5
http://faiz-e-mushtaq.com/l1tg60n
http://friluftsgaarden.dk/zl0vz
http://shodgrat.net/05wfkn
http://shodgrat.net/1kspvjd
http://shodgrat.net/3xkb6
http://shodgrat.net/6ucp31q
http://wimaj.pl/vnahtgh

UPDATE:
http://bipmwebs.com/nv2nu
http://birebirpazar.com/yz1c5c
http://botanasjr.com/y48g5
http://britneyspears.website.pl/p72nl9es
http://caballerobustamante.com.pe/oc9fxmuj
http://cosywall.pl/lun8lruu
http://dx-team.org/ontjy
http://fadyacor.com/0pjx1b

Malware:
738b40e3ee4ea122a90cc9c5fe45b58dedfe979235aa2abddad0e347f061febf  http___020zz.com_cbc2u0
ee0a3ce25802e2bb3cea1fa80057a620ef11ffd8b45e1f6e21d21cf46b1f1992  http___0551gx.cn_ix4ae
a154acf4985f3324047ec4aded4d5e53764e9185000c2a6c35373c093a42ff04  http___168big.com.tw_pecs0bu
ff1a46699dbb6440f169233a056ff25e8e946e6ef943b3b844ef2bc673322361  http___1kupon.com_dlxlwwju
19d27266da307c841438ed9c7123c13b21e48ea1a57a840b8de8cd015e822213  http___adj3.pt_18ljogc
08be61c71ad254bade549436bfbaa57f8ac12badeedb9a76f93d3de424fa7a76  http___africantickets.de_93fxk05
c987719292b93d082192ad8872d7c8a740c2d7d665f648b725dff34572624d6a  http___aizheni.cn_suyod
7f8ed1969e5fbe3769637b9756f6b8e657aac0a82014ce265003ea9c572df1dd  http___ajooma.nl_rdi4fl
2839dcb95f006df9ce183ea700e4912b8c23fb1dcae5364428ab0ba8f9039533  http___akram37.com_rr8zdl
4fc3cae817126652dc7b24bb9dbb550fe5836edcbc229bad783e581dd68421ce  http___alexandrkireev.ru_vkxsl
5700f8fea3c82872552e99741541f396f57853d8f3287b3fc01a38a0b31134cd  http___append.pl_srh9xsz
4305d80956fed689dde2dcfae7f12ecad695681206aa6bd30831b5a72c0d1733  http___aquatica.at_ddbrfj
b4d46bad133528fb8694983ac52c9b9ad0dac65d2009084bbf167b17d7606054  http___armantrading.co.ir_t2w9f4o
5e124f02769092fab1a78addc93e420fab1c6b70af89129b24baf0bae6469165  http___asaproducoes.com_dw7mt
a52455e2214f4b99359917b0f7a2725b62786d2c09c9b5dce4635fa7085a5036  http___asianbuffet.ca_wa18rel7
2e07acfc965d47d4ebf840e432135c090c32e6fcfd85eb8f3108c070892ffbc8  http___avnbook.com_0984p
48c81c0bf803dadc79c702dabd10df01614434897d56a28ad50bd5a607c52fd9  http___axledha.net_1i7kb
d6898bb2aafc6b40a9218680eb72dc2750f10939a409963d49fea1f5e87c28b4  http___axledha.net_3hjos
f1f507e1ae9d2f7a1ea91419310fd6b41aff4d76749e36282bf1515193893127  http___axledha.net_6rbjg
633b5b1f2062ced628e4826c9f8a533b7ab9ac6e9c75e6e8632dbef0b3ce932b  http___axledha.net_8z62l
6d819736d21cc8c6d023898b44697d7c8f17be603077f61e81fb73ad2b48aaa6  http___axwat.com_n9dse9
0d35ab46e819e5716cbd6e88e59b7314e39b47212eab02cbde1e5ff066b4755d  http___balkello-accommodation.com_tx7f05n
491f5bef8cf0d6e50dd2f1d268fba1ff41764a8768c73eff75caa2b9c954a8ba  http___basarinn.is_swydciy
be684b02cf385786a1f149b995a209c076b44973fd9f888fa3364aa86beae38c  http___baseballtivy.com_a0h6d3kx
f586890fc5720515a53e758c95cdef47f61f24f24d437742b7e2a9d63968bf8a  http___bbq-tech.com_box6k6q5
bc88da9d9a6c3ddda2f5eb83aaf0b4a165a615b3fe0444afcfadd3cf171a8d31  http___belaket.nl_gwp2e
45fb6cd6fc790b477757dc026afbb082bc492b48a52aee5a9504b77edf995289  http___bestoptic.eu_bmbq3xe
b9ec3d7e661a847ce7f715505674467034c4958796d31d38c68365838417a4a9  http___bg-n.nl_jp9am1
dd6353ec63d1e0bbc84d54a290a8617ee1ba1eadb2e576896f3318d0a4194df9  http___blueerdos.com_kn0jqsp6
ece842a679ce49534b11165536fa1b6e7b33c85029fd8e37d4a5075c52d12e5a  http___bradandmel.com_kvtebnbn
4a90f64ccf3a3136a19f0b6dc285c05542aa99b0b7decc8f8ba06b4b46a557fb  http___butscher.co_upm89
77b5467218761309b96d4cd9177761d73747162a3b07ac32b0baaaec532eda14  http___caballerobustamante.com.pe_qxdf89k
5f01046f221e91c0f821c7ca06dfebd8b78b961fcb7a473aa7939b02e5aecd2b  http___campingmclaren.com_nitao
88b02750164d844cc6e184876a76d97ba80d89a9c31cf518e1902d57c7abef2b  http___canyinzx.com_rlozfrl
6ca53ae78166cacef7adac42cb7fd38db3377d9da66c63bd71357b84ab20a20d  http___ccilfov.ro_bsqxrpzg
d72426b532040a42af6b13aa53bcb4a74d88b0de3ce5ca6a100c84302fbd1080  http___chinasymbolic.com_ct8d8a6
3c24214944dee5f73c8663fc1c628a51039b6b97f0874090ddf25e4fb2ec0415  http___chmedonline.com_yx5svu44
2e07acfc965d47d4ebf840e432135c090c32e6fcfd85eb8f3108c070892ffbc8  http___cisehire.com_0984p
d0dadfd2ecd5541fa15f3f507f1908aa29032114171ad1bdd7e0b39b25f4b337  http___cisehire.com_1qgqdy
6e2d465a16b2e45d35407cb9769ae3aee76c77ad3404024de7bd586a4c4fab84  http___cisehire.com_4e0e3f
934304f9d71e2d8aceaa03232ea00aeea6df6398ba937c3cf9019b5e3f38425a  http___cisehire.com_7cfykc4
ee200b085faf48c87f7c460080bfe3c177f8c167b539049508fab105c9ef57d5  http___clickjv.com_cq2j7r2t
dfeda24308ddb5f0d8714edfd669c1f72fc53fc2b12ada551d799093cfdacb65  http___cor-huizer.nl_9y2zo3rf
80f5351bed09383a79cf99e48d239b4b84b95fa950a7a3c1f93867683b5b32c9  http___culturallascondes.cl_ko94iclv
e9f9bf4295a0518c5510ed00d62baa0c2b053e99960af73ce8ec50d14ee3a217  http___dentastyle.ro_e2b2byo5
6011cd7f8df8eeeec2afea832bfa6239db48a1e720f13fdbbf4cc1103955c42c  http___dietafine.cz_hmlzgj
b265b63175046c0f94ef90c7cff0e401b7ed7f3becd6064d6f3e8cd2b775b518  http___distributorsite.com_84cnjrwk
6ed8bff35228c69be441060311fe28b563ea6237e13fc82dc06c67da3f83f9f5  http___diwsj.com_y3s3b2
4a580eaa4388140350cd6298010197ee9a01ca2cdcfabb70874f3939db3e22fd  http___djjaviermix.cl_ew3ptva0
152af3e89d142742f233682db73173869f62229c58f71c33c45657894d1ef638  http___dutchcotton.nl_i7rr6r
19d27266da307c841438ed9c7123c13b21e48ea1a57a840b8de8cd015e822213  http___dwalemong.net_18ljogc
b16f6f6e314bb1d4188a99d696680bbf8c59a8d39546f5f70d888e517890c94c  http___dwalemong.net_3g9s4ef
26122e579547099a518775394757528fd04af8b4f23a4a9dfb33fc36350c14d0  http___dwalemong.net_5zm8b
b265b63175046c0f94ef90c7cff0e401b7ed7f3becd6064d6f3e8cd2b775b518  http___dwalemong.net_84cnjrwk
f91645c6db13c7c2884c0f42750303aa4fab303472770068d5ad60bb519a32b5  http___dwunion.com_sdcvhbq
bf8d246af96b3fd6e1dd4b13b972b15029e8bebfae9295dc472304271393a89b  http___edumarvm.com.ar_q9q2r84b
ffc8efd1322a1589b3c00304b105b52946b808ade8db4147b315156c1bc1c9a1  http___electron-trade.ru_ec2ya5u
5655d91a868ff268e50f6ba0ecb7206cfd2a919f783778dc2052a193b236b11a  http___elegant-taste.com_udhljvb
b55404644bbc3fa5077bdb61ef0885c4e4de780e81f21cfa01a7c63c05d87dff  http___evirtualteam.com_hxnm53
c41ee70482a8c1d5d22b84728a0f180fd80488e5de37eb983178cbb3dbd36cee  http___fadyacor.com_2spmb
e299f6a8779e9c8e7fed81bdf8186d64c7572805e10fb71f5980a28499df3be0  http___fadyacor.com_4ifnk
61df75707787548d72cac28b0ce9a455015f99f28009a2ba53ebb273f64a573a  http___fadyacor.com_7tzc21z5
42e61cad6f179574abbd065866e0f01bc9ef0140d8b9f6d3c3fa0b01b4aa81b3  http___faiz-e-mushtaq.com_l1tg60n
2d58c812242585a7dc2d96eb4c15f5e6da70190c9d20a63aa827d96cfa570e23  http___friluftsgaarden.dk_zl0vz
a70aa4478754bb562479bcad7e7655db4bfb6e2d1858c276deddb0a1cb039545  http___shodgrat.net_05wfkn
f24eac14f568489b6d8b7afb026e00369b4b3ad47e41e8595789e8c2c15e4af4  http___shodgrat.net_1kspvjd
6d353d9ffbdfba53f3e984cd775435821c8022794b06487b218fc04e73c1f948  http___shodgrat.net_3xkb6
d1af5fdf34db0814d0660f7859b8a5c7132019e6f5275c5fdfddfbd9dd61c702  http___shodgrat.net_6ucp31q
6c0dbf310d208db15a5e01812c364f8c9ec6f7c30b052f383e1cc3e062b580dd  http___wimaj.pl_vnahtgh

UPDATE:
b38814df0e4c2872e2d9418482c7ba092569e744590bd7044f22bf94e182177c  http___bipmwebs.com_nv2nu
154eef3f7e998763fb676744ce4f3a95654db7644148cdfb4122603b80230810  http___birebirpazar.com_yz1c5c
a768de1c50058906eeda8746a8b0dde871cc7fc4704e08a12f768868249e2945  http___botanasjr.com_y48g5
684e68c5f1fed55c3f6fee790e19c69492794588597fbaa7a54470da6d74124a  http___britneyspears.website.pl_p72nl9es
c6ae291b5f0b6aa7c7d91a82a1dcedcff98d21de83d55948710e151e9fdf2303  http___caballerobustamante.com.pe_oc9fxmuj
a7b75ac19d1b5d4f48d50f70020dd49af352f10ff81db2c242377ac2b78200d8  http___cosywall.pl_lun8lruu
c5223a2044c1a01f60dea78a31b992390c936b4098aa73e1ae6598f36c54eda7  http___dx-team.org_ontjy
c42cf11536a6c6dcca178befc9b588e255169a4688d037bc4d7effff3a4f0e2e  http___fadyacor.com_0pjx1b

- executed by "rundll32 %TEMP%\<dll_name>,0001"

C2:
POST http://185.118.67.204:80/message.php
POST http://81.177.26.136:80/message.php
POST http://185.67.0.102:80/message.php

xuotcothbuhat.pw
rktjbvxjbihrqdlvh.info
qyxrdhfuufn.biz
gfytvimwwi.pl
catejvrnxi.xyz
armrcupngncgum.click
npgmteapwbncfch.xyzp
prdnueyhukcjy.info
lanubxgujiclwvbvw.work
ggcemyyajb.pl
ilicnmsuferm.biz
cuduqdh.pl