2016-12-20 Locky "Scan"

2016-12-20: #locky email phishing campaign "Scan"

Email sample:
-----------------------------------------------------------------------------------------------------------------------------
From: "chasity beldowski" <chasity.beldowski@magicfoto24.pl>
To: [REDACTED]
Subject: [SUSPICIOUS MESSAGE] Scan
Date: Tue, 20 Dec 2016 19:45:43 +0300

Regards,

CHASITY BELDOWSKI
Business Development
Mobile No.  +91 5554217728
Phone No. 021 35669 720

Lumax Industries Ltd.
608. Chakan - Talegaon Road
Mahalunge - Chakan Pune 410501 India

Attachment: 843218509b7c2ed.zip -> be27dc4c28efb26ee81c6fbc33a3fbe1.wsf
-----------------------------------------------------------------------------------------------------------------------------
- sender varies between emails
- subject is "Scan"
- attached file "<10-16 random hexa characters>.zip" contains file "<32 random lowercase chars>.wsf", a JScript downloader

Download sites:
- the download sites overlaps with "for printing" campaign, but the sample had changed in time
http://alaliengineering.net/hjv56
http://aministudio.com/hjv56
http://artlab.co.il/hjv56
http://bluelunar.net/hjv56
http://carloszubiaga.com/hjv56
http://charlenelouw.co.za/hjv56
http://corlouis.com/hjv56
http://cracoviamanor.com/hjv56
http://devzendo.org/hjv56
http://dwdesigns.us/hjv56
http://friedensschlag.de/hjv56
http://fsamson.com/hjv56
http://greatgoods2.bravepages.com/hjv56
http://guide4health.info/hjv56
http://hostalmilabi.com/hjv56
http://hostingjoomla.be/hjv56
http://householdanimals.50webs.com/hjv56
http://hzcoobl.com/hjv56
http://imperialroofing.co.uk/hjv56
http://inzt.net/hjv56
http://ipt.se/hjv56
http://isriir.com/hjv56
http://jaba-translations.pt/hjv56
http://jansen.com.ua/hjv56
http://jayacoat-industries.com.my/hjv56
http://jimprudom.com/hjv56
http://jzcolorful.com/hjv56
http://kakamiao.com/hjv56
http://kayju.com/hjv56
http://kenix.debugnet.com/hjv56
http://keralavoter.com/hjv56
http://kmwine.ge/hjv56
http://ldagnes.pl/hjv56
http://macoinservicios.com/hjv56
http://mass-appeal.com/hjv56
http://minilab.ca/hjv56
http://mk-beauty.de/hjv56
http://namecardcenter.net/hjv56
http://nfia-china.com/hjv56
http://ogustine.com/hjv56
http://owncloud.weber-rechtenbach.de/hjv56
http://phayamengrai.chiangrai.doae.go.th/hjv56
http://pozsgaiingatlan.hu/hjv56
http://residencegardenia.it/hjv56
http://revolutionarymom.com/hjv56
http://seolandia.pl/hjv56
http://shouxinghg.com/hjv56
http://stuifmeelenstamper.be/hjv56
http://tc12345.com/hjv56
http://theservantsoflove.com/hjv56
http://todoalojamiento.es/hjv56
http://ventureorchestra.com/hjv56
http://webplatter.com/hjv56
http://www.azrodandclassic.com/hjv56
http://www.genesisbilling.net/hjv56
http://www.grupoaex.es/hjv56
http://www.langeoog-meerleben.de/hjv56
http://www.tenji-guide.com/hjv56
http://yorkshire-pm.com/hjv56

Malware
- encoded: SHA256 f7fa2e9a0fc039666b98b2176a3544c6c597ec951640d12c22ef7aa5d5c40797, MD5 b435d0006a4fc1701852c0969b258b56
- decoded: SHA256 53a9fedfab0d20d64916f1a03620e2be255c5d8ec334370999f0dd03ca7a7624, MD5 997bea2edabbceb9df6fdd564dc0f143
- decoding (XOR) key is "e81G9Dsvrh0NR2qGWZSk1CSTNyqr8I2f"
- executed by "rundll32.exe %TEMP%\pYmpJfsNiM1.dll,vape"
- sample https://www.virustotal.com/en/file/53a9fedfab0d20d64916f1a03620e2be255c5d8ec334370999f0dd03ca7a7624/analysis/

C2:
POST http://176.121.14.95/checkupdate
POST http://188.127.239.48/checkupdate
POST http://193.201.225.124/checkupdate
POST http://91.203.5.144/checkupdate
POST http://91.223.180.3/checkupdate