New Locky distribution sites - 29/06/2016 affid=3

_*Locky affid=3*_

*Email info*

The *Subject* can be one of the following:

FW:foto
FW:images
FW:my photo
FW:my photos
FW:photo
FW:photo you asked
FW:pictures
RE:foto
RE:images
RE:my photo
RE:my photos
RE:photo
RE:photo you asked
RE:pictures
foto
images
my photo
my photos
photo
photo you asked
pictures

No*_Body* email observed.


In attachment a zip archive with a javascript file.
Here the code: https://gist.github.com/Antelox/c3e6cf237687fa662fc1a41452fc87ee

Javascript sample - MD5: a318d0a63e13d03b7c300bc022710b1c
VT: 11/55 - https://virustotal.com/en/file/e25662a6be279c1db7d5f042ec2129f0d54c9b3b12890bc9aa378dcc4de78206/analysis/

*Compromised domains (13)*:

armaplate.co.uk/ 8y7gvt65v?utajtJu=UwxvtvuRe
bdkj-alzey.de/ 8y7gvt65v?utajtJu=UwxvtvuRe
benelist.cz/ 8y7gvt65v?utajtJu=UwxvtvuRe
demo25k.hekko24.pl/ 8y7gvt65v?utajtJu=UwxvtvuRe
haselburg.cz/ 8y7gvt65v?utajtJu=UwxvtvuRe
mazaci.cz/ 8y7gvt65v?utajtJu=UwxvtvuRe
mypetsculpture.com/ 8y7gvt65v?utajtJu=UwxvtvuRe
pawpawscatfishhouse.com/ 8y7gvt65v?utajtJu=UwxvtvuRe
stxha.com/ 8y7gvt65v?utajtJu=UwxvtvuRe
topoeval.ro/ 8y7gvt65v?utajtJu=UwxvtvuRe
www.cristaleriadominguez.com/ 8y7gvt65v?utajtJu=UwxvtvuRe
www.gnatologo.eu/ 8y7gvt65v?utajtJu=UwxvtvuRe
www.wenti.nl/ 8y7gvt65v?utajtJu=UwxvtvuRe

*Sampled downloaded*:

File Name: 8y7gvt65v
MD5: 6c33700b12efaae1d87191068e2d9936
VT 6/53 - https://virustotal.com/en/file/2fcd597cef85c840072220a4742941c57cb1b19aee71107828faafa06d2f57b7/analysis/

*Hardcoded IPs*:

93.170.123\.219
151.236.17\.45
149.154.159\.125
14.31.59\.147
151.236.17\.47

*DGA*:

alxsgfnnwpkm\.xyz
apwspwaxwgxd\.org
cjjrhlowiqgaiui\.xyz
cuivjbqkauvusoe\.click
hgyrjsa\.pw
icgxhdkgfm\.work
rbgpglsfypiuesrgl\.click
rxmekpy\.org
upuerwvwauety\.pl
wqdwxpmvwdstncige\.pw ->	69.195.129\.70 	United States
xtwinxqqgogkynfh\.info
ysggrqvej\.info

*Hashes*:

05f1a9bee6ca27e4165b64651641f1bb
0f2c55bba384bac9d5dac16163ae3c42
14395970fac354401a4aac827cc3009e
15b6e0361e9ae3f22ccd13bf86e4c3c7
19ff98415a0379a63ef819a6afbdc886
3064305ea482271b15352b55d3171460
3d006fc4a88c60a919bf5b76101badd7
47b7594839f902de913c1534bd38f358
4d389d1bf1bc9ce85366cd3c793d6597
4fab03e434367c0dff17f3d9bc15e5ae
5eee5cedb96154f63286e0fd825bbacc
64d4229ec43e403c3be2955341f15130
6764bdd0c90d0557b0769ae6417174f8
681a05a74dd23014cd2157e7b1f687ea
70e29371ff4d659f3c7b4a30c9a54599
7696f133a76309593e6853659ee6f689
8747d2a51eeefacd3333d7de4602b622
8a4ec1850e2446d58f5f4d026f1fc68e
99fcddb0fd9997433165cd672895d98e
a318d0a63e13d03b7c300bc022710b1c
a3f7a662a3124650cc017c4e12d79b3a
a9d9499724612d2953dd0216885fd067
b94964fbdc62dba3fb35d1861872b75f
b9ab940d778a7134c93e2ef75f5b72f1
c44f960d8711fe1bb8338e0418a8545c
c92af3932c4ac83310dba866333eb5a3
cc9b8d9622f010d87215c23daa39d52c
d7030a7e7c3148c7142cc1da32de8423
e240d95188b85db2398a97d56b7e8a6a
f24dd428e996e7501c77b1b51eaf7f14
f330cb82fe9eb3b89cf9f1b0e2a5cbc9
f77259f3570bbc824aabf48649188ef7
f84b4a0e8aa2edccc4cdf42e894e48ea