Locky "Foundation plan"

2016-07-29 #locky email phishing campaign "Foundation plan"

Email sample:
----------------------------------------------------------------------------------------------------------------------------
From: "Jolene Fry"
To: [REDACTED]
Subject: Foundation plan

Hello,

I attached the foundation plan I made for our campaign.

Yours sincerely,
Jolene Fry

6c5034874710ac30e72c690bb2e3684accb89ab1357e11535d
----------------------------------------------------------------------------------------------------------------------------
Attachment: 522e97ab168.zip, containing file "foudation plan ~F67~..wsf"; JScript downloader

http://111.86.142.67/~h_fujii/95hdienf
http://529265.swh.strato-hosting.eu/gikggp
http://66.147.244.210/~rainbilc/r4nucs
http://93.175.140.1/q6cvuvu
http://adsnight.com/t660p
http://bokutaka.web.fc2.com/8rj9v664
http://carelife.koborezakura.com/2t29rb0d
http://ecotek-canada.us/6akas
http://fabricbuild.com/ufogle
http://familieewald.de/jt73zb0z
http://krohe-dienstleistungen.de/enu10vxa
http://leska-test.angelfire.com/7zw6yo4z
http://lokin.grafi-offshore.com/82nd0u
http://lotok.webstolica.ru/jxhz9hz
http://lscqlt.web.fc2.com/lqk5nzti
http://medilink.fr/~medilink/pqkuywne
http://newsgolf.50webs.com/hbvprzgx
http://robbeottoy.dommel.be/45ulb7g
http://sabplatform.com/r11u6
http://slotin.awardspace.com/61qoaa
http://smart.tin.it/~disconzi/brq738ap
http://snowbu.net/x45ookx
http://sobczuk.republika.pl/x8trr
http://studiobbou.com/~studio/49n7m
http://termstal.cba.pl/8cq0do1y
http://tydenvlibereckemkraji.cz/f11jz7
http://used-audi-car-for-sale.co.uk/1pb4oex0
http://visite-grece.com/wggna1ns
http://vupegrafika.hu/mph5kp
http://wieselflinkpro.gmxhome.de/35qcpq88
http://www.dan-dumitrache.go.ro/qz7ms
http://www.estreetshuffle.it/twlm0e
http://www.europegreen.org/ece88l
http://www.finkeyhangszer.hu/vajbtymy
http://www.finkeyhangszer.hu/y3vos3w0
http://www.guapaweb.jazztel.es/s42eqr
http://www.hotelnidodaquila.it/4uplr74
http://www.instalacionesjosearteaga.com/inj7k
http://www.italius.com/r0qho6
http://www.itoigawanavi-www.com/pu79i
http://www.jruffle.plus.com/6b4evw
http://www.landscape.hu/vwoo36at
http://www.landscape.hu/yjdtqex
http://www.lartsev.com/lw3qc
http://www.meta.metro.ru/87oo7w
http://www.offroadhandel.de/b0r8a2ka
http://www.offroadhandel.de/fqdute8
http://www.recuperifallimentari.it/p2l77
http://www.studiolegalecarlopuddu.com/izrt8r
http://www.www.dvdvision.webcindario.com/uiv58

Encrypted malware, filesize 143364 bytes
2b16f57e578539ddddb9600b258e164bc62af7ac187682c4e4f3b8a757110a23  http___111.86.142.67_~h_fujii_95hdienf
aae418b812da162124be6ae0f57b4b8a3eb7a7bcd1141f57409ec8bad902b2c9  http___529265.swh.strato-hosting.eu_gikggp
80ede3544fd4a5a1441503de5aecad00392401489123e4ecce8d23e4c3e779ac  http___66.147.244.210_~rainbilc_r4nucs
d5fdc1fced4cabb3206a88e7d8043e6bcc9d7d4430bac99052db9054f5106fad  http___adsnight.com_t660p
48c610fb65bf0e6fc5ad3c142b1ccde3318cebf6518ee62240f59c812d73ca70  http___carelife.koborezakura.com_2t29rb0d
887f95b6cf9348746c8b92664ce8d4f874a62c804caceb6ff6d2f8c9dd00d8ce  http___familieewald.de_jt73zb0z
ffe21c412255d689c3a3ca0799994ddd84dd513840a99185f45e43296c41b0bf  http___krohe-dienstleistungen.de_enu10vxa
66f8b07da8829fea162496966aedda49bb5980e2d48cb5cd7f4db4adbf8a32c3  http___leska-test.angelfire.com_7zw6yo4z
b103c1ff9d9a147710d824ddca640256ddf33b312397ce7afff26693d9616404  http___lokin.grafi-offshore.com_82nd0u
067ff2dff246942948db84469145ceaa8178720d63f9b263f57fcdd509c6b963  http___medilink.fr_~medilink_pqkuywne
c9b9d3d16bd6a0fe873638221842cf51de927b58c0a5295e3d48e456ff458de6  http___newsgolf.50webs.com_hbvprzgx
8ed0d7a0f95d2d18e9f75d7e8145838270c52305b7e29e6ac32f75069747d770  http___robbeottoy.dommel.be_45ulb7g
5354664802f8c4113485f4b3790c0d50c7dc2a29245207be4f9b5ecf819a12f9  http___sabplatform.com_r11u6
d6799b1f49a0137931b1376f1412d1bbde0d0cf9f7f38985672b3c834d1c4cdf  http___smart.tin.it_~disconzi_brq738ap
ac58802f039f7f868f864f2d98a1cc488ebada5aa9ce78c2a874597dcde1df25  http___snowbu.net_x45ookx
cc162b93828e30c208389d06fc9abb0b3acde2b33956c5daa7366a7618efa39d  http___sobczuk.republika.pl_x8trr
cd80b97dbcd1b193e2de0126b6c805c22cf25a977fa078e937998b0367e4328f  http___studiobbou.com_~studio_49n7m
183a8c8526f9837eff2e2b679229ce2d728d0efe28c8b8c36f01013f47d548ff  http___tydenvlibereckemkraji.cz_f11jz7
216e57c76ed54dd1a15a64d165303cbd65183758a5b96aada48a5f71695e6d71  http___used-audi-car-for-sale.co.uk_1pb4oex0
5a05a08528e114a49ded28eabdb3dc403129ea36f6b21740475937316f1466c6  http___visite-grece.com_wggna1ns
da7df43ed08b67480580319518ff77b1719c2b8f055ac353c6a83112e767ce46  http___vupegrafika.hu_mph5kp
5def8dbb97a88d930165775247dbbabd27b302e8501b72f8a441c60c4c8cf97a  http___wieselflinkpro.gmxhome.de_35qcpq88
67132887468b43be83e25f6c483e3514fc7a2ed5c54e0a37a7cc8c3fa014ec37  http___www.dan-dumitrache.go.ro_qz7ms
bd9ea453bf208675e27a557a5a3baadfb83a9ee719e91d10ea43b442efcb6b2a  http___www.estreetshuffle.it_twlm0e
ed94de123a8b40ecb4cfb5ae82dc780f578ead76e02e4eb16bd4181f13d1f23a  http___www.europegreen.org_ece88l
b9c2dc45d35ff0c3e70c658b4627e4edb787990bda9f5316f43fd53612a37286  http___www.finkeyhangszer.hu_vajbtymy
f03b932419e1d9cc834811358a96e940fcf550ec6475603f9629ad6297e050d2  http___www.finkeyhangszer.hu_y3vos3w0
3c821035211bc83385c8248d3904d854237e317c5e0e64ca771644e8b5ea5a94  http___www.guapaweb.jazztel.es_s42eqr
2a98863cab049948e50b296e4cb69036ea235077564a105f657b504a928d4467  http___www.hotelnidodaquila.it_4uplr74
7773218f85f6eee2dc99336368e596314c39647e0c02f9b869476f83dc35cd83  http___www.instalacionesjosearteaga.com_inj7k
df129fca1be9fea09612a04bc475d70f9311ea5cb41828f8f435f630fdb07649  http___www.italius.com_r0qho6
0504fb2dd3b550ac965a3c3338220d39766ff48ef25cf4ac323738fdeacf0fae  http___www.itoigawanavi-www.com_pu79i
e010d390941a4ebcab69b97d303ea62f4b4cb852b45f08f5af5982feac2bbb93  http___www.jruffle.plus.com_6b4evw
011e1ded884ce771e1ab5d6108904c85f2bc1d44aaed0a4e58148094b50e4207  http___www.landscape.hu_vwoo36at
dded5bb35160c9726c014a29c69e50669aa71201bfa753f6828a7bda80ee7f3d  http___www.landscape.hu_yjdtqex
2f27dd9801f51d6de39c4b0bbf4079da2dbd26105daf6b642202bf3c5a2f06cc  http___www.lartsev.com_lw3qc
228fca431e0e60fbc06782147559a52f9cd68a72aeea68373c11c6bc44070cc3  http___www.meta.metro.ru_87oo7w
dc5b59922bf4d21ec8e0dc451ebe5c8bdd5989f9c0e1b735fcefc9e9368d8b4a  http___www.offroadhandel.de_b0r8a2ka
f88afde0e73c65ed9b2cd0dda96266737810216f20c26be6cc445437cd6f54f3  http___www.offroadhandel.de_fqdute8
a1fedc3f1f4bb5c9b03023bcdc7f42672f1b0d45968eabbf98892bdebcd85638  http___www.recuperifallimentari.it_p2l77
52613b92fbde4d256c0b21c20df7e8982f9073425c861deb30049e9b9e4df763  http___www.studiolegalecarlopuddu.com_izrt8r
c0340702642eb3447c883968f864bcdcaca3e6b5913a728385af3af5830dfa20  http___www.www.dvdvision.webcindario.com_uiv58