2017-05-25 Jaff

2017-05-24: #jaff email phishing campaign

Download sites:
http://benimkecim.com/TrfHn4
http://better57toiuydof.net/af/TrfHn4
http://bionorica.md/TrfHn4
http://blackstoneconsultants.com/TrfHn4
http://danthegreat.athost.net/TrfHn4
http://derossigroup.it/TrfHn4
http://dianagaertner.com/TrfHn4
http://dreamybean.de/TrfHn4
http://duktigaflickor.se/TrfHn4
http://enseling-gmbh.de/TrfHn4
http://enzler-elektro.ch/TrfHn4
http://facecapsule.com/TrfHn4
http://holidayhops.com/TrfHn4
http://hunter.cz/TrfHn4
http://operadorapuma.com/TrfHn4
http://orchideus.cz/TrfHn4
http://pepmata.com/TrfHn4
http://pixshoot.com/TrfHn4
http://rejtjel.hu/TrfHn4
http://tropicalcoffeebreak.com/TrfHn4
http://vipmarketing.co.il/TrfHn4
http://vsflot.ru/TrfHn4
http://youtoolgrabeertorse.org/af/TrfHn4


Malware:
- encoded on download SHA256 ba7952ae07b41d049ad82674aeffbd43a5079f1db10a941db6545490c6c386bd, MD5 9585bc2d5d63b189bf8455d2e05cfb5e
- decode by XORing the data with key 6WLms4bGcHU5iDixvWv6Wmuql3ILxV8S
- decoded SHA256 2cc1d8edc318e0e09aad6afbc48999980f8e39e54734bca4c1a95c7b5db39569, MD5 fc8c82354bbc40f2662d577863c6b20f
- sample https://www.virustotal.com/en/file/2cc1d8edc318e0e09aad6afbc48999980f8e39e54734bca4c1a95c7b5db39569/analysis/1495712694/
         https://www.reverse.it/sample/2cc1d8edc318e0e09aad6afbc48999980f8e39e54734bca4c1a95c7b5db39569?environmentId=100