2016-11-28 Locky "Insufficient funds"

2016-11-28 #locky email phishing campaign "Insufficent funds"

Email sample:
----------------------------------------------------------------------------------------------------------------
From: "Carter Baldwin" <Baldwin.Carter@fast.net.id>
To: [REDACTED]
Subject: Insufficient funds
Date: Tue, 29 Nov 2016 06:35:57 +0700

Dear [REDACTED],

Your bill payment was rejected due to insufficient funds on your account.

Payment details are given in the attachment.

Attachment: payment-[REDACTED].zip -> -snk-8220553.js
----------------------------------------------------------------------------------------------------------------
- sender varies between emails
- subject is "Insufficient funds"
- attached file "payment-<recepient name>.zip" contains file "-snk-<7-10 digits>.js", a JScript downloader

Download sites
http://decorvise.com/sqq0k
http://faeryminny.net/8mppw72
http://faeryminny.net/lawyx0iuzi
http://faeryminny.net/lnzadbv
http://faeryminny.net/ptytf6cmb0
http://hotelsheikhpalace.com/ibqw1jm
http://hzxihe.com/hf95jfu9fm
http://icdsarch.com/mfjfge3bmw
http://ifsaiumumi.com/x54y9f
http://imexltd.eu/scbz1mv6nr
http://impobg.eu/fhn5h15
http://invisplast.ru/rc5uqh3le
http://iovel.ro/mr4kj32wx
http://izww.cn/uefdi
http://jaspercn.com/lml6irz3j
http://jellybaby.org.uk/tju8y196
http://jimijunshi.com/quoh7o
http://jjbook.net/hkpka70y
http://jlhack.com/ezdcpdw9yf
http://jltl.net/jovxqn3wjz
http://job0916.cn/tteauk
http://joshcomeauxhair.com/prxm9gz
http://junhao8.com/klttzvqld
http://jurainvestments.com/i6ihhzl03x
http://kabele.ru/wgsscfqti
http://karens.com.au/msd0w6yds
http://kartikakarkam.com/hnrsbnst
http://kemerhaber.net/f2hzbx
http://khatibul-umamwiranu.com/rg1xwd7c
http://klaxcar.ro/pzpvxn
http://kongkhak.go.th/yh8ztc
http://kotofey24.ru/gukdc4ih
http://kovac-trade.com/e78ahlqflm
http://kppngarut.org/pvlb8qav
http://kstm.or.th/zmhztk8d4o
http://kuficflub.com/3wyjpraqd
http://kuficflub.com/8mqemxp
http://kuficflub.com/fnhoi
http://kuficflub.com/qef8yr7
http://kuponik.eu/vyieyqljp
http://leyuego.com/ejxgf1iy
http://liangriyou.cn/dk8iz
http://librosinculpa.com.ar/l9zbu
http://lumimont.cz/svond9
http://lyvyx.com/rnqzzicdq
http://majesticimmo.com/ira7a9
http://marcelrahner.com/taysisuvd
http://maroeg.com/yl5zdw
http://mashijiazu.net/fnkbxfozec
http://mclodesigns.com/n8pinagrs
http://melzer-casting.de/unhwqfy2y
http://minmin.in/nixovgx
http://mudrahviezda.sk/vjqcw
http://mujtabatrading.com/e8tldqozh
http://mybankofgold.com/hs64iyg
http://rcabaj.com.pl/6jk20
http://reaga.cz/c2wtfht
http://ruggyhaven.com/bbfqq8ooc1
http://ruggyhaven.com/iz9dn68
http://ruggyhaven.com/qxh6c
http://ruggyhaven.com/xgkrpgzft
http://safety-speed.ru/biipbsuzk
http://schmidtbauer.at/52euyhofgg
http://secur.ph/dpjjvj
http://smolwow.ru/5ixtjazs
http://structuralstonellc.com/aoenfcu5c
http://szgoland.net/bdrmzv
http://tdtrading.nl/d3fum2hq
http://tybor.hu/6mens1xdqj
http://uzbakadore.net/ah76ki5g0p
http://uzbakadore.net/h81mivlzi9
http://uzbakadore.net/pldwf
http://uzbakadore.net/st1rqo6nls
http://veinteproducciones.com.ar/ctu8jotsp
http://wharlslops.net/fwytmemzsj
http://wharlslops.net/lwzk4zx
http://wharlslops.net/ngohmr
http://wharlslops.net/pzyh4q5cs
http://www.meleather.com/dz1ksu4gr1

Malware:
- encoded on download
f1f691a1cbaa0c3d7f31bb12a277627bc38c8f82f9ec972a7cb803204171f6e1  http___faeryminny.net_8mppw72
375ffcb8ffebec177afbbf80004b31643a819c15eb97b39bd54acb15466cb049  http___faeryminny.net_lawyx0iuzi
3e5ec83fb9273aa86b550df704b2b841e355a6d60bd905c34288e5e1237bbeb2  http___faeryminny.net_lnzadbv
fc9cb54ca5715e9bcfcca8d2c5199d3362fd3fb44b43734cc71947435f3ce81a  http___faeryminny.net_ptytf6cmb0
0c4da63ccc3d21edb66108128124ac244f4fa813614141e1a176061c05b8a310  http___hotelsheikhpalace.com_ibqw1jm
3209ec768086217280fbe28faa95e6687a03f20db1e8e0d9feaf3eee91d9363e  http___hzxihe.com_hf95jfu9fm
e0c7186a2cdcb5511ed8ab94424150081c8643e924888441e4fcef9c3e9817b5  http___icdsarch.com_mfjfge3bmw
c4286b8966a82d6d4ab37eedb9f94f461652bd09e5a1b4209089838535ad3fce  http___ifsaiumumi.com_x54y9f
efb8ddd0851cee8fd66e848aebbc06917fc2f804a950c42bca03b08c83f74d5e  http___imexltd.eu_scbz1mv6nr
8b3284aedb309fa2f828d721cfcd3ca7d8dabde099335959989ef887aa6602e1  http___impobg.eu_fhn5h15
e0cad60366887422e881322726bf69a07e75519d33627bbd729ff00a476ab944  http___invisplast.ru_rc5uqh3le
a4b65d21cf0a48316ce43c8fda9f5c7f35dbd76c5586e18a3fff6cf2f4f99f9d  http___iovel.ro_mr4kj32wx
7a4b3f78041d20aefeb163e45b5a08797cfbfe4b5da75494b13f1de25ca692c3  http___izww.cn_uefdi
e8f4dc18dceae9637cde2e30fca64a03eb42f3f80e9d3918ce6fa6ad9bd7b765  http___jaspercn.com_lml6irz3j
6d09a817bdd624a6e6c26db4a33dd3139ad934fabac13694e4eb725b70569058  http___jellybaby.org.uk_tju8y196
b05ef45b12d89b3327438eab494bbad413dfa4f4815ac1c9c607bca325e78f42  http___jimijunshi.com_quoh7o
0eac0a8dd542abf976afe7431778eb70f7ae97502183cb992cfb9bbb0acb6c9b  http___jjbook.net_hkpka70y
e9531608c12aad92d909bfbe1f4378f7cd833bc876cd57353729f4bbcdf20ccc  http___jlhack.com_ezdcpdw9yf
40990af56e89f07208df1bf8852465499f805acfb6c0e1bb4061f66aaaffd2b3  http___jltl.net_jovxqn3wjz
89006506e85d8ae111c017edc36e97d95deeed712464680737875ac6a2ccef5d  http___job0916.cn_tteauk
0febcda65ce97fb0542fa82cdb62d030e038c64621fbf7519dcf866d4268f8fd  http___junhao8.com_klttzvqld
44586ab4bf9df59eab890bf713feb7a7a846195617c41c60c9100a086511bdae  http___jurainvestments.com_i6ihhzl03x
9fb3e2a802510c89640a24e12fb31b7920bb072403647a831a68a2dc77a0abc9  http___karens.com.au_msd0w6yds
9401c8d8767e183581c1d5b4b3879159509a9ac8755c41f88d9277c629a93151  http___kemerhaber.net_f2hzbx
e44cbffafd7d8e1a2359fa417a183a0d8cddac94552bf7bd2a47535fede1a1ec  http___khatibul-umamwiranu.com_rg1xwd7c
07b82db971d7178ee56f500f6310e2dd0ca5c10399729bcc723411dcb69b36e4  http___kongkhak.go.th_yh8ztc [1]
021c62096a0aa5420f825f76d96a43bb48e09f489d036e59b892ece87ea56081  http___kovac-trade.com_e78ahlqflm
23123cc964f7d9ddbe50f934c4a9494643dc47613c7a01b3066b356cad8de652  http___kppngarut.org_pvlb8qav
1c5a6cd93427a1d4f05e1baaa1f5fe203dc9e566eb54a7caff18fab8883ccb0e  http___kstm.or.th_zmhztk8d4o
1c3e813626ffcf78ad920fcc4d7230f64a57345ed0f1a48af9d84f24b0078d18  http___kuficflub.com_3wyjpraqd
bddb2c96eadd395dc1065b9b396f839ca647daddd6f7c4fb445631912e2ea934  http___kuficflub.com_8mqemxp
704992d60366d290ca5bfe56c72f353c160ba60e3f14297dcb53907b3c82335d  http___kuficflub.com_fnhoi [4]
00b17ac8a4cde8cc648184a10e0718c88fae772114cb289cc47ab186182e4aed  http___kuficflub.com_qef8yr7
62c4f23e23efbfcbf1f57556d5f049cf3585ec45268a09f80a9410427dc91f15  http___kuponik.eu_vyieyqljp [2]
c844f1c98de92513a9fccaf0de44e626a0d077e1ba3385a017946d7458486642  http___leyuego.com_ejxgf1iy
35391920ec8dcee59a6d0bb052745ee2aadd44a34ffd06f01f054fbf7fb34502  http___liangriyou.cn_dk8iz
ab286903628efa6cec7cceaa89f9040ef06171f34239f0aa388d58552041d174  http___librosinculpa.com.ar_l9zbu
1d4e77cbd1a7941965d19bf790e2af072b4afcc753559d1ec12d5685aaa0400d  http___lumimont.cz_svond9
3bf5a8330f4019489dae20e3ae88611ed28e334a3e107b3b38a43a3939dda156  http___majesticimmo.com_ira7a9
02206a1c7f8ad6e2e44966597ae46629b69abb9ffc2df8e544b3266ac3083f18  http___marcelrahner.com_taysisuvd
336779dafd2c54ef9e88d9d989da7396f97ae1af4979cceb6ff942f141297a8e  http___maroeg.com_yl5zdw
51fdb09421cc456c0cef88b2975fcce3572c487037dc4338a7142781f9bb7530  http___mashijiazu.net_fnkbxfozec
43a5abaf41378f1a39d8e467bce01f3b2f087abb34fe07d7b7a9d7ec85904a23  http___melzer-casting.de_unhwqfy2y
e994369aca2415f5d1cfae6faa2169e57f0edf7b4ff267e4bb76840b98e2bc35  http___minmin.in_nixovgx
ed726e732aca2746292128984d9aeef359401d675696e712a6bbf12a298877b1  http___mudrahviezda.sk_vjqcw
3d64e53e7e0849c538c7a6eb75abb50409d7972b23522dd43622e577b2f652ed  http___mujtabatrading.com_e8tldqozh
93d3543004046d063c576b55b21d8cb63b242136c977e616e9fd85789327fba6  http___mybankofgold.com_hs64iyg
70ec2ff034e0c2167f997332f9c2f85d8d8679def66a469c091ee09de09ef6ca  http___reaga.cz_c2wtfht
b76b2360f78979e69f1ce5a0e40389a1aa789de7ea62369f35465c1e276a82cd  http___ruggyhaven.com_bbfqq8ooc1
7fb42b8dc55803ef161a7b7cfdeccba7a2b53f68191c99eaa505de598d1e5d23  http___ruggyhaven.com_iz9dn68
329209df94958b57b774c70fbfe60f1613fbdf13cf873c7af8dd8d2dc45bce7c  http___ruggyhaven.com_qxh6c
b2b1e83991c7f50d975fa848cee05d4cbd0ba7a73f66fd34a52dd7a446baa857  http___ruggyhaven.com_xgkrpgzft
a986d84eee94d902fc5e7540a6d09c8b1783ec6e58a3f4278723e553343c3b90  http___schmidtbauer.at_52euyhofgg
a11a84459c3ec8dca8bcdf37d89492d9f2136f6ff2f3ea6c6ef7e271a987de6a  http___secur.ph_dpjjvj
9b367eb1ef9bf78683bf8413eba02d066c9bb45e6cbf8d24c526b6dc71d42be2  http___smolwow.ru_5ixtjazs
77d43c09d8ce18c23df8ab9e7a75e6adfa2cf46ba5ac0093fef50496fc5d1473  http___structuralstonellc.com_aoenfcu5c
aa1363a69e27129fa35ead12813a54ea300d7b4e916722aaddcce28567284f4a  http___szgoland.net_bdrmzv
799b79263a8f1ef97044c9a29527b006b6ad596ef1935285db6324e3fa663697  http___tdtrading.nl_d3fum2hq
1a139fa3399bf82483e40ebc52f3b7b2a296d93fc3dfd7fc77a6a95742abeabf  http___tybor.hu_6mens1xdqj
d0f530fc62f628365a71befa919bcf375620e329d798df1c5d532c009204c28c  http___uzbakadore.net_ah76ki5g0p
8480541d3bfe59f1f4202de29fb4afcb0f2894f1b5ab3f34a05948f920320640  http___uzbakadore.net_h81mivlzi9
928b8eb50c41de5f2a7d437fcadeb75690890dbdd68f2328697dfdfa0d3beb3a  http___uzbakadore.net_pldwf
4bc85fc5785991acc37cd02546a9aa365926782cf3df4302c5c4045c0112d99a  http___uzbakadore.net_st1rqo6nls
236b104932f38b614c98c22194dd8cc9b59ac3031a5fdbe481a157c6d187d110  http___veinteproducciones.com.ar_ctu8jotsp
1e1897d961c82215b3c141bfc7cee8dcc02290ca3c48b737acb4a87a61a65470  http___wharlslops.net_fwytmemzsj
84a2ec9d47e29c821a46dea14f58250dc3c9456db11de5fc4ed38505c36def0f  http___wharlslops.net_lwzk4zx [3]
5e7e2e39ba7f44b6f0f4fd827f538dd17c214326bd409f1051950c0599459614  http___wharlslops.net_ngohmr
86bc331becd63967fb674534941bd773012e3cc1455a471aea6fabf6749b305c  http___wharlslops.net_pzyh4q5cs
a78e6c03695010d69a38d9ee4a3ddd5d4836eda1941c152fd8188cdfba310c76  http___www.meleather.com_dz1ksu4gr1
- decoded
55db70bc6e18f7e258bc64f55d35b838717e8761f0520ecff2b21cae824202ad [1]
76b2a7d5430fed91821acc53bf90c989307650677a7cf18c39e41e271d3f11ca [2]
1c043c689c5f4027a8f8b2e3a7b6d8e968bdd8ce74f070ccb4d50b48cd8515e8 [3]
1c4b29acfdd2c0f82948662f3378842b9737200f2e24a67e3c7092250c074f1f [4]
- executed by "rundll32.exe %TEMP%\<filename>.TDB,RXIT"

C2:
POST http://185.12.95.92/information.cgi
POST http://213.32.66.16/information.cgi
POST http://85.143.214.58/information.cgi
POST http://btvmgstydik.xyz/information.cgi
POST http://eprfepnufndgvmpih.click/information.cgi
POST http://ijopfgpxhdius.info/information.cgi
POST http://kepotjp.ru/information.cgi
POST http://mhnvkhlbejh.info/information.cgi
POST http://mmhqsciwweest.ru/information.cgi
POST http://oqkyfxemfijb.info/information.cgi
POST http://pdlheaotidrx.org/information.cgi
POST http://uhimwogwgocdc.pw/information.cgi