SHARE
TWEET

2016-11-28 Locky "Insufficient funds"

Racco42 Nov 28th, 2016 (edited) 209 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. 2016-11-28 #locky email phishing campaign "Insufficent funds"
  2.  
  3. Email sample:
  4. ----------------------------------------------------------------------------------------------------------------
  5. From: "Carter Baldwin" <Baldwin.Carter@fast.net.id>
  6. To: [REDACTED]
  7. Subject: Insufficient funds
  8. Date: Tue, 29 Nov 2016 06:35:57 +0700
  9.  
  10. Dear [REDACTED],
  11.  
  12. Your bill payment was rejected due to insufficient funds on your account.
  13.  
  14. Payment details are given in the attachment.
  15.  
  16. Attachment: payment-[REDACTED].zip -> -snk-8220553.js
  17. ----------------------------------------------------------------------------------------------------------------
  18. - sender varies between emails
  19. - subject is "Insufficient funds"
  20. - attached file "payment-<recepient name>.zip" contains file "-snk-<7-10 digits>.js", a JScript downloader
  21.  
  22. Download sites
  23. http://decorvise.com/sqq0k
  24. http://faeryminny.net/8mppw72
  25. http://faeryminny.net/lawyx0iuzi
  26. http://faeryminny.net/lnzadbv
  27. http://faeryminny.net/ptytf6cmb0
  28. http://hotelsheikhpalace.com/ibqw1jm
  29. http://hzxihe.com/hf95jfu9fm
  30. http://icdsarch.com/mfjfge3bmw
  31. http://ifsaiumumi.com/x54y9f
  32. http://imexltd.eu/scbz1mv6nr
  33. http://impobg.eu/fhn5h15
  34. http://invisplast.ru/rc5uqh3le
  35. http://iovel.ro/mr4kj32wx
  36. http://izww.cn/uefdi
  37. http://jaspercn.com/lml6irz3j
  38. http://jellybaby.org.uk/tju8y196
  39. http://jimijunshi.com/quoh7o
  40. http://jjbook.net/hkpka70y
  41. http://jlhack.com/ezdcpdw9yf
  42. http://jltl.net/jovxqn3wjz
  43. http://job0916.cn/tteauk
  44. http://joshcomeauxhair.com/prxm9gz
  45. http://junhao8.com/klttzvqld
  46. http://jurainvestments.com/i6ihhzl03x
  47. http://kabele.ru/wgsscfqti
  48. http://karens.com.au/msd0w6yds
  49. http://kartikakarkam.com/hnrsbnst
  50. http://kemerhaber.net/f2hzbx
  51. http://khatibul-umamwiranu.com/rg1xwd7c
  52. http://klaxcar.ro/pzpvxn
  53. http://kongkhak.go.th/yh8ztc
  54. http://kotofey24.ru/gukdc4ih
  55. http://kovac-trade.com/e78ahlqflm
  56. http://kppngarut.org/pvlb8qav
  57. http://kstm.or.th/zmhztk8d4o
  58. http://kuficflub.com/3wyjpraqd
  59. http://kuficflub.com/8mqemxp
  60. http://kuficflub.com/fnhoi
  61. http://kuficflub.com/qef8yr7
  62. http://kuponik.eu/vyieyqljp
  63. http://leyuego.com/ejxgf1iy
  64. http://liangriyou.cn/dk8iz
  65. http://librosinculpa.com.ar/l9zbu
  66. http://lumimont.cz/svond9
  67. http://lyvyx.com/rnqzzicdq
  68. http://majesticimmo.com/ira7a9
  69. http://marcelrahner.com/taysisuvd
  70. http://maroeg.com/yl5zdw
  71. http://mashijiazu.net/fnkbxfozec
  72. http://mclodesigns.com/n8pinagrs
  73. http://melzer-casting.de/unhwqfy2y
  74. http://minmin.in/nixovgx
  75. http://mudrahviezda.sk/vjqcw
  76. http://mujtabatrading.com/e8tldqozh
  77. http://mybankofgold.com/hs64iyg
  78. http://rcabaj.com.pl/6jk20
  79. http://reaga.cz/c2wtfht
  80. http://ruggyhaven.com/bbfqq8ooc1
  81. http://ruggyhaven.com/iz9dn68
  82. http://ruggyhaven.com/qxh6c
  83. http://ruggyhaven.com/xgkrpgzft
  84. http://safety-speed.ru/biipbsuzk
  85. http://schmidtbauer.at/52euyhofgg
  86. http://secur.ph/dpjjvj
  87. http://smolwow.ru/5ixtjazs
  88. http://structuralstonellc.com/aoenfcu5c
  89. http://szgoland.net/bdrmzv
  90. http://tdtrading.nl/d3fum2hq
  91. http://tybor.hu/6mens1xdqj
  92. http://uzbakadore.net/ah76ki5g0p
  93. http://uzbakadore.net/h81mivlzi9
  94. http://uzbakadore.net/pldwf
  95. http://uzbakadore.net/st1rqo6nls
  96. http://veinteproducciones.com.ar/ctu8jotsp
  97. http://wharlslops.net/fwytmemzsj
  98. http://wharlslops.net/lwzk4zx
  99. http://wharlslops.net/ngohmr
  100. http://wharlslops.net/pzyh4q5cs
  101. http://www.meleather.com/dz1ksu4gr1
  102.  
  103. Malware:
  104. - encoded on download
  105. f1f691a1cbaa0c3d7f31bb12a277627bc38c8f82f9ec972a7cb803204171f6e1  http___faeryminny.net_8mppw72
  106. 375ffcb8ffebec177afbbf80004b31643a819c15eb97b39bd54acb15466cb049  http___faeryminny.net_lawyx0iuzi
  107. 3e5ec83fb9273aa86b550df704b2b841e355a6d60bd905c34288e5e1237bbeb2  http___faeryminny.net_lnzadbv
  108. fc9cb54ca5715e9bcfcca8d2c5199d3362fd3fb44b43734cc71947435f3ce81a  http___faeryminny.net_ptytf6cmb0
  109. 0c4da63ccc3d21edb66108128124ac244f4fa813614141e1a176061c05b8a310  http___hotelsheikhpalace.com_ibqw1jm
  110. 3209ec768086217280fbe28faa95e6687a03f20db1e8e0d9feaf3eee91d9363e  http___hzxihe.com_hf95jfu9fm
  111. e0c7186a2cdcb5511ed8ab94424150081c8643e924888441e4fcef9c3e9817b5  http___icdsarch.com_mfjfge3bmw
  112. c4286b8966a82d6d4ab37eedb9f94f461652bd09e5a1b4209089838535ad3fce  http___ifsaiumumi.com_x54y9f
  113. efb8ddd0851cee8fd66e848aebbc06917fc2f804a950c42bca03b08c83f74d5e  http___imexltd.eu_scbz1mv6nr
  114. 8b3284aedb309fa2f828d721cfcd3ca7d8dabde099335959989ef887aa6602e1  http___impobg.eu_fhn5h15
  115. e0cad60366887422e881322726bf69a07e75519d33627bbd729ff00a476ab944  http___invisplast.ru_rc5uqh3le
  116. a4b65d21cf0a48316ce43c8fda9f5c7f35dbd76c5586e18a3fff6cf2f4f99f9d  http___iovel.ro_mr4kj32wx
  117. 7a4b3f78041d20aefeb163e45b5a08797cfbfe4b5da75494b13f1de25ca692c3  http___izww.cn_uefdi
  118. e8f4dc18dceae9637cde2e30fca64a03eb42f3f80e9d3918ce6fa6ad9bd7b765  http___jaspercn.com_lml6irz3j
  119. 6d09a817bdd624a6e6c26db4a33dd3139ad934fabac13694e4eb725b70569058  http___jellybaby.org.uk_tju8y196
  120. b05ef45b12d89b3327438eab494bbad413dfa4f4815ac1c9c607bca325e78f42  http___jimijunshi.com_quoh7o
  121. 0eac0a8dd542abf976afe7431778eb70f7ae97502183cb992cfb9bbb0acb6c9b  http___jjbook.net_hkpka70y
  122. e9531608c12aad92d909bfbe1f4378f7cd833bc876cd57353729f4bbcdf20ccc  http___jlhack.com_ezdcpdw9yf
  123. 40990af56e89f07208df1bf8852465499f805acfb6c0e1bb4061f66aaaffd2b3  http___jltl.net_jovxqn3wjz
  124. 89006506e85d8ae111c017edc36e97d95deeed712464680737875ac6a2ccef5d  http___job0916.cn_tteauk
  125. 0febcda65ce97fb0542fa82cdb62d030e038c64621fbf7519dcf866d4268f8fd  http___junhao8.com_klttzvqld
  126. 44586ab4bf9df59eab890bf713feb7a7a846195617c41c60c9100a086511bdae  http___jurainvestments.com_i6ihhzl03x
  127. 9fb3e2a802510c89640a24e12fb31b7920bb072403647a831a68a2dc77a0abc9  http___karens.com.au_msd0w6yds
  128. 9401c8d8767e183581c1d5b4b3879159509a9ac8755c41f88d9277c629a93151  http___kemerhaber.net_f2hzbx
  129. e44cbffafd7d8e1a2359fa417a183a0d8cddac94552bf7bd2a47535fede1a1ec  http___khatibul-umamwiranu.com_rg1xwd7c
  130. 07b82db971d7178ee56f500f6310e2dd0ca5c10399729bcc723411dcb69b36e4  http___kongkhak.go.th_yh8ztc [1]
  131. 021c62096a0aa5420f825f76d96a43bb48e09f489d036e59b892ece87ea56081  http___kovac-trade.com_e78ahlqflm
  132. 23123cc964f7d9ddbe50f934c4a9494643dc47613c7a01b3066b356cad8de652  http___kppngarut.org_pvlb8qav
  133. 1c5a6cd93427a1d4f05e1baaa1f5fe203dc9e566eb54a7caff18fab8883ccb0e  http___kstm.or.th_zmhztk8d4o
  134. 1c3e813626ffcf78ad920fcc4d7230f64a57345ed0f1a48af9d84f24b0078d18  http___kuficflub.com_3wyjpraqd
  135. bddb2c96eadd395dc1065b9b396f839ca647daddd6f7c4fb445631912e2ea934  http___kuficflub.com_8mqemxp
  136. 704992d60366d290ca5bfe56c72f353c160ba60e3f14297dcb53907b3c82335d  http___kuficflub.com_fnhoi [4]
  137. 00b17ac8a4cde8cc648184a10e0718c88fae772114cb289cc47ab186182e4aed  http___kuficflub.com_qef8yr7
  138. 62c4f23e23efbfcbf1f57556d5f049cf3585ec45268a09f80a9410427dc91f15  http___kuponik.eu_vyieyqljp [2]
  139. c844f1c98de92513a9fccaf0de44e626a0d077e1ba3385a017946d7458486642  http___leyuego.com_ejxgf1iy
  140. 35391920ec8dcee59a6d0bb052745ee2aadd44a34ffd06f01f054fbf7fb34502  http___liangriyou.cn_dk8iz
  141. ab286903628efa6cec7cceaa89f9040ef06171f34239f0aa388d58552041d174  http___librosinculpa.com.ar_l9zbu
  142. 1d4e77cbd1a7941965d19bf790e2af072b4afcc753559d1ec12d5685aaa0400d  http___lumimont.cz_svond9
  143. 3bf5a8330f4019489dae20e3ae88611ed28e334a3e107b3b38a43a3939dda156  http___majesticimmo.com_ira7a9
  144. 02206a1c7f8ad6e2e44966597ae46629b69abb9ffc2df8e544b3266ac3083f18  http___marcelrahner.com_taysisuvd
  145. 336779dafd2c54ef9e88d9d989da7396f97ae1af4979cceb6ff942f141297a8e  http___maroeg.com_yl5zdw
  146. 51fdb09421cc456c0cef88b2975fcce3572c487037dc4338a7142781f9bb7530  http___mashijiazu.net_fnkbxfozec
  147. 43a5abaf41378f1a39d8e467bce01f3b2f087abb34fe07d7b7a9d7ec85904a23  http___melzer-casting.de_unhwqfy2y
  148. e994369aca2415f5d1cfae6faa2169e57f0edf7b4ff267e4bb76840b98e2bc35  http___minmin.in_nixovgx
  149. ed726e732aca2746292128984d9aeef359401d675696e712a6bbf12a298877b1  http___mudrahviezda.sk_vjqcw
  150. 3d64e53e7e0849c538c7a6eb75abb50409d7972b23522dd43622e577b2f652ed  http___mujtabatrading.com_e8tldqozh
  151. 93d3543004046d063c576b55b21d8cb63b242136c977e616e9fd85789327fba6  http___mybankofgold.com_hs64iyg
  152. 70ec2ff034e0c2167f997332f9c2f85d8d8679def66a469c091ee09de09ef6ca  http___reaga.cz_c2wtfht
  153. b76b2360f78979e69f1ce5a0e40389a1aa789de7ea62369f35465c1e276a82cd  http___ruggyhaven.com_bbfqq8ooc1
  154. 7fb42b8dc55803ef161a7b7cfdeccba7a2b53f68191c99eaa505de598d1e5d23  http___ruggyhaven.com_iz9dn68
  155. 329209df94958b57b774c70fbfe60f1613fbdf13cf873c7af8dd8d2dc45bce7c  http___ruggyhaven.com_qxh6c
  156. b2b1e83991c7f50d975fa848cee05d4cbd0ba7a73f66fd34a52dd7a446baa857  http___ruggyhaven.com_xgkrpgzft
  157. a986d84eee94d902fc5e7540a6d09c8b1783ec6e58a3f4278723e553343c3b90  http___schmidtbauer.at_52euyhofgg
  158. a11a84459c3ec8dca8bcdf37d89492d9f2136f6ff2f3ea6c6ef7e271a987de6a  http___secur.ph_dpjjvj
  159. 9b367eb1ef9bf78683bf8413eba02d066c9bb45e6cbf8d24c526b6dc71d42be2  http___smolwow.ru_5ixtjazs
  160. 77d43c09d8ce18c23df8ab9e7a75e6adfa2cf46ba5ac0093fef50496fc5d1473  http___structuralstonellc.com_aoenfcu5c
  161. aa1363a69e27129fa35ead12813a54ea300d7b4e916722aaddcce28567284f4a  http___szgoland.net_bdrmzv
  162. 799b79263a8f1ef97044c9a29527b006b6ad596ef1935285db6324e3fa663697  http___tdtrading.nl_d3fum2hq
  163. 1a139fa3399bf82483e40ebc52f3b7b2a296d93fc3dfd7fc77a6a95742abeabf  http___tybor.hu_6mens1xdqj
  164. d0f530fc62f628365a71befa919bcf375620e329d798df1c5d532c009204c28c  http___uzbakadore.net_ah76ki5g0p
  165. 8480541d3bfe59f1f4202de29fb4afcb0f2894f1b5ab3f34a05948f920320640  http___uzbakadore.net_h81mivlzi9
  166. 928b8eb50c41de5f2a7d437fcadeb75690890dbdd68f2328697dfdfa0d3beb3a  http___uzbakadore.net_pldwf
  167. 4bc85fc5785991acc37cd02546a9aa365926782cf3df4302c5c4045c0112d99a  http___uzbakadore.net_st1rqo6nls
  168. 236b104932f38b614c98c22194dd8cc9b59ac3031a5fdbe481a157c6d187d110  http___veinteproducciones.com.ar_ctu8jotsp
  169. 1e1897d961c82215b3c141bfc7cee8dcc02290ca3c48b737acb4a87a61a65470  http___wharlslops.net_fwytmemzsj
  170. 84a2ec9d47e29c821a46dea14f58250dc3c9456db11de5fc4ed38505c36def0f  http___wharlslops.net_lwzk4zx [3]
  171. 5e7e2e39ba7f44b6f0f4fd827f538dd17c214326bd409f1051950c0599459614  http___wharlslops.net_ngohmr
  172. 86bc331becd63967fb674534941bd773012e3cc1455a471aea6fabf6749b305c  http___wharlslops.net_pzyh4q5cs
  173. a78e6c03695010d69a38d9ee4a3ddd5d4836eda1941c152fd8188cdfba310c76  http___www.meleather.com_dz1ksu4gr1
  174. - decoded
  175. 55db70bc6e18f7e258bc64f55d35b838717e8761f0520ecff2b21cae824202ad [1]
  176. 76b2a7d5430fed91821acc53bf90c989307650677a7cf18c39e41e271d3f11ca [2]
  177. 1c043c689c5f4027a8f8b2e3a7b6d8e968bdd8ce74f070ccb4d50b48cd8515e8 [3]
  178. 1c4b29acfdd2c0f82948662f3378842b9737200f2e24a67e3c7092250c074f1f [4]
  179. - executed by "rundll32.exe %TEMP%\<filename>.TDB,RXIT"
  180.  
  181. C2:
  182. POST http://185.12.95.92/information.cgi
  183. POST http://213.32.66.16/information.cgi
  184. POST http://85.143.214.58/information.cgi
  185. POST http://btvmgstydik.xyz/information.cgi
  186. POST http://eprfepnufndgvmpih.click/information.cgi
  187. POST http://ijopfgpxhdius.info/information.cgi
  188. POST http://kepotjp.ru/information.cgi
  189. POST http://mhnvkhlbejh.info/information.cgi
  190. POST http://mmhqsciwweest.ru/information.cgi
  191. POST http://oqkyfxemfijb.info/information.cgi
  192. POST http://pdlheaotidrx.org/information.cgi
  193. POST http://uhimwogwgocdc.pw/information.cgi
RAW Paste Data
Top