2016-10-24 Locky "Receipt"

2016-10-24 #locky email phishing campaing "Receipt"

Email sample:
------------------------------------------------------------------------------------------------------------------
From: <[email protected]>
To: [REDACTED]
Subject: Receipt 82-253
Date: Mon, 24 Oct 2016 13:58:18 +0300

Attached: Receipt 82-253.zip
------------------------------------------------------------------------------------------------------------------
- sender varies, but seems always come from @gmail.com
- subject is "Receipt <numbers>-<numbers>
- email body is empty
- attached file "Receipt <numbers>-<numbers>.zip" contains file "Receipt <numbers>-<numbers>.hta" or "Receipt <numbers>-<numbers>.wsf", a JScript downloader

Dowload sites (actual URLs contain suffix ?<random>=<random> which does not influence the download):
http://103.15.50.73/076wc
http://117.239.70.228/076wc
http://3ainstrument.com/076wc
http://absxpintranet.in/076wc
http://abulhoul.ae/076wc
http://acanac.wysework.com/076wc
http://aiahelps.com/076wc
http://asadraza.ca/076wc
http://autorijschoolpedro.nl/076wc
http://bagnet.ir/076wc
http://belovephoto.com/076wc
http://beyondhorizon.net/076wc
http://castoncorporateadvisory.in/076wc
http://checkimage.comuf.com/076wc
http://cignitech.com/076wc
http://cygnatech.com/076wc
http://cynosurejobs.net/076wc
http://demoinfolink.com/076wc
http://dolphinom.com/076wc
http://ebuddesign.com/076wc
http://grupoecointerpreis.com/076wc
http://ibitol.com/076wc
http://icclicks.com/076wc
http://jhandiecohut.com/076wc
http://ledenergythai.com/076wc
http://logcabins4less.ie/076wc
http://mynamepixs.com/076wc
http://naacllc.com/076wc
http://nanrangy.net/076wc
http://olpharm.com/076wc
http://punjabipollywood.com/076wc
http://ratchadaphoto.com/076wc
http://somindia.in/076wc
http://sowkinah.com/076wc
http://stock.comuf.com/076wc
http://thaitooling.net/076wc
http://tifa-awards.net/076wc
http://wamasoftware.com/076wc
http://www.jhandiecohut.com/076wc
http://www.pspgemencheh.edu.my/076wc
http://www.pspmrsmag.com/076wc
http://www.pspmrsmtumpat.com/076wc
http://www.rawahyl.com/076wc

Malware
- encoded on download, SHA256 8e136039b9a7960d8bd2f330a0438ddeeec921ac4c4017943431ad7cc8c3c009, filesize 278528 bytes
- .hta samples (none of below .hta detonated properly in HA)
https://www.reverse.it/sample/b50722efad89b83b58e21a423d0d2f304f9088c44a827fa334394f7fc55da1ae?environmentId=100
https://www.reverse.it/sample/0fae0d66d3df6cdf8ab777d2df6b7ddc07f917d3d89040947d48d3ef7271b699?environmentId=100
https://www.reverse.it/sample/4d3785566d3c14effac378df27b3969347e33d2874ac0d69668bba67b8b69461?environmentId=100
https://www.reverse.it/sample/f43df8dd23286253212395226000d2644e35a5492148584d03035eaf36387a0e?environmentId=100
https://www.reverse.it/sample/9a2e1568f4dc9cb438966a5f37b647c2ff9da02df5f00be8dc62eb8a2f5aa286?environmentId=100
https://www.reverse.it/sample/8bea47196313b6614c70bd05bb144e2bf4303cd84272541936456709ab5305d7?environmentId=100
https://www.reverse.it/sample/1eda9a35b01200de8a450ac2fdef47860ce4e5b17ea5267a0403c386e0b37b78?environmentId=100
https://www.reverse.it/sample/54dfc00cd5d18542018f004ec0108cb1388f677f5083bb22df11496dc1e81a45?environmentId=100
https://www.reverse.it/sample/d8bbd5091053a2b9c68dda3ad3d31af3cca83b15270f3bf4a5448d56b07acc03?environmentId=100
https://www.reverse.it/sample/d8bbd5091053a2b9c68dda3ad3d31af3cca83b15270f3bf4a5448d56b07acc03?environmentId=100
https://www.reverse.it/sample/4320aece2cb0e8cc3a4ab86b7a90acf24332bd754c8af0fbf7cc98b86e8a4fda?environmentId=100
https://www.reverse.it/sample/4320aece2cb0e8cc3a4ab86b7a90acf24332bd754c8af0fbf7cc98b86e8a4fda?environmentId=100
https://www.reverse.it/sample/8bea47196313b6614c70bd05bb144e2bf4303cd84272541936456709ab5305d7?environmentId=100
https://www.reverse.it/sample/1d5253eb2deffbe4c6ecfb9fc327a19b986187d20db6877afb5fb8aea5ebe640?environmentId=100
https://www.reverse.it/sample/364a64ab5bb245742e037746c0b5e510afb05db7943beddcf9048f5309336a7a?environmentId=100
https://www.reverse.it/sample/215731a8140773e951875481d66a18460ed73c4fba9dab612ba1b8bf3a8b160e?environmentId=100
https://www.reverse.it/sample/dd614b793c53af86563d9ccd3b88dfddce9c6c0b833d4ca23e62b614ece85956?environmentId=100
https://www.reverse.it/sample/0a377894798ec2626cbce2fdf5aa3fb70be858d6a811db89874677149e12b3b0?environmentId=100
- .wsf samples
https://www.reverse.it/sample/0290c45f7ac157c6cd0c559922baf8b6ac4822f48baa91bfdf151dd0a7f3b7fd?environmentId=100
https://www.reverse.it/sample/67693ed36225f568d3b514252ff7436f5d49d7aa4c1f7cd43b0e2f742a087b73?environmentId=100
https://www.reverse.it/sample/c229ae28a284eea23dfc2756b8e7a269985de651a7fad6e64a0e0cd3721040d4?environmentId=100
https://www.reverse.it/sample/1c2c1bd9e9d4583823f27ba8a02723903db13adf8fdd142c912c14737ce04467?environmentId=100

C2:
POST 185.102.136.77:80/linuxsucks.php
POST 109.234.35.215:80/linuxsucks.php
POST 91.200.14.124:80/linuxsucks.php
POST bwcfinnt.work:80/linuxsucks.php [208.100.26.234]
POST fqtdrnqmeofknd.biz:80/linuxsucks.php [69.195.129.70]