Locky IOCs summer 2016

IOCs Locky wave 25/07/2016
--------------------------

Payload domain:
hxxp://0urkarachi.atspace.com/7h8gbiuomp
hxxp://cantrell.biz/7h8gbiuomp
hxxp://czemarserwis.home.pl/7h8gbiuomp
hxxp://exploromania4x4club.ro/7h8gbiuomp
hxxp://finaledithon.web.fc2.com/7h8gbiuomp
hxxp://koushuen.co.jp/7h8gbiuomp
hxxp://moehakiba.web.fc2.com/7h8gbiuomp
hxxp://ostseeurlaub-tk.homepage.t-online.de/7h8gbiuomp
hxxp://topmanagers.claas.fr/7h8gbiuomp
hxxp://tutomogiya.web.fc2.com/7h8gbiuomp
hxxp://vplegat.dk/7h8gbiuomp
hxxp://www.aproso.de/7h8gbiuomp
hxxp://www.isleofwightcomputerrepairs.talktalk.net/7h8gbiuomp
hxxp://www.louislechien.net/7h8gbiuomp
hxxp://www.motoslittetrecime.com/7h8gbiuomp
hxxp://www.sistronic.com.co/7h8gbiuomp
hxxp://www.tridi.be/7h8gbiuomp
hxxp://www.vakantiehuisjeameland.nl/7h8gbiuomp
hxxp://www.westline.it/7h8gbiuomp
hxxp://zemlya.web.fc2.com/7h8gbiuomp

dropper hash:
80f92545ebc520ce98b242334ef5d9d5b1e2217f575bbbd5cbde513d80b005fb
dcf7b1dd3e2cc3e152da642b9a3aacc64d218cd035ccabaaddc45cb2b8bcd557
435a1f36c620e31bd941df628522103e65676a1386cff42bce0afc21b3cabadb
93ff747b4739d86561d565319bbf44910fdd6a1bd0c4dfe402aa33a594f0311c

payload hash:
35a9ffbbe20f8d4ed483916e15052df53714b7d5fb57fa0326cd0b138c4b73a6
3d8c754b6620c68d7c5f2bfe69a609282fc595220d7203fdaf30a9582e2882f6
5085ef567d97508e3ab3cff03580bb754994c1506cb18a63d93505a6bcb1d14e


IOCs Locky wave 15/08/2016
--------------------------

Payload domain:
hxxp://devierdemuur.50webs.com/HJ6bhGHV
hxxp://kittoyakudatu.web.fc2.com/HJ6bhGHV
hxxp://marcinha.50webs.com/HJ6bhGHV
hxxp://marimo1963430.web.fc2.com/HJ6bhGHV
hxxp://mondialmt2.hi2.ro/HJ6bhGHV
hxxp://orquestracaravan.com/HJ6bhGHV
hxxp://paljyon7.fuma-kotaro.com/HJ6bhGHV
hxxp://rondoncompany.bake-neko.net/HJ6bhGHV
hxxp://soluciones.web.fc2.com/HJ6bhGHV
hxxp://topfireart.com/HJ6bhGHV
hxxp://turiblo.atspace.com/HJ6bhGHV
hxxp://www.anticarredodolomiti.com/HJ6bhGHV
hxxp://www.asilonido-opla.org/HJ6bhGHV
hxxp://www.attivita-antroposofiche-roma.org/HJ6bhGHV
hxxp://www.bozenan.swk.vectranet.pl/HJ6bhGHV
hxxp://www.carrosserie-promocar.net/HJ6bhGHV
hxxp://www.couluc.net/HJ6bhGHV
hxxp://www.cuevas703.jazztel.es/HJ6bhGHV
hxxp://www.dbv-winterthur.homepage.t-online.de/HJ6bhGHV
hxxp://www.lancerortho.com/HJ6bhGHV
hxxp://www.pescatoridelpontile.it/HJ6bhGHV
hxxp://www.reniero.org/HJ6bhGHV
hxxp://www.scoutvda.it/HJ6bhGHV
hxxp://www.tecnohellas.gr/HJ6bhGHV
hxxp://www.vinyljazzrecords.com/HJ6bhGHV
hxxp://xn--kukuk-gstrow-jlb.de/HJ6bhGHV

dropper hash:
8b2a1d01db7df5bd9aa26da7c53364f47c6cb94177a2a2b4ee760d268eaf4efb
bc8126e7a0676afd030b059a572dadf65df8a9d5390e3e4adf2ffe9fafcc4c5b
1d05c5b21eb46c1cd6a717c79c8296b78dbdef7997f0ab10ba5d0761ec5e1d15
5119117e9033023d9e49bdff6d32e7c59143202897e98784a9c12a1c5085a57b

payload hash:
02469222c9895fcbdcbe8264fadfbd8150d649a08e42ea2c476b6a33203e21c5
945936b46faed93f1aadfa9894ece1d06f86033048c5fc07f73fbe1f23a40fe0


IOCs Locky wave 16/08/2016
--------------------------

Payload domain:
hxxp://chokomilk.client.jp/nJHbj0266b
hxxp://macdtoha.web.fc2.com/nJHbj0266b
hxxp://ermt.ikidane.com/nJHbj0266b
hxxp://www.lalineasottile.it/nJHbj0266b
hxxp://www.gcs-crostolo.it/nJHbj0266b
hxxp://fereastrazmeilor.go.ro/nJHbj0266b
hxxp://www.olze.info/nJHbj0266b
hxxp://zarexbytonia.cba.pl/nJHbj0266b
hxxp://franzi66.50webs.com/nJHbj0266b
hxxp://stage.diabetes.bayer.in/nJHbj0266b
hxxp://www.enola.it/nJHbj0266b
hxxp://gury.com.br/nJHbj0266b
hxxp://hoshiomi.yu-nagi.com/nJHbj0266b
hxxp://www.mediatoponline.it/nJHbj0266b
hxxp://manutencao-de-celulares.com.br/nJHbj0266b
hxxp://soma-holidays.co.uk/nJHbj0266b
hxxp://testtameshi2009.web.fc2.com/nJHbj0266b
hxxp://www.aerautomazione.it/nJHbj0266b
hxxp://www.claroviento.it/nJHbj0266b
hxxp://www.ferienhaus-mesa.at/nJHbj0266b
hxxp://www.greatidea.de/nJHbj0266b
hxxp://ambulancesite.nl/nJHbj0266b
hxxp://www.gianlucaboezio.it/nJHbj0266b
hxxp://www.lefaos.50webs.com/nJHbj0266b
hxxp://videoakama.web.fc2.com/nJHbj0266b

dropper hash:
1ea2fb33034a93fce3d93fcd7c325e5c74b3b2fb4d99ac55ab9374029da232cf
adda797a54b4402048b9d9de71a3def1ca44beeb1472bed7a11a48fb0e0c8e2e

payload hash:
73e6aa1f6f62fa8b28f8bf2f55fb94983edad0968b6b4e5775e4aa2e21e7aafb