Locky asasin IOC's

Locky asasin IOC's

Injects DLL into random exe from c:\windows\system32\

Network:
Scans local net SMB tcp port 445
POSTS http://<site>/<characters>.enc
User-Agent: Windows-Update-Agent

POST /fef44gddd.enc HTTP/1.1
Cache-Control: no-cache
Connection: close
Pragma: no-cache
Content-Type: application/octet-stream
User-Agent: Windows-Update-Agent
Content-Length: 0
Host: hair-select.jp

Mutex types, should match similar pattern:
Global\CaBaEa9aEa2a3aGa1a1aFaGa1aGa2aFa
Local\CaBaEa9aEa2a3aGa1a1aFaGa1aGa2aFa