Locky "updated details"

2016-07-27 #locky email phishing campaign "updated details"

Email sample:
-------------------------------------------------------------------------------------------------
From: "Cyrus Pitts"
To: [REDACTED]
Subject: updated details

Dear [REDACTED]
Attached is the updated details about the company account you needed</p>

King regards
Cyrus Pitts
00a24d50bcba3f796f483699b61785031b19fcbc7160ae6d
-------------------------------------------------------------------------------------------------
Attachment: <random hexa number>.zip

Attachment contains company account -XXX-..wsf file that contains JScript donwloader donwloading 2nd stage from:

http://217.64.197.138/~rivista_ipi/4kkmkfz
http://98.131.20.17/q11ci7g
http://ares.net/vnsk2o
http://baer-afc2.homepage.t-online.de/80gb9
http://beauty-jasmine.ru/6dc2y
http://bolloevcenter.ru/tfltg
http://btgnj.com/m40jy
http://btkdevelopment.ru/x2cgny
http://btkdev.lgg.ru/ynsr7at
http://clinic.gov.ua/lvzceu0
http://cmt.ro/b4x5f
http://darkhollowcoffee.com/5yppf0xu
http://dataprim.fr/73ru9l
http://deangelis.co.uk/nxoiuta4
http://download.arpcc.ro/k70bh
http://dub3tv.com/x9lh2
http://enlas.50webs.com/cn56bv
http://erkenne-mich-selbst.de/352oxk
http://fitnesclub.ru/sh54g8z
http://francescoeillupo.magix.net/8g76w
http://hdajaeger.homepage.t-online.de/8z961e
http://hdjung.homepage.t-online.de/0ipttu8w
http://hoosiernetwork.com/oy0hj
http://hotstreams.ru/sam9xqp0
http://ingstroymash.ru/w7zd1q
http://jupp4u.de/~transfer/dd5y4g
http://karinschacht.addr.com/d5utl
http://marchandedidees.fr/nqwx2y
http://maruyoshipap.web.fc2.com/2hvt7
http://mbctrans.3x.ro/ghlx5k
http://modband.com/npu8xr
http://oavb.com/ojjtbz2
http://olgastudio.ro/ufq3ex17
http://s1prod-ams.ho.ua/c6vt8s
http://snetwork.web.fc2.com/24dxbkw
http://takemaruko.web.fc2.com/29t1j
http://testkondostone.web.fc2.com/5scb1m2c
http://theworldforce.de/iit64l0
http://ukrasnogomosta.ru/prfyvy
http://www.adafor.com/glzlpw7u
http://www.compland.ee/9mvezxdy
http://www.dogsandtails.be/3tpp9
http://www.frosinonewesternshow.it/b16pu4
http://www.leonardoveronesi.com/aqbu8
http://www.prometsrl.org/9phnw
http://www.sjones.talktalk.net/94n49
http://www.svenkneipp.de/0pdtfr
http://www.tangoshow.it/lu6dksot
http://www.tipografiacouto.pt/36qvth
http://www.wellness-com.de/1jm8mpa
http://zarabotaina.yomu.ru/xnusv
http://zarabotat.yomu.ru/t8rde7b1
http://zobov.org.ua/ibei9t

2nd stage is encrypted when downloaded
61e354b25662564ce1f8012443c0d8fe4bd3aa13edcfe2098a0ca940ad122226  http___217.64.197.138_~rivista_ipi_4kkmkfz
3ec09c5253569060a9a7b50d3ebeafd0e1e749b667d2ea6ac19d293c88e98cca  http___98.131.20.17_q11ci7g
f8d8875bbc68f102b25d7b45dfa2b2da9647a216f405b91d65c6ea1614538080  http___ares.net_vnsk2o
a38592e470615ec61dcdf4874448a5ab7c2399ca50fe31841793d935a57f291d  http___baer-afc2.homepage.t-online.de_80gb9
271e04630b05c6e926c55fcae86c3e2319adc22e5c5f3aa6867266bafdf35e67  http___beauty-jasmine.ru_6dc2y
9f42cd1212a49e3b47e8e83776bbbc86ad4b6bd0791e95d4428e66b160663aa7  http___bolloevcenter.ru_tfltg
fbd00b3dadb7f03f72160ef6073f377a134f8d029b28845bd457f177aaeb93e0  http___btgnj.com_m40jy
d4fd6575767aa4901f8f62fd491e37a3576c41fcc47599b7c32b5949ffd6d85f  http___btkdevelopment.ru_x2cgny
099745d15a893075bb526757eee792842679f96076112011094fd4b0f9dc5447  http___btkdev.lgg.ru_ynsr7at
28ee39f8558643f243df42794b3fae47a951ac09e19cadd19f7b9a6017bbed38  http___clinic.gov.ua_lvzceu0
aa0563699de2413fa2e9702e43694157cb197ecad51525eb42dde08d93eb1eeb  http___deangelis.co.uk_nxoiuta4
1cc50a57ac40c3ca0480ee385458d05c5702b650c351fba8ad0e5b6c764ac9b6  http___download.arpcc.ro_k70bh
bcc70d9608f4e4f475d766c1243894f0724608cf20beb3eeec4705bba55e4fdc  http___dub3tv.com_x9lh2
1daf9cb39a848b47d36434c6928bbf98456e830913dbdc33a0a347d3b322a052  http___enlas.50webs.com_cn56bv
574a0cd2415d2ebc61e3f61e3b063ef4294e1b09eb453d0fde2af8d7d1e66e61  http___erkenne-mich-selbst.de_352oxk
e42d44a6f5185c28481405a1f22ea8c0e5bce67c9da23ab4b7eb287036845b3a  http___fitnesclub.ru_sh54g8z
e3f84ece2ff70d078bbef5e07dfa4e5e2a3b26746bebbc4d71c8a6f1acd958a1  http___francescoeillupo.magix.net_8g76w
ab184edfd813274a3c1b88a5c0bfc8c23bfe962f542cf83c84dd7758e3a53244  http___hdajaeger.homepage.t-online.de_8z961e
dd966b1603ac0d65a60747fce1b1c4bc27ce4550bbc5ec9f317c95fe23257a01  http___hdjung.homepage.t-online.de_0ipttu8w
fffcfcfc334a9f6d1c8f2134beb255a922c9a4f9f931572dceb8670120facc79  http___hoosiernetwork.com_oy0hj
b6292aba77754a4ff265eab156c0ab2d63b030062c17edac0c0c664091c2cb4e  http___hotstreams.ru_sam9xqp0
dcb0171655f4834ea4fcb239887fed661f49d3dbae7c439a3558a665bbbf0896  http___ingstroymash.ru_w7zd1q
a24d3e556ab1afa2c3a09dad3344dfda7dd6613e13195daeacb3ae569b748db0  http___jupp4u.de_~transfer_dd5y4g
dc44160357991568ff7eb4c87b83502a208137c9da31604c9965740563fb6098  http___karinschacht.addr.com_d5utl
3239b025d3f9c4ad6b37bc8e732029bc428d0b80805a6728f82a8ca509c0a416  http___marchandedidees.fr_nqwx2y
807b79321df47e689acbd85a2b47ad4b9c4828778bd5e234ef3634014b7c436a  http___maruyoshipap.web.fc2.com_2hvt7
a5ab3d752fd874824ca34563d64aed88c6fb79b4b692e8dde9c78b63f19c7c61  http___mbctrans.3x.ro_ghlx5k
8419026556753496876ccc42388872859f5a7eec264c0154b6c0da0ee0aaa98a  http___modband.com_npu8xr
86b9424ef22dd9594f1fcfe069260c1e11d7184d6eacfccb755606f7b4497d99  http___oavb.com_ojjtbz2
6595f73cb66b06362936bbf69c005bcd06575cde7be4c6fb2ebce9f920577ea1  http___olgastudio.ro_ufq3ex17
04d51bb79fed2d80888283caf7c5daaea73472e87c51b1c85f5a364f9f429f5e  http___s1prod-ams.ho.ua_c6vt8s
89c307e7904ab8951b6ac6bf4a1e7130a8487ec261ff5fbc8dfa511ac5d97e9e  http___snetwork.web.fc2.com_24dxbkw
ce81eb93463a9feb431fdff4ad113669edb74a6d36f589649a184d9e62a79212  http___takemaruko.web.fc2.com_29t1j
58b35eb6d89a443814da48d31caba4a31e00066229fdfae53d27581dc73ab925  http___testkondostone.web.fc2.com_5scb1m2c
5ac39efb5559e43a07e0b22cb2973d06247dd058afe0a336e22d9bfebdc08849  http___theworldforce.de_iit64l0
9d48271d2713af3d578827a0d386d3bc5bfa1b60e7d41c2092a22c1fc05a8d1d  http___ukrasnogomosta.ru_prfyvy
d8a515ee055f954aeaef872ef20af23e1d97eaec4434b19b393b9c01501da825  http___www.adafor.com_glzlpw7u
944d3927bb5253578ea4988f9a49fe90d2666763f97317a2ff79753191812a2c  http___www.compland.ee_9mvezxdy
432ab3b5e6b0fc0ae534e7655db79ef813dd3cc53a257cc5486d107fe7ec1e4a  http___www.dogsandtails.be_3tpp9
f82bdbef4770aca64627140aa74ac8132328d82b1b1cb286932c13a6645a5793  http___www.frosinonewesternshow.it_b16pu4
ce1c4018c3490278722157d7f49b18e28b4b7f8d2d466e1e9f82f9fbdc13e41e  http___www.leonardoveronesi.com_aqbu8
78d3422a94687be2ef4fd41a39923f6887698191d7fe98f5313a041e196b324f  http___www.prometsrl.org_9phnw
39ea8926fea046bec41914e83871599e97a41fbb6cd51431f70da2d62523559d  http___www.sjones.talktalk.net_94n49
873559f41e596d0a1d084a25a2911caae992d146856cd86818499973df9cc4bc  http___www.svenkneipp.de_0pdtfr
6c9282a3dd9e3e1788e322a811b2c856b219cc788a13742dc72751b88cd317ae  http___www.tangoshow.it_lu6dksot
92c317c09e86d9d15e8b5c75fe16445e1a20b2e8797ff918f3dd4c3c503716eb  http___www.tipografiacouto.pt_36qvth
174a2371a45f24b0455f47b5c340e2c26f5a616c73f4492d1ced98103023bed7  http___www.wellness-com.de_1jm8mpa
9796732b390a41930573532617ff4a80dc616eda7b0f989351279ac89a049110  http___zarabotaina.yomu.ru_xnusv
c8d3d65c78a623ba8936aebe1ca9109f584fe8c5ec8559e4d09ab2bcd46f70a3  http___zarabotat.yomu.ru_t8rde7b1