Oct 10, 2017 Locky Trickbot IOCs

Email random from with 2-4 letters and domain
Subject: Supplement payment <10 digits>
Attachment: "F<10 digits>_11102017.7z"

URIs Locky
accessyouraudience.com/8y6ghhfg
areanuova.it/8y6ghhfg
eurecas.org/8y6ghhfg
georginabringas.com/8y6ghhfg
highpressurewelding.co.uk/8y6ghhfg
jns.co.th/8y6ghhfg
maule.biz/8y6ghhfg
missinglynxsystems.com/8y6ghhfg
old.tuttoggi.info/8y6ghhfg
pdj.co.id/8y6ghhfg
resortphotographics.com/8y6ghhfg
team-bobcat.org/8y6ghhfg
t-plesk.com/8y6ghhfg
vithos.de/8y6ghhfg
wiskundebijles.nu/8y6ghhfg
fetchstats.net/p66/8y6ghhfg

URIs Trickbot
abdulhamit.org/jhbfvg7
bdbl.com.np/jhbfvg7
bnphealthcare.com/jhbfvg7
demopowerindo.com/jhbfvg7
dispjutr.nl/jhbfvg7
globoart.es/jhbfvg7
highlandfamily.org/jhbfvg7
holidaypools.com.au/jhbfvg7
louisawong.net/jhbfvg7
supremocartuchos.com/jhbfvg7
teracom.co.id/jhbfvg7
fetchstats.net/p66/jhbfvg7

Locky MD5: 6cc527a3d3297aa5d175b06b7bb6b27a
https://www.virustotal.com/#/file/15bbdae2a95fb65dd3cbc280bf63fb2e172fd3cf37384f3a0f96c2fd83f905c6/detection

Trickbot MD5: 1a9d91c1a290ec5e36e3fc8ddac60bd5
https://www.virustotal.com/#/file/a1183310a389c528fafd288d574307db2bb9dba7358bae50a08cee4cddaaecf0/detection