Locky "Commission"

2016-08-29 #locky emai; phishing campaign "Commission"

Email Sample (sender address varies between messages):
-------------------------------------------------------------------------------------------------------------
From: "Rickie Cortez"
To: [REDACTED]
Subject: Commission

Good morning bIFWbumQz,

Here is the excel file of the commission you earned last month. Please analyze
the attachment to confirm the amount.


Regards,
Rickie Cortez
-------------------------------------------------------------------------------------------------------------
Attachment: [Random hexachars].zip, containing file "commission_xls (~[random hexachars]).js", a JScript downloader

Download sites:
http://209.237.142.197/~p27j55uk/von90s
http://69.61.11.216/fdmzmq
http://abcbureautique.abc.perso.neuf.fr/8j3y0
http://ach-dziennik.cba.pl/kag7pe6
http://brothermalw.ws/02qu80s4
http://bypetra.de/g7n6z5e
http://club.konjiki.jp/n7mm85
http://clubofmalw.ws/1gxqj
http://conserpa.vtrbandaancha.net/xn8icbk
http://csegurosural.com/k57z6d70
http://daedalus.dommel.be/tf9p0ktn
http://df2lh.privat.t-online.de/lyu7el
http://dussartconsulting.com/ubo0v39
http://greentechdesign.ca/frozkskt
http://home-hartmann.de/~bbc/r4h7crw1
http://iesjaumei.edu.gva.es/oqbiac4e
http://iistftp1.com/~associated/iiylg3
http://immobilien1000.de/cd7pk1
http://jamesm.co.uk/yiow3jsm
http://job.atspace.org/zshg9nj
http://lokum1985.republika.pl/n4s5gv3l
http://onlybest76.xyz/1r42t
http://rejoincomp2.in/1xo03ss
http://rodewelshcobs.com/z2iitr6
http://savuchtettu.xyz/4hrr5xg
http://sopranolady7.wang/5ofr5p2m
http://spaceinn.co.jp/pq53q6ks
http://spic.bakufu.org/81rme51
http://tpllaw.com/ly186ri
http://vanleeuwenvuurwerk.nl/nuajzmt
http://vicariassicurazioni.it/unh8b7q
http://wangmewang.name/5tr5xeey
http://www.agenziadini.it/gerewv
http://www.agenziadini.it/m7psv0
http://www.agriturismoigirasoli.it/5tr5xeey
http://www.bluedizioni.com/legvkru1
http://www.caffematto.it/gt1thmq5
http://www.caminettilcd.it/66tthne
http://www.carloabati.com/nhrv0e
http://www.carloabati.com/omt672
http://www.coozpn.cba.pl/9f0w1t3
http://www.csm94.org/v450ujsb
http://www.culturalheritagemanagement.org/tpnstb3j
http://www.dialektika.extra.hu/9lfdvl
http://www.dondana.com/x6wgj
http://www.fenit.net/jk2r7
http://www.jan-wallner.de/dpu00ss
http://www.lagottoromagnolo.be/wmy7t
http://www.leprimodels.it/9m9pk
http://www.mussystems.net/d6slacy9
http://www.planet-intv.com/rksd00
http://www.qualityacoustic.comcastbiz.net/pyxwp4h
http://www.saumi.jazztel.es/5ofr5p2m
http://www.ussanlorenzo.it/sbap9f
http://www.vanhoenacker.net/qcounnz
http://www.webcam-bild.de/65yoq
http://xelagon.50webs.org/8rxv3

Downloaded malware (encoded, filesize 146436):
37ee67ec1e1aa559fd80187ff186934e05cbcd172f27bbc6468da1e1fb787199  http___209.237.142.197_~p27j55uk_von90s
0c55b4df541aaf38f54658bd08d2c6423161ed42bbfccd1df77c399c9edd4b21  http___69.61.11.216_fdmzmq
5f06b6ae042b80eb2d0549b31568fefd861d794fc861dfb6a6cbecebd24d4ac3  http___abcbureautique.abc.perso.neuf.fr_8j3y0
1a2ae163c47d8d52d53b7f120a4b9cd5b5689b4f9e893a6acdda94e98585cbdc  http___ach-dziennik.cba.pl_kag7pe6
bee34601291dd99087b5ec887d402b82f7aec8e83d22c318d98bc0767bf2aa0a  http___brothermalw.ws_02qu80s4
1a9939286974648fc2557bd1143e282f1c564df2d71ef1d63be5874dc2bcfa1d  http___bypetra.de_g7n6z5e
0763d53d79453c2f2cdb00f3befaa6f7847833fc2a45e300dffcc3a540259fb1  http___club.konjiki.jp_n7mm85
ce1ccd5d618b5bd6146a3e874129c5efa07cf56c73d9298e92e82b119ddeae12  http___clubofmalw.ws_1gxqj
e55a299daded53642585488c51de68c8b116b8c2aa2bd6664d7172a3d7db8d69  http___conserpa.vtrbandaancha.net_xn8icbk
cec5f762673a5ebfe05196260aeb00822a33b93a0c9a3684a1ce02e42a885001  http___csegurosural.com_k57z6d70
238253d79403aafc368a078e0c1b9779ec7983882bb99956d5db6c70459bc387  http___daedalus.dommel.be_tf9p0ktn
da41a3b81057e7495c6e712a1b2b948900577b3c0e329342c376703a5a9a43d5  http___df2lh.privat.t-online.de_lyu7el
07d38840d581cef59810d0422e74faa29a38decdbe9b4cbe95a7a35dbf188804  http___dussartconsulting.com_ubo0v39
b3421ce3714292afcb4dc680efb3c605d8b5c911c1b7d75bdb776cbc04fc4058  http___greentechdesign.ca_frozkskt
b2d8a295624f54ee303be826d680a2388d8f95e83e709d7e6febe78399a30d19  http___home-hartmann.de_~bbc_r4h7crw1
6657fd61e94841b29b1f04c0dcf58dfef8ebf59982a4484bbde5908f2ace75d1  http___iesjaumei.edu.gva.es_oqbiac4e
b93e2a6ded8da50b8a9e691f926ed8210c470c0a9b7a7bea7d0256b51b323122  http___iistftp1.com_~associated_iiylg3
03835052d3c3e6a1174d200b89bca8dfb1eec1bc44be3e7833ee0610193af890  http___immobilien1000.de_cd7pk1
c571f74b324983f49651fa4cc4325384eeb8726af18fc0bf22d7911fc260b1e0  http___jamesm.co.uk_yiow3jsm
588b03869044ee1ba0c7457deabcd11f032d130ce6931d9f9997a13271d82545  http___job.atspace.org_zshg9nj
7017a7e646b880a25fd9784197a872ab7744092925af6cd6c148d104a3e0ebd4  http___lokum1985.republika.pl_n4s5gv3l
e080d3ea61773cf253ad6280882a43aeb1d663b76c8b0d9c1ea83d83d42d637b  http___onlybest76.xyz_1r42t
d8317bf5c6ba2897fbc2158449a8f99da7d26418ccb5caea09dc4964761adc89  http___rejoincomp2.in_1xo03ss
652d0bee48d677fb20670d563b05ad7c88e1c925b23d12f1c070c7ae746eaa24  http___rodewelshcobs.com_z2iitr6
a60c998dcff0740328df137483c208d7aaa2fedcba89ba4b9ec642e30c933b76  http___sopranolady7.wang_5ofr5p2m
039d166a0841d6946ab79875d5e79630891da62f74b3b88817d4a45c478fc08e  http___spaceinn.co.jp_pq53q6ks
02bbf091c5fc1e9c3d3f502a807d300251870201c292b956d668acbff67744de  http___spic.bakufu.org_81rme51
fe85ff815a96efcb03fc7f2d1e12e39c9635638598f85a8d0a8a9abd3e0b3935  http___tpllaw.com_ly186ri
2b18df0cbaaaa925f6363431493c19325a45cb2ca5ae278eab6ad7ab057e3cf1  http___vanleeuwenvuurwerk.nl_nuajzmt
6b4f448c2b8971bcb5ad74875a83b09ce0aaf7e06ca438fa225b05034639096e  http___vicariassicurazioni.it_unh8b7q
1505f8af4bed035e141fa0b96619c263275c72bb6c91a3d30f12c1ebddefe96e  http___wangmewang.name_5tr5xeey
f8bd1654d7412e807fb439ed8f5e9ed1a3be6fcf123cf7913fb9e7c8596b4def  http___www.agenziadini.it_gerewv
b63f1aa6d205fc1a666632b109f3cbbddacc87dd0c61ea11972e074281597b37  http___www.agenziadini.it_m7psv0
1505f8af4bed035e141fa0b96619c263275c72bb6c91a3d30f12c1ebddefe96e  http___www.agriturismoigirasoli.it_5tr5xeey
b1f1c445d157a2c2b9caca6e25ddb050e9e950d57312d806119934180ae106b4  http___www.bluedizioni.com_legvkru1
2f0878f9b22c18672003f3f57f9ec9e65961302c602a3f98b9170ced4428d5fc  http___www.caffematto.it_gt1thmq5
8ade374204fd86a957a2dde4da466f90300ebe48ee45b282167e84ead980101a  http___www.caminettilcd.it_66tthne
36f0d2953175e442676d76ad65c548776a58aa6fa05bc399ca8e9c955c6571da  http___www.carloabati.com_nhrv0e
e75b5ee3b21a87c21fbf557d45ca98f0a0987758d28fe9f59fdf9e57d7e9f4da  http___www.carloabati.com_omt672
86525b0296a909e2bca2f4d279996216f302fc5e7eb92f4b61c5e734cf9994aa  http___www.coozpn.cba.pl_9f0w1t3
fb427b15462697b3889a181f3323c941c87bf6960b6e2bd917057ca2d00e51eb  http___www.csm94.org_v450ujsb
714183bbf160e6dbbc877317f00b5500a91cbe5f5808b65576835ae75833eb3f  http___www.culturalheritagemanagement.org_tpnstb3j
29c0d37e5b01559958472f7d50270a8e35a1799b7fbaf6212f2550425c2fda0a  http___www.dialektika.extra.hu_9lfdvl
2c0a094811e64263b160d6a924fce9731d9648a005e2510ff77edbdc9b3efa84  http___www.dondana.com_x6wgj
d427528ffb28a78c34c98e17086f2a63541ad6b41faa092466b5bd95200ab6a0  http___www.fenit.net_jk2r7
d2538a3de4167dcf5769f86379cd6647ae5c86994db8a94251401d3c9930d4a6  http___www.jan-wallner.de_dpu00ss
dbc3d055c771a8eb58397b609d6fc680437892a61c17517f9ad60d0e84691626  http___www.lagottoromagnolo.be_wmy7t
864a22cdd2c69d2abc17752427c91b1268b96c63b09855605b8e041ad0405ea0  http___www.leprimodels.it_9m9pk
c3bd88250b37b6bf8de1590c1bcc9a71fae2f1e777b441e38ab1c4d12a457c36  http___www.mussystems.net_d6slacy9
0522a3256d3eb905718474904df21e83a50db3144b43831501a564b061e66b82  http___www.planet-intv.com_rksd00
44ba3bfa86ba0c2b931c38c0828c57e7a13184d8d2702c2147abbb54d7317c32  http___www.qualityacoustic.comcastbiz.net_pyxwp4h
a60c998dcff0740328df137483c208d7aaa2fedcba89ba4b9ec642e30c933b76  http___www.saumi.jazztel.es_5ofr5p2m
b75977739ce8e73fc689b1e5d006ea53a9a5248d3e27589986224b34805705e5  http___www.ussanlorenzo.it_sbap9f
57a9d4424827f19190e0b996e9c98f151674a16dfb46d54c8fc80cf5799481c6  http___www.vanhoenacker.net_qcounnz
fc35f72fdd0268d4d99517194eb1a23e23cb49de13d8e7b32c7e6384f0e2c10d  http___www.webcam-bild.de_65yoq
9c636e759008006b8cbe9f3029638e86aa55d7ac1e3d18059ecc02dc4c9eb689  http___xelagon.50webs.org_8rxv3

Malware:
https://www.reverse.it/sample/6382a184ff96e8aba83b4bd8faecf306529f1ab8afc1b66e1e056c6282ef8068?environmentId=100
https://www.reverse.it/sample/ab8079d2738ceae08677c8366e94f32a232e56393c40b0d8c5debdb96852be6f?environmentId=100
https://www.reverse.it/sample/4c05cf67678cdfecd5874bb00d595dc8a508fefc9552b3a2731db25e6f154dde?environmentId=100
https://www.reverse.it/sample/ccb1f3ff2a97dcb4cdfa9d57e169d360c344c89c7b6f9cd9f89bac904cd9c02e?environmentId=100

C2:
195.64.154.114:80/data/info.php
188.127.249.203:80/data/info.php
138.201.191.196:80/data/info.php
51.255.107.30:80/data/info.php
(trxswbwxhr.xyz) 91.226.92.208:80/data/info.php