IOC Locky : 30/08/2027

### Locky campaign 30/08/2017 ###
# Infos
Tree: 7z archive > script
Archive pattern: "[0-9]{10}.7z"
Script pattern: "[0-9]{10}.vbs"
Payload: https://www.virustotal.com/#/file/864a714e7052b883655e1b28c893c43a56ff8c40cd0bafbc2d4ddc37527400bd/

# IOC
hxxp://cdn.funckgroup-server.com/MNVgfdf4?
hxxp://felinecrf.com/MNVgfdf4?
hxxp://feng-lian.com.tw/MNVgfdf4?
hxxp://fengoffice.net/MNVgfdf4?
hxxp://fffjapan.org/MNVgfdf4?
hxxp://fianceevisa101.com/MNVgfdf4?
hxxp://flemingz.com/MNVgfdf4?
hxxp://fltduty.ca/MNVgfdf4?
hxxp://food.svs.kz/MNVgfdf4?
hxxp://fortel-zahrada.cz/MNVgfdf4?
hxxp://fortresssecurity.de/MNVgfdf4?
hxxp://freese-architekten.de/MNVgfdf4?
hxxp://freidate.de/MNVgfdf4?
hxxp://friesenblut-horde.de/MNVgfdf4?
hxxp://friseursalon-diana.de/MNVgfdf4?
hxxp://frisoguerrino.com/MNVgfdf4?
hxxp://fustahermetic.com/MNVgfdf4?