2017-10-09 Locky "New voice message"

2017-10-09: #locky email phishing campaign "New voice message"

Email sample:
------------------------------------------------------------------------------------------------------------------------
From: "Voicemail Service" <vmservice@[REDACTED]>
To: [REDACTED]
Subject: New voice  message 19088622012 in mailbox 190886220121 from "19088622012" <0348866828>
Date: Mon, 09 Oct 2017 10:08:51 -0500

Dear user:

just wanted to let you know you were just left a 0:53 long message (number 19088622012)
in mailbox 190886220121 from "19088622012" <0348866828>, on Mon, 09 Oct 2017 10:08:51 -0500
so you might want to check it when you get a chance.  Thanks!

                                --Voicemail Service

Attachment: msg034179.7z -> msg093208746.vbs
------------------------------------------------------------------------------------------------------------------------
- sender is "Voicemail Service", email is forged to be coming from recipient's domain vmservice@[domain]
- subject is "New voice  message <11 digits> in mailbox <12 digits> from "<11 digits>" <<10 digits>>"
- attached file "msg<4-9 digits>.7z" contains file "msg<8-9 digits>.vbs", a VBScript downloader, which will download malware from one of Malware download sites
- body of the email contains a link, which will download additional code from:

Links:
http://afslearnenglish.com/voicemsg.html
http://agregate-cariera.ro/voicemsg.html
http://agrourbis.com/voicemsg.html
http://alucmuhendislik.com/voicemsg.html
http://auto-ecolecoccinelle.com/voicemsg.html
http://datenhaus.info/voicemsg.html
http://estudiperceptiva.com/voicemsg.html
http://ferienwohnung-schitter.at/voicemsg.html
http://fortcollins-accounting.com/voicemsg.html
http://hashigosha.com/voicemsg.html
http://ilnumeroverde.it/voicemsg.html
http://kalorsystem.com/voicemsg.html
http://louisawong.net/voicemsg.html
http://maule.biz/voicemsg.html
http://missinglynxsystems.com/voicemsg.html
http://mobius-group.com/voicemsg.html
http://monroepoa.org/voicemsg.html
http://monstermx.com/voicemsg.html
http://mueblesamedidamalaga.com/voicemsg.html
http://norsky.pt/voicemsg.html
http://pagosdelrey.mobi/voicemsg.html
http://parquetroman.com/voicemsg.html
http://pinkyardflamingos.com/voicemsg.html
http://profigera.pt/voicemsg.html
http://recturf.com.au/voicemsg.html
http://resortphotographics.com/voicemsg.html
http://sgtenterprises.com/voicemsg.html
http://shineindian.com/voicemsg.html
http://simonline.nl/voicemsg.html
http://somallc.com/voicemsg.html
http://sunny-voices.de/voicemsg.html
http://team-bobcat.org/voicemsg.html
http://vincent-farben.de/voicemsg.html
http://weloveflowers.co.uk/voicemsg.html
http://wwwa.su/voicemsg.html
http://zik-et-dance.com/voicemsg.html

- downloaded HTML contins an IFrame with link to
http://moroplinghaptan.info/offjsjs/
- domain is unreachable at this time, but probably will contain loader for the malware below:

Malware download sites:
http://aeaccting.com/oiheiryur92
http://ashapeforlife.com/oiheiryur92
http://ashtontan.com/oiheiryur92
http://asnsport-bg.com/oiheiryur92
http://atlantarecyclingcenters.com/oiheiryur92
http://bodywork-sf.net/oiheiryur92
http://brascopperchile.cl/oiheiryur92
http://brc.es/oiheiryur92
http://bsfotodesign.com/oiheiryur92
http://deltadisseny.com/oiheiryur92
http://emmabeckerle.com/oiheiryur92
http://envirotambang.com/oiheiryur92
http://escolademusicasonare.com.br/oiheiryur92
http://essenza.co.id/oiheiryur92
http://evlilikpsikolojisi.com/oiheiryur92
http://financeforautos.com/oiheiryur92
http://fls-portal.co.uk/oiheiryur92
http://galeona.com/oiheiryur92
http://gilgroup.com/oiheiryur92
http://mail.estudiorrbp.com.uy/oiheiryur92
http://mediatrendsistem.com/oiheiryur92
http://mtblanc-let.co.uk/oiheiryur92
http://scottfranch.org/p66/oiheiryur92

Malware:
- locky ransomware, offline .ykcol variant
- SHA256: 66b718f0d6b089523611cec3d7155939f6713e744e5d1316742aa6920804c772, MD5: a0e33d432906262eb9980030a405c3fc
- VT: https://www.virustotal.com/file/66b718f0d6b089523611cec3d7155939f6713e744e5d1316742aa6920804c772/analysis/1507561952/
- HA: https://www.reverse.it/sample/66b718f0d6b089523611cec3d7155939f6713e744e5d1316742aa6920804c772?environmentId=100