2016-11-23 Locky "Bill-xxxx"

2016-11-23 #locky email phishing camapign "Bill-xxxx"

Email sample:
-------------------------------------------------------------------------------------------------
From: patricia o'sullivan <patricia.o'sullivan@[REDACTED]>
To: [REDACTED]
Date: Wed, 23 Nov 2016 15:49:02 +0530
Subject: Bill-0328

Attachment: ebe19c26d23717d41bd1172c97361df3.zip -> chl6dfkhm2qjhtnpxm691uoynsakregr.js
-------------------------------------------------------------------------------------------------
- sender varies between email, but the domain is faked to be same as recipient's domain
- subject is "Bill-<random digits>"
- email body is empty
- attached file "<32 hexa chars>.zip" contains file "<32 lowercase chars and digits.js", A JScript downloader

Download sites (actual URLs contain suffix ?<random>=<random> which does not influence download):
http://asrcargo.ru/08yhrf3
http://decorvise.com/08yhrf3
http://demo.website.pl/08yhrf3
http://gyreunbar.com/08yhrf3
http://halsklam.net/08yhrf3
http://inzt.net/08yhrf3
http://myphychoice.com/08yhrf3
http://nabila.co.id/08yhrf3
http://naruto55.com/08yhrf3
http://netclip.ro/08yhrf3
http://nikanels.pl/08yhrf3
http://nikitassalon.com/08yhrf3
http://njzhigaokt.com/08yhrf3
http://nkfyfs.cn/08yhrf3
http://nnptrading.com/08yhrf3
http://noamshop.com/08yhrf3
http://noosnegah.com/08yhrf3
http://normalizemusic.com/08yhrf3
http://notretribu.eu/08yhrf3
http://nuevarazajeans.com/08yhrf3
http://odtahova-sluzba-praha.eu/08yhrf3
http://oehome.com.cn/08yhrf3
http://ogrodexmilicz.pl/08yhrf3
http://ogustine.com/08yhrf3
http://onushilon.org/08yhrf3
http://o-sis.jp/08yhrf3
http://ossiatzki.com/08yhrf3
http://ostra.ro/08yhrf3
http://ouiphone.fr/08yhrf3
http://ovsz.ru/08yhrf3
http://p2pbikini.com/08yhrf3
http://padcha.com/08yhrf3
http://pakcek.com/08yhrf3
http://panoramicprocurement.net/08yhrf3
http://parenclub-devilsenangels.nl/08yhrf3
http://paronleather.com/08yhrf3
http://paulking.it/08yhrf3
http://pedalcars.ru/08yhrf3
http://pedullaelectric.com/08yhrf3
http://peppyinsta.com/08yhrf3
http://pietroconfalonieri.com/08yhrf3
http://plastictas.nl/08yhrf3
http://platinumrainbow.com/08yhrf3
http://popek.si/08yhrf3
http://power4speed.com/08yhrf3
http://pppconstruction.co.za/08yhrf3
http://premagro.ro/08yhrf3
http://printdot.sk/08yhrf3
http://profit-group.sk/08yhrf3
http://propfisher.com/08yhrf3
http://psouutarnow.org/08yhrf3
http://p-sysnet.de/08yhrf3
http://pusulam.com.tr/08yhrf3
http://quillin.net/08yhrf3
http://qybest.cn/08yhrf3
http://raivel.pt/08yhrf3
http://rdyy.cn/08yhrf3
http://reaga.cz/08yhrf3
http://realearthproperties.in/08yhrf3
http://realtorpics.net/08yhrf3
http://receptoare-satelit.ro/08yhrf3
http://regionalclaimsrecovery.com/08yhrf3
http://revaitsolutions.com/08yhrf3
http://revdev.nl/08yhrf3
http://rgbserver.be/08yhrf3
http://rhodemlogic.com/08yhrf3
http://rikomagic.com.br/08yhrf3
http://rimiller.com/08yhrf3

UPDATE:
http://piaristesafriquecentrale.org/08yhrf3
http://rafaelleon.es/08yhrf3

Malware
- encoded on downaload, SHA256 994904020266dfa4d76ef05d9ccb859ee064b5b3b022aaed658b2b1c5f480b14, MD5 8d5c9a6825a0639b31bd32d954344782
- decoded SHA256 675c681f4c9684685dda43e5e96983c1688bef6d68583562d60fe673dafb3d0c, MD5 4e207b30c5eae01fa136f3d89d59bbbe
- executed by "rundll32.exe %TEMP%\<dll_name>,int

C2:
POST http://80.87.202.49/information.cgi
POST http://94.242.55.81/information.cgi
POST http://95.46.114.205/information.cgi
POST http://hatjmumvu.su/information.cgi
POST http://icjrdsuouoxjxref.click/information.cgi
POST http://jbjolaaxwgudt.org/information.cgi
POST http://myqbrkhlj.su/information.cgi
POST http://oaflyjmei.click/information.cgi
POST http://oeeqvvarhgiqmao.work/information.cgi
POST http://opjhubsyxj.xyz/information.cgi
POST http://qftdyay.org/information.cgi
POST http://qlcxukirtihfly.biz/information.cgi
POST http://trqrhxbooviphgk.ru/information.cgi
POST http://ybokmaqgxqdf.biz/information.cgi