2016-09-26 Locky "Documents Requested"

2016-09-26 #locky email phishing campaign "Documents Requested"

Email:
-----------------------------------------------------------------------------------------------------------------------
From: "Melody" <Melody8@[REDACTED]>
To: [REDACTED]
Subject: Documents Requested
Date: Mon, 26 Sep 2016 17:08:49 -0300

Dear [REDACTED],

Please find attached documents as requested.

Best Regards,
Melody

Attachment: doc(553).zip
-----------------------------------------------------------------------------------------------------------------------
- sender varies between emails, but its email address is forged to be from the same domain as recipient
- subject is "Documents Requested", in some cases prefixed with "Re:" or "FW:"
- attached file "[doc|new doc|Untitled](<number>).zip contains 	file <random chars>.wsf, a JScript downloader

Download sites (the actual URLs contain suffix ?<random>=<random> which does not influence the donwload):
http://allmemoryusa.com/g766d4ft
http://asotelepathology.org/g766d4ft
http://copsro.sk/g766d4ft
http://corights.net/g766d4ft
http://endwithcare.org/g766d4ft
http://floridaautostereo.com/g766d4ft
http://genealogy.su/g766d4ft
http://imagillaboration.org/g766d4ft
http://jahanexchange.com/g766d4ft
http://optimalpoland.pl/g766d4ft
http://relaywebsample.com/g766d4ft
http://resboiu.ro/g766d4ft
http://vktechs.com/g766d4ft
http://xceramics.com/g766d4ft
http://yourwellnessprescription.com/g766d4ft

UPDATE:
http://banksecuritywatch.com/g766d4ft
http://clsss.ru/g766d4ft
http://discountghd.org/g766d4ft
http://elateplaza.com/g766d4ft
http://elmostashar.com/g766d4ft
http://ensaenerji.com/g766d4ft
http://etoc.biz/g766d4ft
http://ict-net.com/g766d4ft
http://infotecx.com/g766d4ft
http://localxmobi.com/g766d4ft
http://lust-vodka.com/g766d4ft
http://minevitamin.com/g766d4ft
http://mokinukai.lt/g766d4ft
http://networkthai.org/g766d4ft
http://osago-plus.ru/g766d4ft
http://polykarpou.com/g766d4ft
http://presidenthotelthailand.com/g766d4ft
http://residencyradio.com/g766d4ft
http://room8008.com/g766d4ft
http://serwing.com/g766d4ft
http://sindhbankltd.com/g766d4ft
http://snor.it/g766d4ft
http://specnaz-ars.ru/g766d4ft
http://sudep-registry.org/g766d4ft
http://u2station.com/g766d4ft
http://venderminegocio.com/g766d4ft


Malware:
- encoded on download, SHA256 02f5f74a6213ca24e55e2baaec2dab8c1366f2287eba9b9bad87dd11354def09, filesize 233472 bytes
- decoded SHA25 86d229d219a21ab8092839a4361d30977e56c78f0ada10b6d68363b2834dd1dc
- executed by "rundll32.exe %TEMP%\<dll_name>,qwerty"
- samples
https://www.reverse.it/sample/292e22840eaaeb57b8fb8ef717db3340b4884bedd2120b2a89ea1888fa6c561c?environmentId=100
https://www.reverse.it/sample/d69264e5d257848117b917f418ff6da3c4a46ff7c91f8e30f22e3214137fa3dc?environmentId=100
https://www.reverse.it/sample/d93ae0db0035126337062b1eede3dcced33d7434f600bf055232f8e86467305a?environmentId=100
https://www.reverse.it/sample/b1cb3e3dd1be978a040f7fe0e30b1b2c020f3101a34a0ade2c355fab5401d700?environmentId=100
https://www.reverse.it/sample/8f209d47f687748f2af3857345aac08f9552363cd999456b6f7239eb581947f6?environmentId=100
https://www.reverse.it/sample/d58770e949bf6eb3411d05bbed9a1a7d3ef0d4c1cefc681fb6f324e283765651?environmentId=100

C2:
POST 62.173.154.240:80/apache_handler.php
POST 5.196.200.247:80/apache_handler.php
POST uiwaupjktqbiwcxr.xyz:80/apache_handler.php [86.110.118.114]
POST rflqjuckvwsvsxx.click:80/apache_handler.php [86.110.118.114]
POST dypvxigdwyf.org:80/apache_handler.php [69.195.129.70]