Locky "Confirmation letter"

2016-08-03 #locky email phishing campaign "Confirmation letter", overlaps with "Fw: New invoices"

Email sample
--------------------------------------------------------------------------
From: Gates.30345@[REDACTED]
To: [REDACTED]
Subject: Confirmation letter

Hi [REDACTED],

I attached the employment confirmation letter I prepared.
Please check it before you send it out.

Best regards
Deirdre Gates
--------------------------------------------------------------------------
Attachment: da471bf3c02.zip, contains "data 99a38ab1-.js"; JScript downloader

Download sites:
http://210.240.104.2/8wldse8
http://aquatixbottle.com/yxmbfle7
http://banthaoduoc.com/ys06v
http://bgnakano.web.fc2.com/581n98q
http://biyoujuicy.web.fc2.com/1r6hs9p
http://blog-aida.cba.pl/2zensi7t
http://buntaro.web.fc2.com/nzeznx
http://calcoastlogistics.com/r26ek39
http://cbactive.com/qb0i95
http://colleenthestylist.com/tjdaf
http://containermx.com/yb6wj
http://darky.cba.pl/2bjwa
http://deanstum.com/dsrpfn39
http://dks357.aiq.ru/7d5ogq
http://doma10.atspace.com/41rplexz
http://eacglobal.us/lxeohcg
http://epokcomm.com/p0nsja5t
http://feepharm.greatnow.com/gpbstpww
http://goldjinoz.com/9s437a
http://hpc.atspace.com/fzlsn
http://ilkhaberadana.com/xeny36
http://joost.standbyhosting.nl/itlorta
http://judowattrelos.perso.sfr.fr/8hnsps8a
http://networkerakademie.de/ow0fmkda
http://oabbahs.web.fc2.com/aunc3kef
http://otwayorchard.net/ydumpjt5
http://platimunjinoz.ws/41rplexz
http://proxes.50webs.com/7y1s2
http://senliheavenly.web.fc2.com/ac0tk
http://silverjinoz.net/49x2nv
http://sv-handwerk.de/b8jzys
http://travoxsb.com/sj49bk8
http://westcoastswingitaly.it/49x2nv
http://www.aaa-ch.com/p23hgn
http://www.nadelaur.com/b4xytp
http://www.nuovogarden.it/4m4vm2
http://www.ra-goebel.eu/4d71tv0m
http://www.ser-tech.com.ar/0pus3
http://www.totalfitness.it/394ouik
http://www.typhloshop.ru/1ql8iq
http://www.valser.onored.com/1ifq8io
http://zonabest.atspace.com/353wxy

Added:
http://allsex.atspace.com/bjagcu
http://pvdbosch.dommel.be/kwvf2xb3
http://thecourtyardcolfaxcom.sites.qwestoffice.net/9s437a

Encrypted malware, filesize 144388:
1a0fefc06a543447a34e27bc0ce3424b3d8e5619a9bf6765907f0cdbf44efae3  http___210.240.104.2_8wldse8
0817a6db71a789c0109ac9d18bb7a1853ba6971fc81e86ab0a9f92cddfb048ad  http___aquatixbottle.com_yxmbfle7
8e4f4bbeff007313a8636dd1183009b72643746930a884ae66c5dd2871603cd3  http___banthaoduoc.com_ys06v
715cd811dd553f180b96d9ba14b7d690efb4b257941cc62cc1ca7abe9d7a1882  http___bgnakano.web.fc2.com_581n98q
e10a86f3c2e4a9542f54f96b18126e411ef5e8d8d40fd07c728c213d1f224e06  http___biyoujuicy.web.fc2.com_1r6hs9p
10476629214eb81cdadf13e71003ad72f93c3429acb23b2a00940f96ed49de1a  http___blog-aida.cba.pl_2zensi7t
d7fb3fa30ca58419e79cd757949ab94d074f381570ae4dc71e9463b302d9ecb9  http___buntaro.web.fc2.com_nzeznx
233ba4c14c52c2fa4316c3495701ffbeeeff85c808e016b0c9845daf35957545  http___calcoastlogistics.com_r26ek39
5fd97fcf3a0f31aad810c664abda5422f4a22d094cf868eb9c9bd3b799c5e966  http___cbactive.com_qb0i95
50a760857dc239623c121fe987e3f221d7bfe70173ec585e926fb57bba613fbf  http___colleenthestylist.com_tjdaf
88da083d6bad97a424363e4929961582f9efec1c729e3572a42d54236402f450  http___containermx.com_yb6wj
93acb8451e77ed799294a3bc7534ad39d7926119609aaa6c83494b172a5f6afc  http___darky.cba.pl_2bjwa
cf45e99f9b9f8fb78a1fefc54bce5f7a8271c100c4c5451004e9f8b4be88a839  http___deanstum.com_dsrpfn39
2a200b6403c3d10e7c1b8afe6c99d148876f3ff567dcad00f272d927ebc7529c  http___dks357.aiq.ru_7d5ogq
62502397b40878fbcbedf42265c4f86cc30eb08ddd83ce3f1e87a9cafe00c6b4  http___doma10.atspace.com_41rplexz
44e8ab592bc6a01502d2c7e0e12f3a13cf819cd8b8fc14b5fa209e25a81fd782  http___eacglobal.us_lxeohcg
2fb027bd6da994a180a6da8199261e3757b48a3844bee81f16b6775a1d42a749  http___epokcomm.com_p0nsja5t
e3f6edd79d05c68c5f7c8d45c6e180576f214fe117289550845d71bf1b805829  http___feepharm.greatnow.com_gpbstpww
9e165d6001d88572e742f0b184420e55f5aaabfe709beac5177f29d548387a53  http___goldjinoz.com_9s437a
3ea627019a1dc2e26edcb5f0f808b3425d920abb58cd00d4f4c02da34fbfd873  http___hpc.atspace.com_fzlsn
3e9718cf028979538f1a3475a7c1ed9ed8a447c6e76f1e148aef176c126f8d62  http___ilkhaberadana.com_xeny36
8836d0cfc60221efa74c14cd222298f3cea2dc2236b8eb2f71c8baff683edde7  http___joost.standbyhosting.nl_itlorta
2c471cebce463966cb15ebc546098469eb46351054b2e0bfc10e7ad38e0a2f53  http___judowattrelos.perso.sfr.fr_8hnsps8a
f03deca711d06da4dfd5e47387eda60500263500f12fe60bf8998b4de160e030  http___networkerakademie.de_ow0fmkda
cbce1e8f017f573439473ffe1dc2c6181ae1b396b8e8ce53129f3911e19c5eda  http___oabbahs.web.fc2.com_aunc3kef
4ef5c0f75d6b467503c133a25a071b68d250ffb446992367d27872b3686b68c6  http___otwayorchard.net_ydumpjt5
62502397b40878fbcbedf42265c4f86cc30eb08ddd83ce3f1e87a9cafe00c6b4  http___platimunjinoz.ws_41rplexz
072459104373c1b648d9ded68e4a05cc435ddd7e54b05d511df7d0c4354dadf0  http___proxes.50webs.com_7y1s2
0a23a54f30431a0d12c2851d1995d4ab3388596ef9da298a2b6c8fb1423cce0d  http___senliheavenly.web.fc2.com_ac0tk
d9489bccccf070946243e00b24fda47520c30b967d7430b1bd0686de6ac90530  http___sv-handwerk.de_b8jzys
f21533f5c87de58144f1a689d052c69f6cdb8ee6fc83fb2877f8565a32eb7d0e  http___travoxsb.com_sj49bk8
ad695a6149d13817bf7ab92015739f06d623137640f41cba9ec6fa0cacde1a0a  http___westcoastswingitaly.it_49x2nv
49da5d871b79e3347ee33e7a543846dc20ce78b9b0c7ef6f482d7e23c9bed6a5  http___www.aaa-ch.com_p23hgn
a498e674d4e4fc0945e1725ab92f5e3f3d273f650db75d0af756926c7a28512d  http___www.nadelaur.com_b4xytp
6168a83e7877ff4387be46bd3d7b8fda4362b0325dd6136dae4c07daf2facc5e  http___www.nuovogarden.it_4m4vm2
0f942860cf28feeaa59cf5c970caf3275db21b68bf6e136f475da48a64690038  http___www.ra-goebel.eu_4d71tv0m
bd43ccd1d4034a5d574f76c582fe67cca0cda46d89ced91301187e7aff5dfe36  http___www.ser-tech.com.ar_0pus3
b4d04c39bdbcb62e18eebf32b0edf302159ec65fc4b4608e1c1b91300223c735  http___www.totalfitness.it_394ouik
f8ff8a3e0702d98ff9c90a5fa0d5c10e9b0b22ddc9e1156fbbc6f58a6f788690  http___www.typhloshop.ru_1ql8iq
c64ff1dba0d047e686f4196016b951b427c1d8d3b589a0be3bf89b124fd1de0f  http___www.valser.onored.com_1ifq8io
97f93eac6779658466b9225265883b266b917ab94ea04ee8a4acb5bca75fc25f  http___zonabest.atspace.com_353wxy