IOC Globimposter : 26/10/2017

### Globimposter campaign 26/12/2017 ###

# Infos
Tree: 7z archive > script
Archive pattern: "CCE26122017_[0-9]{6}.7z"
Script pattern: "CCE26122017_[0-9]{5}.js"
Payload: https://www.virustotal.com/#/file/3a9d5976fbf41daf80f0eb9e6b7aadcece52a82fe9609984ef7f8ea166048547/detection

IOCs:
hxxp://www.caynannews.com/mnbTREkfDS??chogiLBIYlY=chogiLBIYlY
hxxp://www.caynannews.com/mnbTREkfDS??LUojTKDRWo=LUojTKDRWo
hxxp://www.caynannews.com/mnbTREkfDS??tyTsAyrxL=tyTsAyrxL
hxxp://www.caynannews.com/mnbTREkfDS??vMqVKOP=vMqVKOP
hxxp://www.caynannews.com/mnbTREkfDS??VqCqcFOhSz=VqCqcFOhSz
hxxp://www.caynannews.com/mnbTREkfDS??YYonVUzK=YYonVUzK
hxxp://www.pspmagic.ru/mnbTREkfDS??IyhbeTpH=IyhbeTpH
hxxp://www.pspmagic.ru/mnbTREkfDS??JyRyOBLaEj=JyRyOBLaEj
hxxp://www.pspmagic.ru/mnbTREkfDS??KQTdIuyLBO=KQTdIuyLBO
hxxp://www.pspmagic.ru/mnbTREkfDS??tEFHlWIU=tEFHlWIU
hxxp://www.pspmagic.ru/mnbTREkfDS??TyiGEpK=TyiGEpK
hxxp://www.pspmagic.ru/mnbTREkfDS??vOnJRXL=vOnJRXL
hxxp://www.pspmagic.ru/mnbTREkfDS??zfrPxBlDc=zfrPxBlDc
hxxp://www.simpleaftercare.co.uk/mnbTREkfDS??fpWdCU=fpWdCU
hxxp://www.simpleaftercare.co.uk/mnbTREkfDS??fsaBLcVEGB=fsaBLcVEGB
hxxp://www.simpleaftercare.co.uk/mnbTREkfDS??IlAEHkCU=IlAEHkCU
hxxp://www.simpleaftercare.co.uk/mnbTREkfDS??jkgeUTnwckh=jkgeUTnwckh
hxxp://www.simpleaftercare.co.uk/mnbTREkfDS??jrOEURn=jrOEURn
hxxp://www.simpleaftercare.co.uk/mnbTREkfDS??lLKmSNDIH=lLKmSNDIH
hxxp://www.simpleaftercare.co.uk/mnbTREkfDS??YzpqpxTlC=YzpqpxTlC
hxxp://www.simpleaftercare.co.uk/mnbTREkfDS??YzxKBPdASu=YzxKBPdASu
hxxp://www.software24x7.us/mnbTREkfDS??AYCAiuc=AYCAiuc
hxxp://www.software24x7.us/mnbTREkfDS??DcUMLbj=DcUMLbj
hxxp://www.software24x7.us/mnbTREkfDS??hrIqySSsavK=hrIqySSsavK
hxxp://www.software24x7.us/mnbTREkfDS??kceELEVItNj=kceELEVItNj
hxxp://www.software24x7.us/mnbTREkfDS??kFecBuO=kFecBuO
hxxp://www.software24x7.us/mnbTREkfDS??MynASA=MynASA
hxxp://www.software24x7.us/mnbTREkfDS??sgzcCktOwLK=sgzcCktOwLK
hxxp://www.ta-pu.ir/mnbTREkfDS??dfpdtfLYRH=dfpdtfLYRH
hxxp://www.ta-pu.ir/mnbTREkfDS??DFYEldDmy=DFYEldDmy
hxxp://www.ta-pu.ir/mnbTREkfDS??kOQfyyxSmI=kOQfyyxSmI
hxxp://www.ta-pu.ir/mnbTREkfDS??MTQDhMsytxd=MTQDhMsytxd
hxxp://www.ta-pu.ir/mnbTREkfDS??qBAYvJluFUx=qBAYvJluFUx
hxxp://www.ta-pu.ir/mnbTREkfDS??UcLucq=UcLucq
hxxp://www.thedournalist.com/mnbTREkfDS??jYAbcsB=jYAbcsB
hxxp://www.thedournalist.com/mnbTREkfDS??ljHVmfOz=ljHVmfOz
hxxp://www.thedournalist.com/mnbTREkfDS??PIDzljBcBx=PIDzljBcBx
hxxp://www.thedournalist.com/mnbTREkfDS??ryUMPT=ryUMPT
hxxp://www.thedournalist.com/mnbTREkfDS??UYFAOeTVnSt=UYFAOeTVnSt
hxxp://www.thedournalist.com/mnbTREkfDS??vRtcetAg=vRtcetAg
hxxp://www.thedournalist.com/mnbTREkfDS??YawHOi=YawHOi
hxxp://www.trafik-site.ru/mnbTREkfDS??CSEEkagWI=CSEEkagWI
hxxp://www.trafik-site.ru/mnbTREkfDS??DNVlcEgrOK=DNVlcEgrOK
hxxp://www.trafik-site.ru/mnbTREkfDS??lAWwWPq=lAWwWPq
hxxp://www.trafik-site.ru/mnbTREkfDS??OnKoFBYXpL=OnKoFBYXpL
hxxp://www.trafik-site.ru/mnbTREkfDS??QhClbSYXi=QhClbSYXi
hxxp://www.trafik-site.ru/mnbTREkfDS??qtHhOA=qtHhOA
hxxp://www.trafik-site.ru/mnbTREkfDS??RVuqeCNHRl=RVuqeCNHRl
hxxp://www.trafik-site.ru/mnbTREkfDS??URUrtr=URUrtr
hxxp://www.zhaksylyk.kz/mnbTREkfDS??BPXNfNTMmn=BPXNfNTMmn
hxxp://www.zhaksylyk.kz/mnbTREkfDS??BVqSOktKw=BVqSOktKw
hxxp://www.zhaksylyk.kz/mnbTREkfDS??huVyja=huVyja
hxxp://www.zhaksylyk.kz/mnbTREkfDS??IpmITxqHOVP=IpmITxqHOVP
hxxp://www.zhaksylyk.kz/mnbTREkfDS??JyoOxMYT=JyoOxMYT
hxxp://www.zhaksylyk.kz/mnbTREkfDS??pysOfQkT=pysOfQkT
hxxp://www.zhaksylyk.kz/mnbTREkfDS??WtnpgTJS=WtnpgTJS