2017-07-24 TrickBot "Invoice# ADxxx"

2017-07-24: #TrickBot email phishing campaigns "Invoice# ADxxx" and "Order"
Samples: 2 + 2

Email sample 1:
-------------------------------------------------------------------------------------------------------------------------------
From: Tara thwaits <Tara@chrisnaylor.net>
To: [REDACTED]
Subject: Invoice# AD996
Date: Tue, 25 Jul 2017 05:32:10 +0700

Dear Customer
Invoice# AD996 is attached and ready for payment.

*Due to the time frame requests made on this order the payment terms have been lifted to ensure goods are completed and ready for dispatch by Sunday 30th July 2017.Please make payment at your earliest convenience to  ensure an immediate release of goods.
Any queries please call 0438 504 726.
Regards Tara thwaits

Attachment: Invoice# AD996.zip
-------------------------------------------------------------------------------------------------------------------------------
- sender is random
- subject is "Invoice# AD<3 digits>"
- attachment "Invoice# ADxxx.zip" contains file "01258861149_20170411_<6 digits>.wsf" which will download second stage downloader

Email sample 2:
-------------------------------------------------------------------------------------------------------------------------------
From: "Jodie pickup" <Jodie@rsenergies.com>
To: [REDACTED]
Subject: Order
Date: Tue, 25 Jul 2017 04:21:50 +0530

Attachment: MX-2310U_20170725_042150.zip
-------------------------------------------------------------------------------------------------------------------------------
- sender is random
- subject is "Order"
- body is empty
- attachment "MX-2310U_2017072<4 or 5>_<6 digits>.zip" contains file "01258861149_20170411_<6 digits>.wsf" which will download second stage downloader:

Stage2 download sites:
http://51jinshui.com/kklsdhv17?
http://clicburkina.com/kklsdhv16?
http://sedimohassel.com/kklsdhv15?
http://twdrei.de/kklsdhv21?

Second stage downloader is MS HTA file that contains VBScript downloader, which gets malware from:

Malware download sites:
http://abenethigherclinic.com/7regcbw
http://guangyiwuliu.com/7regcbw
http://klausstagis.dk/7regcbw
http://remkvartir.com/7regcbw
http://rockgarden.co.th/7regcbw
http://snnftp.com/7regcbw
http://songtinmungtinhyeu.org/7regcbw
http://spasinski.pl/7regcbw
http://tamilgags.com/7regcbw
http://wesleychristianschool.org/7regcbw


Malware:
- encoded on download, SHA256 87dcc473c4cb195b02d9fbf3665d42f3ec84cbd02f0da12f26b1adeb227514fb, MD5 7ba257b37b2d82fa137617bebcf07b05
- decode by XORing with "A4lN6elPYD6DBelKQDJeL6IxVTy1irSb"
- decoded SHA256 0349cf39dffbc2f8833782ece3fae70aaa34687d145824cc736d6ede386a017d, MD5 885d2852faad6c7a1b0b796047ddced7
- VT: https://www.virustotal.com/file/0349cf39dffbc2f8833782ece3fae70aaa34687d145824cc736d6ede386a017d/analysis/1500958206/
- HA: https://www.reverse.it/sample/0349cf39dffbc2f8833782ece3fae70aaa34687d145824cc736d6ede386a017d?environmentId=100