SHOW:
|
|
- or go back to the newest paste.
| 1 | 2016-09-06 #locky email phishing campaign "Invoice INV0000xxxxx" | |
| 2 | ||
| 3 | Email: | |
| 4 | -------------------------------------------------------------------------------------------- | |
| 5 | From: "Willy aikman" <[email protected]> | |
| 6 | To: [REDACTED] | |
| 7 | Subject: Invoice INV000073388 | |
| 8 | Date: Tue, 06 Sep 2016 19:54:13 +0700 | |
| 9 | ||
| 10 | Please find our invoice attached. | |
| 11 | ||
| 12 | Attachment: Invoice_INV000073388.zip | |
| 13 | -------------------------------------------------------------------------------------------- | |
| 14 | - sender varies | |
| 15 | - subject is "Invoice INV0000<number>" | |
| 16 | - attached file "Invoice INV0000<number>.zip" corresponds to subject | |
| 17 | - attached file contains file "<random chars>.wsf" containing a JScript downloader | |
| 18 | ||
| 19 | Download sites (actual URLs contain suffix ?<random>=<random> which does not influence download) | |
| 20 | http://209.41.183.242/j8fn3rg3 | |
| 21 | http://alians-ekb.ru/j8fn3rg3 | |
| 22 | http://andante-co.jp/j8fn3rg3 | |
| 23 | http://andreas414.republika.pl/j8fn3rg3 | |
| 24 | http://around4percent.web.fc2.com/j8fn3rg3 | |
| 25 | http://bostoncittyregenerww.com/js/j8fn3rg3 | |
| 26 | http://bushman-rest.com/j8fn3rg3 | |
| 27 | http://cmacos.com/j8fn3rg3 | |
| 28 | http://dashman.web.fc2.com/j8fn3rg3 | |
| 29 | http://fidelitas.heimat.eu/j8fn3rg3 | |
| 30 | http://gam-e20.it/j8fn3rg3 | |
| 31 | http://hotelimperium.go.ro/j8fn3rg3 | |
| 32 | http://josemedina.com/j8fn3rg3 | |
| 33 | http://kreativmanagement.homepage.t-online.de/j8fn3rg3 | |
| 34 | http://lacomete52.perso.sfr.fr/j8fn3rg3 | |
| 35 | http://lalarabbit.web.fc2.com/j8fn3rg3 | |
| 36 | http://marcotormento.de/j8fn3rg3 | |
| 37 | http://michik.web.fc2.com/j8fn3rg3 | |
| 38 | http://mixup0813.web.fc2.com/j8fn3rg3 | |
| 39 | http://ngenge.web.fc2.com/j8fn3rg3 | |
| 40 | http://onlineportal-2012.de/j8fn3rg3 | |
| 41 | http://pea5.cba.pl/j8fn3rg3 | |
| 42 | http://portadeenrolar.ind.br/j8fn3rg3 | |
| 43 | http://qualityacoustic.comcastbiz.net/j8fn3rg3 | |
| 44 | http://rosivani.go.ro/j8fn3rg3 | |
| 45 | http://sebangou8.xxxxxxxx.jp/j8fn3rg3 | |
| 46 | http://sitio655.vtrbandaancha.net/j8fn3rg3 | |
| 47 | http://sp-moto.ru/j8fn3rg3 | |
| 48 | http://tst-technik.de/j8fn3rg3 | |
| 49 | http://unimet.tmhandel.com/j8fn3rg3 | |
| 50 | http://w8kvpd5ib.homepage.t-online.de/j8fn3rg3 | |
| 51 | http://wccf.huuryuu.com/j8fn3rg3 | |
| 52 | http://wolffram.homepage.t-online.de/j8fn3rg3 | |
| 53 | http://www.aldesco.it/j8fn3rg3 | |
| 54 | http://www.alpstaxi.co.jp/j8fn3rg3 | |
| 55 | http://www.association-julescatoire.fr/j8fn3rg3 | |
| 56 | http://www.auret.at/j8fn3rg3 | |
| 57 | http://www.beniculturali.org/j8fn3rg3 | |
| 58 | http://www.bytove.jadro.szm.com/j8fn3rg3 | |
| 59 | http://www.ccnprodusenaturiste.home.ro/j8fn3rg3 | |
| 60 | http://www.cmg-ingegneria.it/j8fn3rg3 | |
| 61 | http://www.coropeppinumereu.it/j8fn3rg3 | |
| 62 | http://www.facturi.go.ro/j8fn3rg3 | |
| 63 | http://www.folkjuannepiu.it/j8fn3rg3 | |
| 64 | http://www.fpizzuto.eu/j8fn3rg3 | |
| 65 | http://www.gengokk.co.jp/j8fn3rg3 | |
| 66 | http://www.hestia-bewindvoering.nl/j8fn3rg3 | |
| 67 | http://www.hung-guan.com.tw/j8fn3rg3 | |
| 68 | http://www.keramikobjekt.de/j8fn3rg3 | |
| 69 | http://www.laribalta.org/j8fn3rg3 | |
| 70 | http://www.lindenkapelle.de/j8fn3rg3 | |
| 71 | http://www.lnowak.tkdami.net/j8fn3rg3 | |
| 72 | http://www.mikeg7hen.talktalk.net/j8fn3rg3 | |
| 73 | http://www.montegelato.it/j8fn3rg3 | |
| 74 | http://www.oltransservice.org/j8fn3rg3 | |
| 75 | http://www.one-clap.jp/j8fn3rg3 | |
| 76 | http://www.parrucchieriagiacomo.com/j8fn3rg3 | |
| 77 | http://www.peritiassicurativi.org/j8fn3rg3 | |
| 78 | http://www.pittorf.de/j8fn3rg3 | |
| 79 | http://www.planet-auto.go.ro/j8fn3rg3 | |
| 80 | http://www.plumbntile.talktalk.net/j8fn3rg3 | |
| 81 | http://www.porchettadicolledara.com/j8fn3rg3 | |
| 82 | http://www.radicegioielli.com/j8fn3rg3 | |
| 83 | http://www.roboticapc.com/j8fn3rg3 | |
| 84 | http://www.sieas.com/j8fn3rg3 | |
| 85 | http://www.spiritueelcentrumaum.net/j8fn3rg3 | |
| 86 | http://www.texelvakantiehuisje.nl/j8fn3rg3 | |
| 87 | http://www.threshold-online.co.uk/j8fn3rg3 | |
| 88 | http://www.vanetti.it/j8fn3rg3 | |
| 89 | http://www.vilastefania.go.ro/j8fn3rg3 | |
| 90 | http://www.wellworx.de/j8fn3rg3 | |
| 91 | http://www.whitakerpd.co.uk/j8fn3rg3 | |
| 92 | http://www.xolod-teplo.ru/j8fn3rg3 | |
| 93 | http://zse2.pl/j8fn3rg3 | |
| 94 | http://zui9reica.web.fc2.com/j8fn3rg3 | |
| 95 | ||
| 96 | Malware: | |
| 97 | - | - encoded on download, SHA256 b09fd941cf46fe994af6b88856969b860ab666dedfe198db4ff1ac49b788a870, filesize 76288 bytes |
| 97 | + | - encoded on download, SHA256 b09fd941cf46fe994af6b88856969b860ab666dedfe198db4ff1ac49b788a870, filesize 76288 bytes |
| 98 | - decoded SHA256 adc7cc912bd255e17431ead2dfa592f3176ddfa72cdc84cd3b78ab87f5a3f12d | |
| 99 | ||
| 100 | https://www.reverse.it/sample/40cfb75451d3c878c0d19de31f8ab29146cc3b17ee0ad1e8bea61d022f94abcf?environmentId=100 |
