SHOW:
|
|
- or go back to the newest paste.
| 1 | 2016-08-08 #locky email phishing campaign "988g765f" | |
| 2 | ||
| 3 | Email sample (sender domain is same as recepients, subject varies; begins with Emailing, Attached, Copy or File): | |
| 4 | ----------------------------------------------------------------------- | |
| 5 | From: "Dolly" <Dolly23@[REDACTED]> | |
| 6 | To: [REDACTED] | |
| 7 | Subject: Copy: Photo(61) | |
| 8 | ||
| 9 | [NO EMAIL BODY] | |
| 10 | ----------------------------------------------------------------------- | |
| 11 | Attachment: "Photo(61).zip", containing "PictureXXX.wsf"; a JScript downloader | |
| 12 | ||
| 13 | Download sites (actual download URL also coontains random suffix e.g. ?PaAuxNPFQdk=bSTvQC): | |
| 14 | http://alpeteglio.it/988g765f | |
| 15 | http://armada-kar.nichost.ru/988g765f | |
| 16 | http://books-bsu-pd.atspace.org/988g765f | |
| 17 | http://bork-sh.vitebsk.by/988g765f | |
| 18 | http://expresso-sf.com.br/988g765f | |
| 19 | http://haha8.web.fc2.com/988g765f | |
| 20 | http://j-morin.fr/988g765f | |
| 21 | http://juegos-sb.atspace.com/988g765f | |
| 22 | http://keramago.web.fc2.com/988g765f | |
| 23 | http://lunaparkperugia.it/988g765f | |
| 24 | http://meguriau.koiwazurai.com/988g765f | |
| 25 | http://nflfootballpool.ca/988g765f | |
| 26 | http://nikiforov.dax.ru/988g765f | |
| 27 | http://w47hqoozb.homepage.t-online.de/988g765f | |
| 28 | http://www.acansorga.it/988g765f | |
| 29 | http://www.azetapiemonte.it/988g765f | |
| 30 | http://www.giuni.it/988g765f | |
| 31 | http://www.gonimar.onored.com/988g765f | |
| 32 | http://www.lafoce-nonsolovino.it/988g765f | |
| 33 | http://www.luigi-varsalona.net/988g765f | |
| 34 | http://www.plancho.de/988g765f | |
| 35 | http://www.telsiel.com/988g765f | |
| 36 | http://www.www.www.www.lappeenrannankalevalaisetnaiset.net/988g765f | |
| 37 | http://yosi.sa-suke.com/988g765f | |
| 38 | http://zsnbystre.republika.pl/988g765f | |
| 39 | ||
| 40 | Added: | |
| 41 | http://allrinku.web.fc2.com/988g765f | |
| 42 | http://del-sieradz.neostrada.pl/988g765f | |
| 43 | http://jk1109.cafe24.com/988g765f | |
| 44 | http://pogotowie.pcserwis.c0.pl/988g765f | |
| 45 | http://fieldtennis.web.fc2.com/988g765f | |
| 46 | ||
| 47 | Added: | |
| 48 | http://optimaalopgewicht.nl/988g765f | |
| 49 | ||
| 50 | Added: | |
| 51 | http://meguriau.koiwazurai.com/988g765f | |
| 52 | http://www.pasquaautonoleggi.it/988g765f | |
| 53 | ||
| 54 | Malware: | |
| 55 | Encrypted: ce07b01c56c3a377e9a2cf8bf04d8741a4b10a926bdd536bbe28255627c97c7e | |
| 56 | Decrypted: a8538c61746c690fe5e91999533d68068db0dc16d6f24dc290e952f808262f4b | |
| 57 | ||
| 58 | https://www.reverse.it/sample/5ea729545359fe199a1ace2d525488c667b5c096f55838ef9a9eb8132936c4a7?environmentId=100 | |
| 59 | C2s: | |
| 60 | 185.129.148.19:80/php/upload.php | |
| 61 | 91.219.28.66:80/php/upload.php | |
| 62 | (vkhfytd.xyz) 188.166.150.176:80/php/upload.php |
