2017-06-09 Jaff

2017-06-09: #jaff f'ked up email phishing campaign with no subject

Download sites:
http://7prisms.com/0hbtyHG
http://adjlegal.com/0hbtyHG
http://akira-sushi34.ru/0hbtyHG
http://charlenelouw.co.za/0hbtyHG
http://coregroupindia.co.in/0hbtyHG
http://e67tfgc4uybfbnfmd.org/af/0hbtyHG
http://matbaa.be/0hbtyHG
http://mercobel.be/0hbtyHG
http://msbn.net/0hbtyHG
http://mscomunicacion.com.mx/0hbtyHG
http://seminator.de/0hbtyHG
http://sevsem.biz/0hbtyHG
http://sportsandsocialchange.org/0hbtyHG
http://stock-fallimenti.com/0hbtyHG
http://xp.com.sg/0hbtyHG
http://yesman.me/0hbtyHG
http://zeshta.com/0hbtyHG
http://zonnit.com/0hbtyHG

Malware:
- encoded on download, SHA256 fe492d54d6d9909c97e9556d0e6c2ff46b235cdd0082679683b8ad2459b3062c, MD5 a810aa0c0f88929f805056a2b75956c4
- decode by XORing with eN1bHc7u81KiYVNxi9WIBVPJkeA6W7eE
- decoded malware SHA256 0a52c5de20a7baa231579ceb7b430ecff1b046b58bd156dcc1fee22c89f65324, MD5 a6be6ea02acd9138578cae3ef408cbe7
- VT: https://www.virustotal.com/en/file/0a52c5de20a7baa231579ceb7b430ecff1b046b58bd156dcc1fee22c89f65324/analysis/1496997095/
- HA: https://www.reverse.it/sample/0a52c5de20a7baa231579ceb7b430ecff1b046b58bd156dcc1fee22c89f65324?environmentId=100

C2: http://brookstecholiggronm.net/a5/