Locky "Message from CUKPRxxxx"

2016-09-06 #locky email phishing campaign "Message from CUKRP...."

Email sample:
---------------------------------------------------------------------
---------------------------------------------------------------------

Download sites:
http://209.41.183.242/j8fn3rg3
http://alians-ekb.ru/j8fn3rg3
http://andante-co.jp/j8fn3rg3
http://andreas414.republika.pl/j8fn3rg3
http://bostoncittyregenerww.com/js/j8fn3rg3
http://bushman-rest.com/j8fn3rg3
http://cmacos.com/j8fn3rg3
http://fidelitas.heimat.eu/j8fn3rg3
http://gam-e20.it/j8fn3rg3
http://hotelimperium.go.ro/j8fn3rg3
http://josemedina.com/j8fn3rg3
http://kreativmanagement.homepage.t-online.de/j8fn3rg3
http://lacomete52.perso.sfr.fr/j8fn3rg3
http://lalarabbit.web.fc2.com/j8fn3rg3
http://marcotormento.de/j8fn3rg3
http://mixup0813.web.fc2.com/j8fn3rg3
http://ngenge.web.fc2.com/j8fn3rg3
http://onlineportal-2012.de/j8fn3rg3
http://pea5.cba.pl/j8fn3rg3
http://portadeenrolar.ind.br/j8fn3rg3
http://rosivani.go.ro/j8fn3rg3
http://sebangou8.xxxxxxxx.jp/j8fn3rg3
http://sitio655.vtrbandaancha.net/j8fn3rg3
http://sp-moto.ru/j8fn3rg3
http://tst-technik.de/j8fn3rg3
http://unimet.tmhandel.com/j8fn3rg3
http://w8kvpd5ib.homepage.t-online.de/j8fn3rg3
http://wccf.huuryuu.com/j8fn3rg3
http://wolffram.homepage.t-online.de/j8fn3rg3
http://www.aldesco.it/j8fn3rg3
http://www.alpstaxi.co.jp/j8fn3rg3
http://www.association-julescatoire.fr/j8fn3rg3
http://www.auret.at/j8fn3rg3
http://www.beniculturali.org/j8fn3rg3
http://www.bytove.jadro.szm.com/j8fn3rg3
http://www.ccnprodusenaturiste.home.ro/j8fn3rg3
http://www.cmg-ingegneria.it/j8fn3rg3
http://www.coropeppinumereu.it/j8fn3rg3
http://www.facturi.go.ro/j8fn3rg3
http://www.folkjuannepiu.it/j8fn3rg3
http://www.hestia-bewindvoering.nl/j8fn3rg3
http://www.hung-guan.com.tw/j8fn3rg3
http://www.keramikobjekt.de/j8fn3rg3
http://www.laribalta.org/j8fn3rg3
http://www.lindenkapelle.de/j8fn3rg3
http://www.lnowak.tkdami.net/j8fn3rg3
http://www.mikeg7hen.talktalk.net/j8fn3rg3
http://www.oltransservice.org/j8fn3rg3
http://www.one-clap.jp/j8fn3rg3
http://www.parrucchieriagiacomo.com/j8fn3rg3
http://www.peritiassicurativi.org/j8fn3rg3
http://www.pittorf.de/j8fn3rg3
http://www.planet-auto.go.ro/j8fn3rg3
http://www.porchettadicolledara.com/j8fn3rg3
http://www.radicegioielli.com/j8fn3rg3
http://www.roboticapc.com/j8fn3rg3
http://www.sieas.com/j8fn3rg3
http://www.spiritueelcentrumaum.net/j8fn3rg3
http://www.texelvakantiehuisje.nl/j8fn3rg3
http://www.vanetti.it/j8fn3rg3
http://www.vilastefania.go.ro/j8fn3rg3
http://www.wellworx.de/j8fn3rg3
http://www.whitakerpd.co.uk/j8fn3rg3
http://www.xolod-teplo.ru/j8fn3rg3
http://zse2.pl/j8fn3rg3
http://zui9reica.web.fc2.com/j8fn3rg3

Malware:

https://www.reverse.it/sample/6238dd24667b8305b4de334b96c4766cdfeec3dc79e2451f62b465770021251d?environmentId=100
https://www.reverse.it/sample/d866c449313d39089b77b51fc0a21de9e7c635e9397a4af6f6ef75e38a010305?environmentId=100
https://www.reverse.it/sample/fd1eb84ce3752c667a5115cbe9b5a59aa5a95a769925b30abe32498a38bb8081?environmentId=100
https://www.reverse.it/sample/ec3f674ab5f667073f980949efe40478abcbae9d54b2740129e8b2983e83a702?environmentId=100
https://www.reverse.it/sample/d45c0fd724c33fd95823d803168a0b997461d81da3eca85f4b19f55e2520b8cd?environmentId=100

C2: