Locky "Voice Message from Outside Caller"

2016-08-31 #locky email phishing campaign "Voice Message from Outside Caller"

Email sample (sender address varies between email and seems to have format <peach_necsv[number]@hotmail.[com|co.uk]):
---------------------------------------------------------------------------------------------
From: Peach Telecom <[email protected]>
To: [REDACTED]
Subject: Voice Message from Outside Caller (2m 38s)

Voice Message Arr=ved on Friday, Aug 26 @ 8: 10 AM
Name: Outside Caller
Number: Unavailable
Duration: 2m 38s
_________________
[REDACTED] SV9100 InMail
---------------------------------------------------------------------------------------------
Attached file "Outside Caller 09-01-2016 [random hexachar].zip" or "Outside Caller 08-31-2016 [random hexachar].zip" contains file "[random chars].hta" which contain JScript downloader

Download sites (actual URLs have suffix ?<random>=<random>, but it has no influence on download):
http://ajedrezimprov.50webs.com/yfotxbo
http://foerschl.gmxhome.de/imnmicp
http://joe9099.byethost7.com/hbusdiy
http://m-slova.web-box.ru/mglgyor
http://romanovicz.atspace.com/kpcbgbx
http://t-schoener.de/uaijvvu
http://wapnn.vov.ru/ummvyia
http://www.aktion-zukunft-gestalten.info/msdvwax
http://www.btb-bike.de/psoexes
http://www.john.edmunds.talktalk.net/cwjhfxb
http://www.trade-centrum.eu/ibghgdp
http://yggithuq.utawebhost.at/opdcrhh

Malware
- encoded on download, SHA256 e31a5e9159a48ae4c3ef9b348462e9243717d8d23f1d8fba65e5d773f54804e5, filesize 204800 bytes
- decoded SHA256 ed8965e9834248a177fd0062149410c63c612d68518aff31b35eb58a33b6ce59

https://www.reverse.it/sample/dfa16336058f7e28465cf3d607258820d89b79690808d923c556538d3e44ed63?environmentId=100
https://www.reverse.it/sample/870d75c52b8ce556f4433afe9533641d4b3b35c995227ade19bc7055013ff67e?environmentId=100
https://www.reverse.it/sample/e85e31020637b33f2e57653b69b18036360e59d977a51be67d23a9bd47f15750?environmentId=100
https://www.reverse.it/sample/ba2291bc48e584a8ef43d9c4b8ef762a7f5062754d0a06adfeac0a7965af9d0f?environmentId=100
https://www.reverse.it/sample/bccd58bcb2b4b606c08344312823bcae61c109628169a19fab9be13cb94e5356?environmentId=100

C2:
95.85.19.195:80/data/info.php
188.127.249.32:80/data/info.php
(cufrmjsomasgdciq.pw) 91.223.180.66:80/data/info.php
(tlehsdy.biz) 69.195.129.70:80/data/info.php