2016-11-11 Locky "Virtual card"

2016-11-11 #locky email phishing campaign "Virtual card"

Email sample:
-----------------------------------------------------------------------------------------------------------
From: "Cynthia Mathis" <[email protected]>
To: [REDACTED]
Subject: Virtual card
Date: Fri, 11 Nov 2016 15:00:34 -0300


Dear Client! A virtual card you have ordered is now ready but not active.
In order to activate it, please open the attached document and specify your personal data when it's possible.

Attachment: virtualcard_[REDACTED].zip
-----------------------------------------------------------------------------------------------------------
- sender varies between emails
- subject is "Virtual card"
- attached file "virtualcard_<recipient's name>.zip" contains file "<randomchars>-<randomchars>.js", a JScript downloader

Download sites:
http://almahaconsultants.com/xd7ipc
http://angeredo.com/116peo
http://angeredo.com/2alw6ja
http://angeredo.com/3ne9284q
http://angeredo.com/5qtko
http://coolnshop.com/ykga5p
http://darbyreis.com/223ivzu
http://darbyreis.com/39hv30q9
http://darbyreis.com/5k0si
http://darbyreis.com/8955p7n2
http://eddermiaul.net/1kee8
http://eddermiaul.net/2yr5egml
http://eddermiaul.net/4hz27zup
http://eddermiaul.net/7pzlkzx
http://facecapsule.com/yoj0163
http://goodswand.net/1cpzm0
http://goodswand.net/2lex9
http://goodswand.net/48cco1
http://goodswand.net/7hukrxl
http://helsby.biz/wtcui
http://host71.net/q737atl5
http://hostingforall.gr/demqa
http://hostscom.com/r6tq8
http://hottao.cn/j00q0yi
http://hrlpk.com/pvum0
http://huayudianlan.net/byhpm
http://huodaibbs.com/u1c6eib
http://huojiasf.com/p82et8
http://hurricanefilters.com/jodu7fb
http://hzcysw.net/u1qmyaw
http://icdsarch.com/yogoasib
http://icefon.eu/39hv30q9
http://ifeb.eu/ajvr9q
http://imzhangfei.com/huc61o7
http://infradebt.com.au/bp88nlf
http://inormann.it/ivztrdj
http://israpundit.org/223ivzu
http://it.gr/ncy0ya
http://ithoria.gr/u8gz8qj
http://iwebsdns.com/116peo
http://jalapodist.net/13ptmq
http://jalapodist.net/2ej2cqf
http://jalapodist.net/3xx77m97
http://jalapodist.net/6xs6hc
http://jingshieye.com/mycn9y5a
http://joyannainsurance.com/lr4ys
http://jssmsc.com/bc5mzpyo
http://keseru.hu/m6xgia
http://keyloggers.ro/tdjjp7kg
http://kirulya.com/lfmx70p
http://konet.org/n1uxie4z
http://konsultanasuransi.com/oxq4y0yh
http://langevin.jp/48cco1
http://lasentea.com/yxtnvs
http://lebeier520.com/ke97t8x
http://ledetdom.ru/ef6wxcl
http://lexcellence.ru/a1j9k4
http://longyimumen.com/rdtg55j0
http://luczko.pl/223ivzu
http://m3t.cz/j5t02o
http://madly.me/jkssg
http://markibernadett.hu/j5wuv3d1
http://minevitamin.com/lyrdalwu
http://morfoloji.com/bgs8ehpm
http://multipartnersistem.com/ly784b41
http://nasosy76.ru/f230s
http://nepeanfinearts.com/yd64fsvl
http://over.nl/jq6itied
http://solmevini.com/vrchsk
http://spoiltgirlsclub.com/x6usth1
http://stocktradex.com/zhryhn
http://tfeambalaj.com/mblr6o
http://utes.com/116peo
http://vintage.com/g9zfzg
http://web.ru/g2zikwa0
UPDATE:
http://mangdesign.com/ud7gv4

Malware:
- NOT encoded on download
add0aa9e13f16a4323fab7268c38613bf3d9a56ca9630c60b0aa26ff679b78c8  http___almahaconsultants.com_xd7ipc
0693362b8d5dce5ad628b5a2b216dfca06e0a1dd36b8698ad4d15ee617a87785  http___angeredo.com_116peo
34c7f057a239fb2f781759e4726204d41350475ee9c3f4677c1a11a25edcf796  http___angeredo.com_2alw6ja
a02cf44ec0fd1de5cebb39abacdf4a498859c8f6df6b8b3a5cadae026e85dbdb  http___angeredo.com_3ne9284q
9206a7791778a3a909fd1f1488eb009990ae62f7da90646ed4026567b4179eb9  http___angeredo.com_5qtko
42ed1323d0b8f505c7239426393479560f20f5330c9bb0a7f85de83f1dd4b1c2  http___coolnshop.com_ykga5p
970d1ce0728ad29c53a51219408cba6ee13f27ddf366d8a4e25c2eda57462f73  http___darbyreis.com_223ivzu
fb1ebb9a632fc7ab14f728a2309600ce7486591c4f49045ed91b79d4256e3969  http___darbyreis.com_39hv30q9
7ab3d9c93fc306947875752fa008f137df6b841ac1b01e0cf2c612eedacf277f  http___darbyreis.com_5k0si
26178452f1a978e8ad670281223dea840830b65aba5214f1a407d7ddf3d61637  http___darbyreis.com_8955p7n2
7497f58ffe052c3b5ee784f9c85aea3b70a2716acdd9e12f5a0e487ae9ab8925  http___eddermiaul.net_1kee8
6b10e84777e25e8b7f5c906295a11847c3bfd2db5d8e718f2ed6bc13f6136558  http___eddermiaul.net_2yr5egml
3bce4f35afed6f7f07ef9d49a1c2852547f52ddadbad3f285c978de966012069  http___eddermiaul.net_4hz27zup
806bf439441cd5b15c53afed071b53d8c7dc86dffa02dcaf9de62b023967a415  http___eddermiaul.net_7pzlkzx
1bac4c8b16a01ceecfd5134bea121e22bf3f6f1a4711aa10b41f5ea0f2bf33ec  http___facecapsule.com_yoj0163
9eeae530fd01a8b17cd5aa5f4f5a276e52ecdba55d288b858fa0069a1929cf82  http___goodswand.net_1cpzm0
595262b54ea98799fded5825d8a6fb6accd105fd985e087f0be0955ac229ce87  http___goodswand.net_2lex9
6c459c69fb6e9c6293f65ecca5a8de18048b1aa940210959ac054d5f047fdec0  http___goodswand.net_48cco1
52bf42058b7baad76ada9c874d5a71bfbb0786be3a21fb493638bda6b1c17133  http___goodswand.net_7hukrxl
311af149693c583d899d68ee18664116b8dd312be7decf251c74160208fa89c4  http___helsby.biz_wtcui
826f3794c4a4b7fdb2557a3a0a60ecdc086acf47974e0f6d3d4f6d3f494cb393  http___host71.net_q737atl5
69a9fab6524943beb920a55b24e3ca1da8a7c233a60a5b9755f59c6b69181978  http___hostingforall.gr_demqa
6fa139b754633c72c4758f514803d4f1014e5439e4522c74c758c2d406fe1f0c  http___hostscom.com_r6tq8
2a6e9cf3050c22541169394ab48b786a977f06d318291c918c853bb06268d5ec  http___hottao.cn_j00q0yi
087f37eec30369699ef4fabb6713e27748a7223cc156c55e0921d38a983ce328  http___hrlpk.com_pvum0
f51785127dfbcf0450684f61087d4f8d4b10532f878ff5cbf447c8d51a834efa  http___huayudianlan.net_byhpm
037607f2e0a17173125a20d09c83ff264aa3be64dee997fa477b51fb2394e659  http___huodaibbs.com_u1c6eib
35d778ed1dcec748b649dadb43354b30ca7681e02f2ddae8e346788fcb5d7058  http___huojiasf.com_p82et8
c0ce0214a2906e6b6483833b1771d490106c55fd1cf48b42b00aef0d49e68248  http___hurricanefilters.com_jodu7fb
c217018fe6162edab94d5b68393e4def8f5f85e9b3cbe1a54054dfab6665b40d  http___hzcysw.net_u1qmyaw
2c4cd6b506843215903c9d66d9aaabad4ca2b4407bb780d89c16dcd528110905  http___icdsarch.com_yogoasib
fb1ebb9a632fc7ab14f728a2309600ce7486591c4f49045ed91b79d4256e3969  http___icefon.eu_39hv30q9
e516bd091553e01e9b3b239d367a2307e5b9eb1c09a370eba700c9147874a113  http___ifeb.eu_ajvr9q
9ba0b29569faaf0ac68d90904c4fd8642c844be439c6ebb43bd91cd3a482def1  http___imzhangfei.com_huc61o7
98e92a46ae7933c41a66ce37c36abdf0e7a792f931c9a905ed8039e044a0a3f2  http___infradebt.com.au_bp88nlf
e8155a526cbc6ee892b08ad4b75ae5bea739ea1466c1f17373b0f0783253be99  http___inormann.it_ivztrdj
970d1ce0728ad29c53a51219408cba6ee13f27ddf366d8a4e25c2eda57462f73  http___israpundit.org_223ivzu
be87fcec3b7ffaea14d195894a44d525cd16548773e1fc0ff6a1ba5cb9894cb5  http___it.gr_ncy0ya
0bb7641403bd6db295f817f8b5551532aca9c9cc568d22e76e87245feb49f19f  http___ithoria.gr_u8gz8qj
0693362b8d5dce5ad628b5a2b216dfca06e0a1dd36b8698ad4d15ee617a87785  http___iwebsdns.com_116peo
1135e72a3906a52b329cfb01eb1bb6f890647ad42dce842775237e601b1897b0  http___jalapodist.net_13ptmq
57fc18ca00e20af848c92ec195db3a18e4528a46f245d67686ffa03ec52589cd  http___jalapodist.net_2ej2cqf
ca8e13c69a727fb6ecf02adac8ce9e161a8eef8d2374fd3ef7db780994531143  http___jalapodist.net_3xx77m97
12ea3dd7f8808dcc3d0170d0897899f8342c8e01b78b2da9a9863818efd2af3e  http___jalapodist.net_6xs6hc
1c9b31afeb0bf4f2dfbcc51e940cc836731bbdc20a2cdd10d3b7cdafef042c06  http___jingshieye.com_mycn9y5a
adac6f434f7ffcc912e65d0d3ee2df28090dd1b18b7c2ea254499dbfa3fd2d66  http___joyannainsurance.com_lr4ys
07e5e772e22b0fa9c1739fdea4854fb02445b857b9a124986fd78346a4bba813  http___jssmsc.com_bc5mzpyo
85a0510d9eb98196ec9087c714b032cffc441e69c172ffd68c77b9a2fe6ce9cc  http___keseru.hu_m6xgia
4001b7e1a4f69d5fab7c14ee0a5fe6607a7be0430d0602069776b2f4d23321d7  http___keyloggers.ro_tdjjp7kg
563918775367b35660e3108716348d8375f9ae83ab97f66e3a309a55279951e4  http___kirulya.com_lfmx70p
8a4daf016362b0fd838f01cf2d764b4bf3c892f36f7191b8fb361cfd45270eef  http___konet.org_n1uxie4z
51904c7c976908d7adeddc855e6204bf89b35a759e72330b54cf7eba3a06d9f6  http___konsultanasuransi.com_oxq4y0yh
6c459c69fb6e9c6293f65ecca5a8de18048b1aa940210959ac054d5f047fdec0  http___langevin.jp_48cco1
d19833081db753a266f60ad6452a14fdf208983589fcdd3fc0536f79b6d11610  http___lasentea.com_yxtnvs
f9a2ea1422279c3df691e5298d937b027748e07b255b71c5594d46f680f07252  http___lebeier520.com_ke97t8x
f2b6a377c793482349e35514076c96c92e6ed435bf9eea83fd4db8511d548a91  http___ledetdom.ru_ef6wxcl
59c00877dcbacbfca10f781b2cec6a3caba5fd619cb89e0c40fa955512c7ffe7  http___lexcellence.ru_a1j9k4
45d2dd40080973d4208f9fa5c17446ef4b9ad2212866d0a3b74b7f35c850da43  http___longyimumen.com_rdtg55j0
970d1ce0728ad29c53a51219408cba6ee13f27ddf366d8a4e25c2eda57462f73  http___luczko.pl_223ivzu
22183fe24423f260222c103986e947caf670a7498394744012d737c093c272af  http___m3t.cz_j5t02o
7ae91c8cc4df82f6cde7c36f28d38305462fb05b17295d78fcf91a1f3a033e40  http___madly.me_jkssg
0065b8f50625971c105bbacf6f7c446dfe19b6f9afa285efdf6e70d95c6a864a  http___markibernadett.hu_j5wuv3d1
4888c49811b27bca5554b34bb2cff696fa4d122430770afd98f8ca63d50839b1  http___minevitamin.com_lyrdalwu
3bf3c9a177a34c503284f2b68695909b1f3712e85d9e48147224b4df646f10c2  http___morfoloji.com_bgs8ehpm
3385f3168534e195a0c9755b04eb84b50264fcda97a6187a2c6c4a486e68acef  http___multipartnersistem.com_ly784b41
5a04374f95ae31604eba9ab57bddcff57a4e95b92bbba4a2846a6968197ed44b  http___nasosy76.ru_f230s
bf5deab07358a05c33ae5e8faf68c79316ebce199856ea5fb2650779c9df06f3  http___nepeanfinearts.com_yd64fsvl
a4d2eeb57eaba87fc25c71346b9b60f98a5efc018d447311eadb8d8d2e13fe24  http___solmevini.com_vrchsk
8c9abd6446f67381bb21c4062bee685ec4115ea8e7ae5bb3b9ee7ab038864476  http___spoiltgirlsclub.com_x6usth1
486445dc533768b364d9427463d66665700f18c0b72afa47d6941f554c1c6490  http___stocktradex.com_zhryhn
be1089d3aff58b096df1912cae38f1122c8cffc68c1ffb9c4f9a2485bc39dcbe  http___tfeambalaj.com_mblr6o
76a7cdc98e11b8f01ceeacb9c93994f44a02998047d244c25cf456580952fcbb  http___vintage.com_g9zfzg
UPDATE
95dc24979b48fafc5b17ec4ed7a05b10b5e5f8f67b6ad5d9a62d841876c91163  http___mangdesign.com_ud7gv4

- executed by "rundll32.exe %TEMP%\<dll_name>,0005"

C2:
POST http://185.66.12.209/message.php
POST http://213.32.66.16/message.php
POST http://91.234.35.99/message.php
POST http://abunfllsx.pl/message.php
POST http://bpuywtn.org/message.php
POST http://btwyfwyrjtlgbr.ru/message.php
POST http://fpvpcfae.info/message.php
POST http://gxmoitskkjxyktyo.xyz/message.php
POST http://ktmchapsivfhjojic.click/message.php
POST http://mcpniuqiytk.su/message.php