Locky "09yhbvt4"

2016-07-22 #locky email phishing campaign "09yhbvt4"

Email sample (sender is the same for all emails)
------------------------------------------------------------------------------------------------------------------
From: "Robert Mbonu" <rcmbonu@yahoo.com>
To: [REDACTED]
Subject: [random 12 numbers]

Attachment: <random12 numbers>.docm
------------------------------------------------------------------------------------------------------------------

Download links:
http://allmusic.c0.pl/09yhbvt4
http://delta5.homepage.t-online.de/09yhbvt4
http://dillerator.chat.ru/09yhbvt4
http://files.igamingbusiness.co.uk/09yhbvt4
http://fotouniek.grafi-offshore.com/09yhbvt4
http://hxt.50webs.com/09yhbvt4
http://mizosiri3.web.fc2.com/09yhbvt4
http://okumachiryouin.yu-yake.com/09yhbvt4
http://pamm-invest.ru/09yhbvt4
http://plingplong.homepage.t-online.de/09yhbvt4
http://tattoo-studio.nl/09yhbvt4
http://w879c8c45.homepage.t-online.de/09yhbvt4
http://wfwf1011.warabuki.net/09yhbvt4
http://www.df9jw.homepage.t-online.de/09yhbvt4
http://www.gerichtszeichnungen.de/09yhbvt4
http://www.herity.org/09yhbvt4
http://www.moran10.karoo.net/09yhbvt4
http://www.piconsul.it/09yhbvt4
http://www.silvotecna.co.cl/09yhbvt4
http://www.sirigor.republika.pl/09yhbvt4
http://www.studiocentouno.it/09yhbvt4
http://yagastudio.web.fc2.com/09yhbvt4

3a750752b543511f31b4163297f4b6a1ac2d1f362cb2cee49d044b6187989418  0001.docm
9e24b6a560acceee7f5eaa9d0321d1273f0dc71882921c2f0a7cefbe3dc781b3  0004.docm
4fb73e9648d75ee456ab186d7889b23b5edd46807383468e16de139cfe6e34b4  0005.docm
3e97df1d93dd1a129b7a5e0f955be4958202cfa99755e7674fe193b9494d107d  0006.docm
8ba83382415f2c60ed886d2ed9c2e79c06a072842d62d0caaf453e1860a1b0a0  0007.docm
ab2b481ff56c0aea7ef913e1f486b4b8d28b6c5c21f6a200b4287a55451349a3  0008.docm
b5bd9d9432b5be6d1d658ee16c93e09ee6abf4143cf1a3da037f4049842e7678  0010.docm
8f04b66b05867ec007fb8bc0c5ea0bf625733660ef61b75daa860617ce932677  0011.docm
3b11269fa2d8c39a75824c7b9b0c026facae7392d8d439a46770ec06c8905518  0013.docm
d6abe1faf0b1fdfe298a6d7cd150a479ad41a148d34a68f1a26e58dcf5f744fc  0014.docm
59ec6d0827a49b78802b351835492154708d32a626a71aacb21f85c50ae5ecbf  0015.docm
47b1c88fbe4d2cabae397b1670825217589871aeb7c4bd75c3a0ecec71232004  0018.docm
c9feda30b660575c45fa3969ff9bbbe241bab62555cf52227cdff1e2a9197106  0019.docm
60acdba9043295ec2db8b8babc85267a34388a91da32a0875fc8b224d5217121  0020.docm
e097bf10030a42d39d9cd4f1fe328f5ab8960ac30913c9a7378e3b3bc80f7f48  0021.docm
e22f65340f2a235e21b09b91fc19a87f6367513a6e9793282082dcfe778bc9b0  0022.docm
72ad525a762c2cfb89443e912234ac419a018fab8a132fff33625d861e828c4e  0025.docm
d54852c03486d866a438fee57bbc66bf405006edc54b906b58fbfe897f0b91e4  0027.docm
7bd8b1e09b2a82406b090d9db07c860bb9e2be630ade5bb6c7f87bb42242d329  0028.docm
da3f14508d5f7dd58ac60d7265a59dbc44b246575a90833a3342e24951580e86  0030.docm
e32f0f4f19c66a9e187415a111b4605508ea67845bd7945e61277aee35cd04e5  0031.docm
627fcc223c538161a4c7fe5e67fdbaf14f5cbe7dc51dce5cd6700ef859cb8486  0033.docm
cd7cc1101c06cbd49945bb1670f32fd8e4b81540eb5f1053446092fa5c870b20  0034.docm
8e86a87d2f9486afdde0518f42ac5e941536143808069b54973b47172c93cf18  0041.docm
57657eb2049d8cfa9d21926ba39f4b816c8f34baa0fe65176b5c5ed4ca34be89  0043.docm
9cbd303275946007ee44e544c3b660b0cd814aa5b19df96d0f7c88def1f0871a  0045.docm
2672f37f88847d85e6bed2912b257068624b1fdb9ed7bfbf504859bc9577d979  0047.docm
42e22980b6137e9bcc9c35bfac15e1102f34e9be381b1f86e19b0403e8161c98  0048.docm
dee8826ed4a2bf6054a6d20d8260a875e5738a6a17353d0e35467beba5443320  0050.docm
0ca3f9a0ac4380780c085166df277e3b2b0b1eeee227b50e3dfd71ca1d1ac0e4  0054.docm
454d0004e2ce89802c274eb0a4d8a621a10526b8136fae60231e0eebd36d2489  0062.docm
8374ff06e858cf26ff0660ceb9d0a727e307272db3cb7c86868604fa3a1cee9f  0063.docm
32fb1a5a26565a46a4a4db53d3305ebabc7d4c7a8cbbcf14e057458dbd17e9a0  0066.docm
d7f9cfb6f8dbb71707e50e8cf19cce8a64ecd4be957d056b208d44c03204b080  0067.docm
bd42612f88e48b079fbb1c9ab2921a6adb5dc173f2164885a9a831eb7173d350  0075.docm
6b4e4d625ab86d2b4bf14d44a29ad1550fe13376d192b10d8bfe3195fc09374a  0078.docm
6f1dc654d53210006cbe6e2501d2b778f4a9cc70ce731c133593e1e64c301784  0080.docm
c66cd7be977408e349c6498709abf8ae3377c0d025b5bc81e86516b0bd094ea4  0085.docm
f6ece80f51bf96147f7dbcb0bc35d1851138246311174ca4b709b490823f2cec  0086.docm
ecbf2fdcab759ea627560d32de87ad087495b90fb2c6908b6a6b72f5b1dd0ba8  0087.docm
6ed6a6c9398c99d1a8d7bb40fa8d674e02bcf2b15101a0c8eff526ed5c2b54c8  0089.docm
e5312c045b57c15fbdb358ffd5e42c4847fdba05aea36d6bec3a34cab6599349  0090.docm
83d02205f05c0e75d5ac2fb7c6c007d903de6510a619305d2b50dab9771481c0  0093.docm
d6c9f67247cf517fb2309069e01799f1f4c2c506151d4763b2450c12b4363e66  0116.docm
823a9225b13e9bdb0a14a87c78d31f0a8f47f1f4c7461df41f475fa9f819fc21  0163.docm
a0c157d90d2883fdfc4bbda67b037b969603dff033a7bde56869f77d9d3bd944  0164.docm
2f27ffee7e621f70c97edc8417fcff3ecf4d90a33ed1589af96c485696ae8b80  0165.docm
0786e3af13eb979abf383bb46c38c3e73d8a85a7c88672ebe75b3455bc0e7e9b  0172.docm
f022991be219d2ba97901ab1cb856d1e188ceb6c606e5b151f592deb34908450  0173.docm
5822ec1c8676c8f184040f92e4efccc2427f01860609146b65c5dcb66921e3ae  0175.docm
2e5ba8475713ec699180ebed0748795a9207a839eedc872fdaa8e96a35d1c03b  0176.docm
239f9c0c87b88b0f3ab4ea1ee28e04c8e0efb81f4d2eaf330f97ae02303afc89  0177.docm
d0a8a1fdc321424ad44c48c108f2892aaf66303471565494ab50b9f4a9fe92e4  0179.docm
c8fc50600b041ffb4dd6e16dd646228e14d3e7d3170fb3822182dd0dea709ef1  0180.docm
e826f79ca39efc2c9670ebf1fbc3053cf2da458d781e0d0e4900d22c97118a6a  0181.docm
668038f715d6e077fcaf57a3a79d207e44c983ff46e0a39ec446cbc8be8cb872  0182.docm
ee84060dcb32113fe4509f5505780b9dbd4dc4410f888c4ac0d391c76fa253f4  0186.docm
aee2373ddd4aa783907a71142bca89036adce413eb44710e67faa4d53dc0dd6a  0187.docm
4ac16b6cca53e829585f5e8d8cbe26958037d56c971b4b0300da7c2723b7f3a5  0192.docm
7ae62d3c92b9cdc35b79f452155fba55d217bcf54afd9b868e2f63951fb0f8ec  0195.docm
eca289d4f65679fb5f4ed2795adc78756cdcfb8f5dc7687f06a51337190f2492  0199.docm
428870359b7295c05f2f70e21b071a400e9d9c0dae5e4d2d72574115ff7331cc  0201.docm
776bdd2dbd067ea8924bc29c70b21a1ae6671cdcecc8911282036f53a71304f8  0214.docm
78dc11a7c71b3d5bcdd39c5d958c4ccf9637cf9df79a822befdebe360bc5f166  0215.docm
21d582272269b51235fa9cf2be702d3352cc02a819b3c17a5f805734b5031409  0216.docm
ac6afc5fb220de167f085c84041b1d36aa0fd02f6220df5f2f993c084fb81c73  0217.docm
8e1d8ff8cfd156074a506ee0019fccfb07d0a044a4baaee44fa8a1dc8088c02d  0218.docm
557fe44b9d7cbec5fd8045c91c2d330268fff65d5fffc67226bf00c74bf92318  0219.docm
9c0bf71414e80d07a70b2dd77939fa29711a975b832ba302fd96cf16f016376c  0222.docm
2f05956af6de31d6d0a5457d85de1a4708a8f855192b6aee18ed8239ebe537c7  0223.docm
f520b57d1179cb73c90e6db4dec3e9f5b5f7512784116216515ca0f868c4f1c8  0224.docm
6d9e588421909399a772f7b271a63c06c2b1a57f41e2f1834caf45375f221ec2  0228.docm
a12fcd6536eebfe06325d2cefad1076e8c8be88aa5a30001afd08a25465e6d79  0229.docm
ea5c0daf81ab2f442b2f132b13b94db4cc7d4bc1091ca0a01d395a2e18ffaaf1  0232.docm
9a78e6d0587104202e2d06be711abe10b7f1ca2a675d3250cbadf9d2eec75ae6  0235.docm
39022e229771be400c18bd788ab091d3227cf0fe323909b75ca0aa0e8aa42a04  0236.docm
dc8226e37c42fb9deb66a42f301e0ef8ec4020460bf936250136b19889ad8c9e  0238.docm
4d027a7d266c52cbb69bff8b9abe2823d4cb353a612a24587550801dcbf512b3  0240.docm
a67422e352369de350715477af04fd4e12b076c4270a8f54092fbe2d27a08812  0241.docm

malware: 148aa4934663f9c6581cd65f0d955bd1e635cce4425c853e250b21e3d139e0f8