SPAM 25_05_2018

From Spam Mail italy
Sample
https://app.any.run/tasks/d858a89b-e434-4410-b1c1-d14f22e4d1f9
https://www.reverse.it/sample/e9f032906a5ccb4627f0fc238e95d9e208db969fcd01122c51c490f897bb4566/5b07dd917ca3e131555e8a83
( -> http://workoutinsf.com/pagenewex10.php ) -> GootKit 78d576fd3b60f2f6099bc695ea0ceea0e7d4dcfc6c5d353f1c1623445c0a16a1

Link inside mail that drop malware

Domains
www.rebelmavenmastermind.com
www.sunfloro.com
www.onlinepreps.com
www.guitar-studio-lessons.com
www.jeffjourdain.com
www.workoutinsf.com
www.meyerstation.com
www.bioelectricmedia.com
www.bretontynerbryan.com
www.bitmain-affiliation.com
www.rapidsuccessprogramming.com
www.nonpartisancoalition.com
www.fretsforvets.com
www.motorcyclecambodia.com
www.scubadiveinparadise.com
www.restedtraveler.com
www.hermeslogisticsint.com
www.blind-pig.com
www.detroittechtown.com
www.blahhouse.com
www.kichha.com
www.makeyourbest.com
www.moonsilo.com
www.icloudunlockexperts.com
www.saberastronautics.com
www.siliconplanetbook.com
www.topupmyanmar.com
www.doomchamber.com
www.reportbuys.com
www.brookingsharborlocalnews.com
www.albertomerello.com
www.hireseowriters.com
www.maxibuys.com
www.mymindisgoing.com
www.bonodigital.com
www.bbods.com
www.householdhaircuts.com
www.raadsolutionscorporation.com
www.agamelike.com
www.buytwitterlike.com
www.hackerdefenseacademy.com
www.teendriversinsurance.com
www.automaticfyuselikes.com
www.q8expos.com
www.bcspreli.com
www.ingadgetshop.com
www.q8offers.com
www.ganse.com
www.abdussattaracademy.com
www.sayaair.com
www.postpunks.com
www.weddingphotographernorwich.com
www.missmermaidsg.com
www.firstdominionchurch.com
www.dudash.com
www.el-safa.com
www.uberalawyer.com
www.streakk.com
www.dienthoai.com
www.petesdeals.com
www.adprofitizer.com
www.bhanumunjal.com
www.owxb.com
www.holidaypartymagic.com
www.pulidodeterrazo.com

Payload
www.rebelmavenmastermind.com/ccol?mphs=6499
www.sunfloro.com/ccol?mphs=6499
www.onlinepreps.com/ccol?mphs=6499
www.guitar-studio-lessons.com/ccol?mphs=6499
www.albertomerello.com/ccol?mphs=6499
www.jeffjourdain.com/ccol?mphs=6499
www.workoutinsf.com/ccol?mphs=6499
www.meyerstation.com/ccol?mphs=6499
www.bretontynerbryan.com/ccol?mphs=6499
www.bitmain-affiliation.com/ccol?mphs=6499
www.rapidsuccessprogramming.com/ccol?mphs=6499
www.nonpartisancoalition.com/ccol?mphs=6499
www.fretsforvets.com/ccol?mphs=6499
www.motorcyclecambodia.com/ccol?mphs=6499
www.scubadiveinparadise.com/ccol?mphs=6499
www.restedtraveler.com/ccol?mphs=6499
www.hermeslogisticsint.com/ccol?mphs=6499
www.blind-pig.com/ccol?mphs=6499
www.detroittechtown.com/ccol?mphs=6499
www.blahhouse.com/ccol?mphs=6499
www.kichha.com/ccol?mphs=6499
www.makeyourbest.com/ccol?mphs=6499
www.moonsilo.com/ccol?mphs=6499
www.icloudunlockexperts.com/ccol?mphs=6499
www.saberastronautics.com/ccol?mphs=6499
www.hireseowriters.com/ccol?mphs=6499
www.siliconplanetbook.com/ccol?mphs=6499
www.topupmyanmar.com/ccol?mphs=6499
www.doomchamber.com/ccol?mphs=6499
www.reportbuys.com/ccol?mphs=6499
www.brookingsharborlocalnews.com/ccol?mphs=6499
www.maxibuys.com/ccol?mphs=6499
www.bonodigital.com/ccol?mphs=6499
www.bbods.com/ccol?mphs=6499
www.householdhaircuts.com/ccol?mphs=6499
www.raadsolutionscorporation.com/ccol?mphs=6499
www.agamelike.com/ccol?mphs=6499
www.buytwitterlike.com/ccol?mphs=6499
www.hackerdefenseacademy.com/ccol?mphs=6499
www.teendriversinsurance.com/ccol?mphs=6499
www.automaticfyuselikes.com/ccol?mphs=6499
www.q8expos.com/ccol?mphs=6499
www.bcspreli.com/ccol?mphs=6499
www.ingadgetshop.com/ccol?mphs=6499
www.q8offers.com/ccol?mphs=6499
www.ganse.com/ccol?mphs=6499
www.abdussattaracademy.com/ccol?mphs=6499
www.sayaair.com/ccol?mphs=6499
www.postpunks.com/ccol?mphs=6499
www.weddingphotographernorwich.com/ccol?mphs=6499
www.missmermaidsg.com/ccol?mphs=6499
www.firstdominionchurch.com/ccol?mphs=6499
www.el-safa.com/ccol?mphs=6499
www.uberalawyer.com/ccol?mphs=6499
www.streakk.com/ccol?mphs=6499
www.dienthoai.com/ccol?mphs=6499
www.petesdeals.com/ccol?mphs=6499
www.adprofitizer.com/ccol?mphs=6499
www.mymindisgoing.com/ccol?mphs=6499
www.dudash.com/ccol?mphs=6499
www.bhanumunjal.com/ccol?mphs=6499
www.owxb.com/ccol?mphs=6499
www.holidaypartymagic.com/ccol?mphs=6499
www.pulidodeterrazo.com/ccol?mphs=6499
www.bioelectricmedia.com/ccol?mphs=6499