3QeK5Mn3

12016-10-24 #locky email phishing campaing "Receipt"
2
3Email sample:
4------------------------------------------------------------------------------------------------------------------
5From: <mariano.bigod@gmail.com>
6To: [REDACTED]
7Subject: Receipt 82-253
8Date: Mon, 24 Oct 2016 13:58:18 +0300
9
10Attached: Receipt 82-253.zip
11------------------------------------------------------------------------------------------------------------------
12- sender varies, but seems always come from @gmail.com
13- subject is "Receipt <numbers>-<numbers>
14- email body is empty
15- attached file "Receipt <numbers>-<numbers>.zip" contains file "Receipt <numbers>-<numbers>.hta", a JScript downloader
16
17Dowload sites (actual URLs contain suffix ?<random>=<random> which does not influence the download):
18http://103.15.50.73/076wc
19http://117.239.70.228/076wc
20http://3ainstrument.com/076wc
21http://absxpintranet.in/076wc
22http://acanac.wysework.com/076wc
23http://aiahelps.com/076wc
24http://asadraza.ca/076wc
25http://bagnet.ir/076wc
26http://belovephoto.com/076wc
27http://beyondhorizon.net/076wc
28http://castoncorporateadvisory.in/076wc
29http://checkimage.comuf.com/076wc
30http://cynosurejobs.net/076wc
31http://ebuddesign.com/076wc
32http://grupoecointerpreis.com/076wc
33http://ibitol.com/076wc
34http://icclicks.com/076wc
35http://ledenergythai.com/076wc
36http://logcabins4less.ie/076wc
37http://mynamepixs.com/076wc
38http://nanrangy.net/076wc
39http://olpharm.com/076wc
40http://punjabipollywood.com/076wc
41http://ratchadaphoto.com/076wc
42http://somindia.in/076wc
43http://sowkinah.com/076wc
44http://stock.comuf.com/076wc
45http://thaitooling.net/076wc
46http://tifa-awards.net/076wc
47http://wamasoftware.com/076wc
48http://www.pspgemencheh.edu.my/076wc
49http://www.pspmrsmag.com/076wc
50http://www.pspmrsmtumpat.com/076wc
51http://www.rawahyl.com/076wc
52
53Malware
54- encoded on download, SHA256 8e136039b9a7960d8bd2f330a0438ddeeec921ac4c4017943431ad7cc8c3c009, filesize 278528 bytes
55-