· 9 years ago · Oct 25, 2016, 02:36 PM
12016-10-25 #locky email phishing campaign "File, Picture, Scan Data NNN"
2
3Email sample:
4---------------------------------------------------------------------------------------------------------------
5From: JACKLYN L <jacklynl226@gmail.com>
6To: [REDACTED]
7Date: Tue, 25 Oct 2016 19:25:15 +0530
8Subject: IMG 1
9
10Attachment: IMG 1.zip
11---------------------------------------------------------------------------------------------------------------
12- sender varies between emails, but the domain is always @gmail.com
13- email body is empty
14- subject is "<Pic|Blank|Picture|Document|Scan Data|IMG|File|Image> <number>"
15- attachement name is <same as subject>.zip; contains file <same as subject>.js a JScript downloader
16
17Download sites (actual URLs have suffix ?<random>=<random> which does not influence the download):
18http://a1channel.com/g76dbf
19http://abplhomes.com/g76dbf
20http://alyatater.com/g76dbf
21http://baedalapp.com/g76dbf
22http://bbe-umzuege.de/g76dbf
23http://beaumontschool.com/g76dbf
24http://bid21.com/g76dbf
25http://blastspraypolish.com/g76dbf
26http://dev.blazedream.in/g76dbf
27http://dwimultimakmur.com/g76dbf
28http://easytravelvault.com/g76dbf
29http://elitednadt.com/g76dbf
30http://emreker.com/g76dbf
31http://faisal-ibrahim.info/g76dbf
32http://fpi-canada.com/g76dbf
33http://gellyrepin.com/g76dbf
34http://halomax.co.in/g76dbf
35http://hdbrts.co.in/g76dbf
36http://himytutor.com/g76dbf
37http://jeminwedskhushboo.com/g76dbf
38http://karyemek.net/g76dbf
39http://kendalpos.com/g76dbf
40http://lamurindo.com/g76dbf
41http://lilxtreme.com/g76dbf
42http://lookbeauty.ir/g76dbf
43http://mahendradesai.net/g76dbf
44http://newdesign.well.pk/g76dbf
45http://onestopvouchershop.com.au/g76dbf
46http://panaceapeople.com/g76dbf
47http://pragathicentralschool.com/g76dbf
48http://privatestashstorage.com/g76dbf
49http://promo.worldloft.ru/g76dbf
50http://rajashekharkubasad.com/g76dbf
51http://read4change.com/g76dbf
52http://runmyaccounts.ch/g76dbf
53http://sampletemplates.co.in/g76dbf
54http://samuderaciptaraya.com/g76dbf
55http://sport.cash/g76dbf
56http://srcc.co.th/g76dbf
57http://sukhavatibali.com/g76dbf
58http://tacunair.com/g76dbf
59http://tciislandguide.com/g76dbf
60http://tebdan.com/g76dbf
61http://tvoje-zahrada.cz/g76dbf
62http://uatsa.cl/g76dbf
63http://web.justproductions.co.uk/g76dbf
64http://wivebeday.com/g76dbf
65http://www.africanvacationtours.com/g76dbf
66http://www.fireballindia.com/g76dbf
67http://www.megasafaris.com/g76dbf
68http://www.pb2bb2c.com/g76dbf
69http://www.pharmaciela.com/g76dbf
70http://www.pragathicentralschool.com/g76dbf
71http://www.sibobe.com/g76dbf
72http://www.villakeratea.it/g76dbf
73
74Malware
75- encoded on download, SHA256 12d3077c923bc12aff8c2f3d04f96db427d841b185fa84a0a151d882cb3f08f8, filesize 278528
76- executed by "rundll32.exe %TEMP%\<dll_name>,qwerty"
77- samples
78https://www.reverse.it/sample/8f9e425c31e3227b0a7ddd2cdf0bb79ba503eebce76d972be8d5feedad4cf16a?environmentId=100
79https://www.reverse.it/sample/4485e022714503f0c8e88fb6265dd32597c7acdedff614c63243ddc33a2bbf80?environmentId=100
80
81C2:
8277.123.137.221:80 POST /linuxsucks.php
8391.200.14.124:80 POST /linuxsucks.php
84185.127.27.100:80 POST /linuxsucks.php