aS9ftVbg

12016-12-13: #locky email phishing campaign "Bill for papers 2016-12-13"
2
3Sample email:
4------------------------------------------------------------------------------------------------------------------------------
5From: woodrow.milliken@gmail.com
6To: [REDACTED]
7Subject: Bill for papers 13-12-2016
8Date: Tue, 13 Dec 2016 05:42:43 +0530
9
10Attachment: Bill.zip ->
11------------------------------------------------------------------------------------------------------------------------------
12- sender varies between emails, but always from @gmail.com
13- subject is "Bill for papers 12-12-2016"
14- email body is empty
15- attached file "Bill.zip" contains file "<3 digits>-<4 uppercase letter><4 digits>.wsf", a JScript downloader
16
17Download sites (the actual URLs have suffix ?<random>=<random> which does not influnce the download):
18http://24x7telugu.com/jht76gh
19http://agile-scrum-training.com/jht76gh
20http://alhamdinternational.co.in/jht76gh
21http://artofovernight.com/jht76gh
22http://axzio.com/jht76gh
23http://badvaruhus.se/jht76gh
24http://banknifty.com/jht76gh
25http://bindaasdelhi.org/jht76gh
26http://bmbuildingpteltd.com/jht76gh
27http://bonzerwebsolutions.com/jht76gh
28http://bptpm.sragenkab.go.id/jht76gh
29http://bpt.sragenkab.go.id/jht76gh
30http://cambostudio.com/jht76gh
31http://cardimax.com.ph/jht76gh
32http://cargo1.lin14.siteonlinetest.com/jht76gh
33http://cemiselbiseleri.com/jht76gh
34http://csrj-ah.rau.ro/jht76gh
35http://development.susteen.nl/jht76gh
36http://dlugosz-it.pl/jht76gh
37http://dndwebtech.com/jht76gh
38http://dreamruntech.com/jht76gh
39http://dryilmazyildirim.com/jht76gh
40http://dssstaging.net/jht76gh
41http://eurofranq.com/jht76gh
42http://giafastfood.ro/jht76gh
43http://goldseparator.com/jht76gh
44http://gruponyn.com/jht76gh
45http://gtaxusa.com/jht76gh
46http://hansdavisgroup.com/jht76gh
47http://hoopwizard.com/jht76gh
48http://imlearningsystems.com/jht76gh
49http://infomazza.com/jht76gh
50http://innoservtest.in/jht76gh
51http://intrekmedya.com/jht76gh
52http://italics.in/jht76gh
53http://jackpotfutures.com/jht76gh
54http://koiatm.com/jht76gh
55http://mangliks.com/jht76gh
56http://mygreenlivingideas.com/jht76gh
57http://narifashion.com/jht76gh
58http://nationaltaxoffice.com/jht76gh
59http://olivierimmobiliare.com/jht76gh
60http://prototypingjob.com/jht76gh
61http://pubbligrafica360.it/jht76gh
62http://rajfoto.com/jht76gh
63http://ravaniagro.com/jht76gh
64http://ravaniinfra.com/jht76gh
65http://sampletemplates.net/jht76gh
66http://seasy.in/jht76gh
67http://shreemahalaxmiagro.com/jht76gh
68http://sparezz.com/jht76gh
69http://statelesspeopleinbangladesh.net/jht76gh
70http://suffitechh.com/jht76gh
71http://sukienhoanggia.com/jht76gh
72http://taipei-lottery.com/jht76gh
73http://tasveeranarts.in/jht76gh
74http://themeonhai.com/jht76gh
75http://thingsandsuch.co.uk/jht76gh
76http://twoj-sennik.pl/jht76gh
77http://ubertama.com/jht76gh
78http://www.3g4e.ir/jht76gh
79http://www.3shadz.com/jht76gh
80http://www.camko-motor.com/jht76gh
81http://www.epmedia.it/jht76gh
82http://www.kamakhyaits.com/jht76gh
83http://www.mastropoloartgallery.com/jht76gh
84http://www.merinnaa.com/jht76gh
85http://www.risto10.it/jht76gh
86
87Malware:
88- encoded on download SHA256 40db24cd899efd4381dbe76eb82a10b29a7b5acff901da9ce9a1b3284d3830be, MD5 e98ae17129de777e560d9bb5a49d77e3
89- decoded SHA256 5c8d053e3339d09bf277a98c73feac0eb34dd604ae8459f3f24cd7c1a56f414a, MD5 8bc549a9e9d720c6e25a03eac360479f
90- executed by "rundll32.exe %TEMP%\<dll_name>,set_str""
91- sample https://www.virustotal.com/file/5c8d053e3339d09bf277a98c73feac0eb34dd604ae8459f3f24cd7c1a56f414a/analysis/1481587931/
92
93C2:
94POST http://109.234.34.212/checkupdate
95POST http://176.121.14.95/checkupdate
96POST http://185.75.46.13/checkupdate