This spam email has a malicious attachment and a slightly amusing typo:
From: Sophia Rowland
Date: 27 June 2016 at 22:17
Subject: Updated
Dear [redacted],
Attached please find the documents you requested..
King regards
Sophia Rowland
Technical Manager - General Insurance
Mon, 27 Jun 2016 17:17:50 -0400
These two Hybrid Analyses
[1] [2] show what appears to be Locky ransomware being downloaded from multiple locations. The dropped binary has a detection rate of
2/55. At present I don't have any C2 servers, but I would guess they are largely the same as the ones
found here.
1 comment:
http://204.232.192.84/b751qdo
http://80.244.134.169/0772t
http://933666.net/7q4e3lyp
http://addonworks.com/ncwx0b
http://allchannel.net/nk5jbh
http://aloprint.com/f216w5
http://apotekroxy.com/slc93v1
http://asliaypak.com/355ip
http://bani-shehr.org/fzvog
http://cnn-generics.com/k0m9wru
http://cond.gribochechki.ru/3sh2zhp
http://easysupport.us/i62i9r
http://ecomuseedelau-dela.net/w2mb4
http://empiredeckandfence.com/x0xio
http://fpg.com.my/t5dsdw
http://fuji-mig.com/drl01
http://futuretech-iq.net/n9x1p2b4
http://handicraftmag.com/sriu1n1f
http://hrlpk.com/soaoxmo8
http://hudebiah.net/ibmw1psh
http://iminlife.com/ggu0m1s
http://infocuscreative.net/i1paaw59
http://ingstroymash.ru/al8z1
http://innatesynergy.com/sjkxwu
http://innogenap.com/tyob8uor
http://livecamstrippers.com/4y98s3ha
http://olgastudio.ro/zw0g38
http://pakar.com.my/waohxzq
http://passagegoldtravel.com/ffi5dton
http://potolok-profit.ru/maill2sw
http://pub-voiture.com/hvik6d
http://racedayworld.com/86ks8fhf
http://sevvalsenturk.com/41l8xj
http://srilaktours.com/3sh2zhp
http://staffsolut.nichost.ru/bl7ms
http://subang.go.id/ui64jy0
http://summasolution.net/t12u2h
http://systemalu.com/he9g1
http://techproconsult.com/m2q3u
http://titaniumequities.com/t44df6bl
http://totalsportnetwork.com/niohzxc
http://u-flats.com/3q55hs7c
http://vantagenetsvc.com/bbeleqj9
http://vinabuhmwoo.com/9w9pgdi
http://wbksis.com/5r167if
http://webcam-newzealand.info/7ikowb
http://williamsbreak.com/vvekuwj
http://yourworshipspace.com/aj33f
Post a Comment