Monday, 27 June 2016

Malware spam: "Updated" / "Attached please find the documents you requested.." / "King regards"

This spam email has a malicious attachment and a slightly amusing typo:

From:    Sophia Rowland
Date:    27 June 2016 at 22:17
Subject:    Updated

Dear [redacted],

Attached please find the documents you requested..



King regards

Sophia Rowland
Technical Manager - General Insurance
Mon, 27 Jun 2016 17:17:50 -0400
These two Hybrid Analyses [1] [2] show what appears to be Locky ransomware being downloaded from multiple locations. The dropped binary has a detection rate of 2/55. At present I don't have any C2 servers, but I would guess they are largely the same as the ones found here.

at

1 comment:

  1. DK28 June 2016 at 09:55

    http://204.232.192.84/b751qdo
    http://80.244.134.169/0772t
    http://933666.net/7q4e3lyp
    http://addonworks.com/ncwx0b
    http://allchannel.net/nk5jbh
    http://aloprint.com/f216w5
    http://apotekroxy.com/slc93v1
    http://asliaypak.com/355ip
    http://bani-shehr.org/fzvog
    http://cnn-generics.com/k0m9wru
    http://cond.gribochechki.ru/3sh2zhp
    http://easysupport.us/i62i9r
    http://ecomuseedelau-dela.net/w2mb4
    http://empiredeckandfence.com/x0xio
    http://fpg.com.my/t5dsdw
    http://fuji-mig.com/drl01
    http://futuretech-iq.net/n9x1p2b4
    http://handicraftmag.com/sriu1n1f
    http://hrlpk.com/soaoxmo8
    http://hudebiah.net/ibmw1psh
    http://iminlife.com/ggu0m1s
    http://infocuscreative.net/i1paaw59
    http://ingstroymash.ru/al8z1
    http://innatesynergy.com/sjkxwu
    http://innogenap.com/tyob8uor
    http://livecamstrippers.com/4y98s3ha
    http://olgastudio.ro/zw0g38
    http://pakar.com.my/waohxzq
    http://passagegoldtravel.com/ffi5dton
    http://potolok-profit.ru/maill2sw
    http://pub-voiture.com/hvik6d
    http://racedayworld.com/86ks8fhf
    http://sevvalsenturk.com/41l8xj
    http://srilaktours.com/3sh2zhp
    http://staffsolut.nichost.ru/bl7ms
    http://subang.go.id/ui64jy0
    http://summasolution.net/t12u2h
    http://systemalu.com/he9g1
    http://techproconsult.com/m2q3u
    http://titaniumequities.com/t44df6bl
    http://totalsportnetwork.com/niohzxc
    http://u-flats.com/3q55hs7c
    http://vantagenetsvc.com/bbeleqj9
    http://vinabuhmwoo.com/9w9pgdi
    http://wbksis.com/5r167if
    http://webcam-newzealand.info/7ikowb
    http://williamsbreak.com/vvekuwj
    http://yourworshipspace.com/aj33f

    ReplyDelete