Malware spam: "Business card" / "I have attached the new business card design." leads to Locky

This spam email has a malicious attachment:

From:    Glenna Johnson
Date:    4 August 2016 at 10:18
Subject:    Business card

Hello [redacted],

I have attached the new business card design.
Please let me know if you need a change


King regards,
Glenna Johnson
c75b53fd1ea488ebe8eaf068fd5c9dd13f1848f4d3a7

Sender names and that long hexadecimal number with vary. Attached is a randomly-named ZIP file containing a malicious .js script beginning with "business card" [example]. The payload appears to be Locky ransomware.

This Hybrid Analysis of the script gives plenty of detail as to what is going on. My trusted sources tell me that the list of download locations is quite short:

escapegasmech.com/048220y5
goldjinoz.com/0a3tg
platimunjinoz.ws/13fo8lnl
regeneratewert.ws/1qvvu9lu
traveltotre.in/2c4ykij7

This drops a binary with a detection rate of 8/54. The earlier Hybrid Analysis report shows it phoning home to:

31.41.46.29/php/upload.php (Relink Ltd, Russia) [hostname: ip.cishost.ru]
185.129.148.19/php/upload.php (MWTV, Latvia)
91.219.29.35/php/upload.php (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine) [hostname: 35.29.219.91.colo.ukrservers.com]

All of those network blocks have a pretty poor reputation and I recommend that you block their entire ranges.

Recommended blocklist:
31.41.40.0/21
185.129.148.0/24
91.219.28.0/22

Malware spam: "Please review the attached corrected annual report." / "Corrected report"

This spam comes with a malicious attachment:

Subject:     Corrected report
From:     Joey Cox (Cox.48@sodetel.net.lb)
Date:     Monday, 1 August 2016, 13:37

Dear webmaster,

Please review the attached corrected annual report.

Yours faithfully
Joey Cox

The name of the sender will vary. Attached is a ZIP file with a random name, containing a malicious .WSF script beginning with "annual report". This attempts to download Locky ransomware from one of the following locations (thank you to my usual source for analysis):

121.83.206.211/~ftp-yama/9z6nu
12-land.co.jp/gyukmx
209.202.52.42/~wevugoja/eijz2y
213.228.128.12/~joaod/2xbjbu
213.228.128.12/~joaod/74ujkijl
217.26.70.200/~pitagora/4nm1k
218.228.19.9/~yossi/9ssfpkz
67.23.226.139/~jneccsio/2egblt4m
79.96.153.93/cxzlkz
80.109.240.71/~r.theeuwes/6c1arl9
abufarha.net/55hhso
akeseverin.com/audqp
akva-sarat.nichost.ru/xc2kao
arogyaforhealth.com/l9bwo0
b-doors.ru/l65n0 - hash
bisericaromaneasca.ro/jzvtuc
bobbysinghwpg.com/k3v1t3v4
canplus.fc2web.com/faepi1
certifiedbanker.org/lg305
climairuk.com/kmbw8q
clinic.gov.ua/sku4ql
darkhollowcoffee.com/n69xfk
darkhollowcoffee.com/xlbps
enexp.ru/r2wbp6
fotografuj.pl/8hotlfc2
fotografuj.pl/y4m2b
gp-logistics.ru/uwkop
keven.site.aplus.net/rb9skl
krovgid.ru/wooq2
libertymanuals.com/o97dh92i
mobile-kontent.com/ou6ne
openspace.pro/teg7qur
paletteswapninja.com/~playre5/0mxupm8q
programistyczni.strefa.pl/j7xk8c
ramsayconstruction.ca/b27ix9s
rom-stroy.ru/s0kphjat
schlebach.25mm.ru/ycz6sn
seahawkexports.com/7954qp3a
shagunproperty.com/8ikrr
sigovka.ru/w790cg8h
steelfs.com.mx/00ucikvv
stroymonolit.su/7oiy5i8
tvoy-android.com/i8rsoei
u2319351.plsk.regruhosting.ru/vsfvyj1j
ultramarincentr.ru/jtmms
uxeurope.com/~guest/7rj3px
visionaero.com/9grdv
wordpress.pro-tiler.ru/mk9yi4wl
www.robtozier.com/bg58a

The dropped binary then attempts to phone home to:

91.230.211.139/upload/_dispatch.php (Optizon Ltd, Russia) [hostname evradikfreeopti.ru]
37.139.30.95/upload/_dispatch.php (Digital Ocean, Netherlands) [hostname belyi.myeasy.ru]
91.219.29.48/upload/_dispatch.php (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine)

The host for that last one comes up over and over again, it's time to block that /22..

Recommended blocklist:
91.230.211.139
37.139.30.95
91.219.28.0/22

Malware spam: "Voicemail from Anonymous" / SureVoIP [voicemailandfax@surevoip.co.uk]

This fake voicemail spam has a malicious attachment:

From     SureVoIP [voicemailandfax@surevoip.co.uk]
Date     Fri, 29 Jul 2016 17:47:41 +0700
Subject     Voicemail from Anonymous <Anonymous> 00:02:15

Message From "Anonymous" AnonymousCreated: Fri, 29 Jul 2016 19:45:15 +0900Duration:
00:02:37Account: victimdomain.tld

The attachment is in the format msg_7b40ef3f-90a3-c2c7-2858-f9041f1023de.zip containing a malicious .wsf script with a name similar to account record =B5D=.wsf.

According to my trusted source (thank you as ever):

64.22.100.95/78h8ry
A1Engg.com/9u8jreve
am-i-evil.de/n3rv3rv
avaretv.atspace.com/n3rv3rv
cieslakwz.cba.pl/9u8jreve
curionaut.web.fc2.com/78h8ry
gim24.y0.pl/9u8jreve
guessen.privat.t-online.de/9u8jreve
gurannbania03.web.fc2.com/9u8jreve
hanokenko.web.fc2.com/n3rv3rv
hokkatsu6.web.fc2.com/78h8ry
kapiti-alpaca.co.nz/78h8ry
kathrin18.edv-kamue.de/78h8ry
kimani.dommel.be/n3rv3rv
martinezlabalsa.atspace.org/78h8ry
melzer-ferienwohnung.de/78h8ry
mertenitalia.atspace.com/78h8ry
paris82nana.cafe24.com/78h8ry
pixelacker.de/9u8jreve
rakurakutuuhang.web.fc2.com/n3rv3rv
rhodins.nu/n3rv3rv
sandalcraft.cba.pl/9u8jreve
shinryu1226.web.fc2.com/78h8ry
sspbadecz.ugu.pl/9u8jreve
www.amelander.nl/78h8ry
www.arrietayasociados.es/9u8jreve
www.atiyka.home.ro/9u8jreve
www.bobp.org.uk/9u8jreve
www.cabana.it/9u8jreve
www.corama.com/n3rv3rv
www.cs-strumentazione.it/9u8jreve
www.destine.broker.go.ro/n3rv3rv
www.diegofabbri.com/n3rv3rv
www.ecologica2000srl.eu/78h8ry
www.finnform.it/n3rv3rv
www.flamarimports.com.br/n3rv3rv
www.josegbueno.jazztel.es/9u8jreve
www.malzi.mynetcologne.de/n3rv3rv
www.markomielentz.de/78h8ry
www.nieli.de/9u8jreve
www.oliooddo.com/n3rv3rv
www.professionaldga.com/78h8ry
www.suesswarentechniker.de/78h8ry
www.techninov.fr/n3rv3rv
yohollywood.50webs.com/78h8ry

The downloaded binary is Locky ransomware, phoning home to:

178.62.232.244/upload/_dispatch.php (Digital Ocean, Netherlands) [hostname:vps-110775.freedomain.in.ua]
91.195.12.143/upload/_dispatch.php (PE Astakhov Pavel Viktorovich, aka host4.biz, Ukraine)
91.230.211.139/upload/_dispatch.php (Optizon Ltd, Russia) [hostname:evradikfreeopti.ru]

Recommended blocklist:
178.62.232.244
91.195.12.143
91.230.211.139

Malware spam: "Attached Image" leads to Locky

This spam appears to come from the user's own email address, but this is just a simple forgery. It has a malicious attachment.

From:    victim@victimdomain.tld
To:    victim@victimdomain.tld
Date:    26 July 2016 at 10:27
Subject:    Attached Image

**********************************************************************
The information in this email is confidential and may be privileged.
If you are not the intended recipient, please destroy this message
and notify the sender immediately.
**********************************************************************

Attached is a ZIP file with a name apparently made up of random numbers, containing a malicious .js script with another random number, such as this one. In this example the script downloads a malicious binary from:

www.isleofwightcomputerrepairs.talktalk.net/okp987g7v

There will be many other scripts with different download locations and perhaps other binaries. The file downloaded is Locky ransomware with a detection rate of 4/54. The Hybrid Analysis for the dropped file shows it phoning home to:

31.41.47.41/upload/_dispatch.php (Relink Ltd, Russia)
91.234.35.216/upload/_dispatch.php (FOP Sedinkin Olexandr Valeriyovuch aka thehost.ua, Ukraine)

Recommended blocklist:
31.41.47.41
91.234.35.216

Malware spam: "I attached the detailed business analysis (updated}"

This spam has a malicious attachment. And also mismatched (brackets}.

From     "Lynnette Slater"
Date     Tue, 19 Jul 2016 10:47:09 +0200
Subject     Business Analysis
Message text

I attached the detailed business analysis (updated}

---

King regards,
Lynnette Slater

Briglin Pottery
Phone: +1 (181) 133-27-50
Fax: +1 (181) 133-27-49
ID: 34a8c7f01e98b92f3985fe91965e703df1f13456

The message will appear to be "from" different individuals, varying from message to message. However, the main part of the body text is always the same.

Attached is a ZIP file containing elements of the recipients email address and some random letters and numbers. I have been unable to obtain a copy of the attachment at the moment, but it is likely to be Locky ransomware and if I get further details I will post them here.

UPDATE

My usual trusted source for analysis (thank you) reports that these ZIP files contain a malicious .wsf script which downloads a component from one of the following locations:

12-land.co.jp/gvkkx
accendojuris.com/dem3owmx
aerosfera.ru/xmljn
alinmaagroup.com/c2baqb
all-rides.com/m6bobmp
altadevelopers.com/kacgwe
anima-centrum.sk/bkcs2
bastidoresderondonia.com.br/ww55qzn
biovinci.com.br/dl9f0m6
choogo.net/qisxmdwz
darkhollowcoffee.com/unntj
daveshearth.com/f1t14
dealsbro.com/ptamc
delaemvkusnoe.ru/7lsypth
delaemvkusnoe.ru/yr54po27
dev.appleleafabstracting.com/j5q4b
dipp.lt/id4e6xcs
econopaginas.com/33ry5u
ejdadim.com/tzblhuk
heonybaby.synology.me/uydikuo
ialri.net/wh64xsb
jem-111.com/v5tq6s3
kveldeil.no/gfk2p
litehauzz.com.ng/cxqr03
lkfashions.com/3vkh8fcv
modulofm.com.br/3ap3qsi
moroem.com/n79lv
muscleinjuries.com/lqah1guh
mylimajai.lt/fkf75fo
myphychoice.com/s0ksxt8e
ormanstressrelief.com/lq1z62q
ostrovokkrasoty.ru/zxaen4
pasadenaoffice.com/431i00cd
right-livelihoods.org/uplwj
scpremiumbikes.com/53mkzxat
sitkainvestigations.com/2wmp4g
technobuz.com/05gwngqn
thetestserver.net/kemymr
tvernedra.ru/zkca0de
u0086064.cp.regruhosting.ru/hnmbac
versus.uz/ah73wlnz
vidonet.es/al268615
vilalusa.com/33q4i6f
westcoastswingitaly.it/jycvhfqq
www.thephoneguy.talktalk.net/om8bt
zuerich-gewerbe.ch/99v85w

I don't have a decrypted sample of the binary at present, although the C2 locations are reported as:

77.222.54.202/upload/_dispatch.php (SpaceWeb CJSC, Russia)
194.1.236.126/upload/_dispatch.php (Internet Hosting Ltd, Russia)
185.117.153.176/upload/_dispatch.php (MAROSNET Telecommunication Company, Russia)
176.111.63.51/upload/_dispatch.php (United Networks of Ukraine, Ltd, Ukraine)

Recommended blocklist:
77.222.54.202
194.1.236.126
185.117.153.176
176.111.63.51

Malware spam: "bank account report" leads to Locky

This fake financial spam has a malicious attachment:

From     "Boyd Dennis"
Date     Mon, 18 Jul 2016 11:34:11 +0200
Subject     bank account report


How is it going?

Thank you very much for responding my email in a very short time. Attached is the
bank account report. Please look at it again and see if you have any disapproval.

--Yours faithfully,Boyd DennisHSBC HLDGSPhone: +1 (593) 085-57-81, Fax: +1 (593)
085-57-41

The sender name and details vary, although it all follows the same pattern. Attached is a ZIP file containing elements of the recipients email address and some random digits. Contained within is a .wsf script that downloads a file from one of the following locations (thank you to my source for analysis):

acnek.com/fyxxbcsz
ahatv.com.au/twh7xv
anchortron.com/hiqsij
aquatixbottle.com/ygyngc
bailamecuba.com/4uyh5bex
banthaoduoc.com/v5g9z0s
BenavidezHoy.com/8zrg48k
bigislandhawaiihilorealestate.com/16h9p
bizconsulting.ro/bm8s7
blackdildo.net/h9kyu
bridgeplacements.com/dhbuk
calcoastlogistics.com/pda6bms
candobetter.net/5nt3ayk
cbactive.com/jw7l6mlr
christian-view.com/rwe24t
cinerd.info/ebiyhv
cloudbws.com/m0tu07b
colleenthestylist.com/rdrfp
containermx.com/tb4u2v
davisdoherty.co.nz/g0vi70
deanstum.com/z9opr
dnp9.com/zpfqk2l
ecpi.ro/cqema
equalityindonesia.com/b229mg
eurasian.fc2web.com/18nws9
findmobileauto.com/gh8ft
fusofrance.fr/nengga
gruposoluciomatica.com.br/ryi81
gv.com.my/qbnuau
ilkhaberadana.com/rmegjezz
kouzoncorporation.com/jikkhl
leeplastic.com/w49a80y
matthewmccright.org/sl8wu
my-result.ru/0j1nlpj8
ormanstressrelief.com/uhgoz3b
otwayorchard.net/u96kt
provincialpw.com/r0vaqf
quest.agency/0ovl6v5z
rsxxx.com/3vp8s83
s2mgmt.com/do40lc
serviceautoiasi.com/4tbvsfcz
smp.com.mx/hcoyv
thegracefamilychurch.com/ltxm3t
tip.ub.ac.id/36k8m2xt
trans-free.ru/2hx1l
travelabroadsecret.com/rxurfhqk
travoxsb.com/qmi5u0n
vakantiehuisinauvergne.com/apyd17
wcouto.com.br/9d207v

I don't have a copy of the payload at present, but it does phone home to:

77.222.54.202 (SpaceWeb CJSC, Russia)
91.240.86.221 (JSC Server, Russia)
176.111.63.51 (United Networks Of Ukraine Ltd , Ukraine)
209.126.112.14 (MegaHosterNetwork, Ukraine)

The payload appears to be Locky ransomware.

Recommended blocklist:
77.222.54.202
91.240.86.221
176.111.63.51
209.126.112.14

Malware spam: "report" / "I致e attached the report you asked me to send." leads to Locky

This spam has a weird problem with its apostrophe and comes with a malicious attachment:

From:    Kris Ruiz
Date:    28 June 2016 at 10:38
Subject:    report

Hi info,

I致e attached the report you asked me to send.


Regards


Kris Ruiz
Head of Finance UKGI Planning

The details of the sender will vary from message to message.

Attached is a ZIP file containing components of the recipient's email address and the words "report" and/or "pdf". Contained within is a malicious .js script file with a name starting with "swift".

This analysis comes from a trusted third party (thank you again). The script downloads a file from one of the following locations:

300tomoli.it/j8m7ktu
4k18.com/dfg4ad
adbm.co.uk/q2bmmhz
atlantaelectronics.co.id/xe1370n
bbmarilu.it/hkl9d
bbvogliadimare.it/il4cc3e
bibliadarkorbit.za.pl/i59j41zo
bisericaromaneasca.ro/trslckn
bobbysinghwpg.com/x42honx
bordur32.ru/re23zcb7
cameramartusa.info/u0uolg9
centrosportivoiunco.it/e8uxd
certifiedbanker.org/qjxfba
cond.gribochechki.ru/1vmcl8l
depaardestal.nl/3vfr61
dobramu.za.pl/4pc3kd9p
dragon.obywateleuropy.eu/4u22bfst
dugganinternational.ca/ksx6dv7
edilperle.it/d1mys2g
euro-support.be/xaf5349p
focolareostuni.it/oqtkiw
ft.driftactive.za.pl/7b03ffv
fuckcraft.xorg.pl/8cn8zeo
hate-metal.com/kgp8v
hudebiah.net/nskx4
ilbalconcino2011.it/e4ao4kky
ingstroymash.ru/cwiivhxu
jd-products.nl/t57vc86
marxforschung.de/0e7ac
mr2peter.de/o5ci15o
mycreativeprint.com/w3d7z6
namifitnessclub.it/f6hi6k
newgeneration2010.it/gupwqe1
potolok-profit.ru/q39aie
sprintbus.com.pl/9h7b0qnx
staffsolut.nichost.ru/jwz8i9
stbb.pt/40gnvp9a
tanie-pranie.za.pl/9e607
tip.ub.ac.id/v9wcojln
turniejkrzyz.za.pl/he2013lf
usdavetrana.it/dn81o
vonenidan.de/m3mmis
www.centroinfantilelmolino.com/qtuuvm2
www.johnlodgearchitects.com/haqew
www.pececitos.com/9ehkrke

The file is then decrypted (although I don't have a sample yet) and appears to be Locky ransomware. It phones home to the following servers:

109.234.35.71 (McHost.ru, Russia)
185.146.169.16 (Pavel Poddubniy aka Cloudpro LLC, Russia)
193.9.28.254 (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine)
194.31.59.147 (HostBar, Russia)
195.123.209.227 (Layer6 Networks, Latvia)
217.12.223.88 (ITL, Ukraine)
217.12.223.89 (ITL, Ukraine)

Recommended blocklist:
109.234.35.71
185.146.169.16
193.9.28.254
194.31.59.147
195.123.209.227
217.12.223.88
217.12.223.89

Malware spam: "Requested document" / "The document you requested is attached" leads to Locky

This spam comes from various senders, and leads to Locky ransomware:

From:    Trudy Bonner
Date:    27 June 2016 at 15:39
Subject:    Requested document

Dear [redacted],

The document you requested is attached.

Best regards


Trudy Bonner
Group Director of Strategy

Attached is a ZIP file containing elements of the recipients email address, the words "document", "doc" or "scanned" plus a random number. Contained within is a random .js script beginning with unpaid.

Trusted external analysis (thank you as ever) shows the scripts downloading from one of the following locations:

192.186.246.134/~advancedptr/4kw2yb
210.171.0.30/~akfa8701/76p9su
216.218.93.172/~thelma2/7a4q7knx
217.172.226.2/~redpaluch/8ji21s5
217.172.226.2/~vikolor/3pdqsh
300tomoli.it/0qgidk55
3141592.ru/rvhijql
4k18.com/lpschs
80.244.134.169/x4jzt5
82.140.32.172/~hoddl/4etb1e1
adbm.co.uk/104ky
addonworks.com/aaotksj
angeelle.nichost.ru/sf0bm5rz
arogyaforhealth.com/apqbmvr
asliaypak.com/zcubi7
atlantaelectronics.co.id/kjdfbm
babycotsonline.com/hiy96z
beautifulhosting.com.au/ljtxwrr4
bisericaromaneasca.ro/amfcy
bobbysinghwpg.com/fx1jpyt
cameramartusa.info/qaghx
camera-test.hi2.ro/5w9tcm
certifiedbanker.org/faplav8m
clients.seospell.co.in/8jq6cu
climairuk.com/bv7haqcm
cond.gribochechki.ru/v84pn
delicious-doughnuts.net/t81of0k
empiredeckandfence.com/8wytfp
euro-support.be/jo1s8r3k
focolareostuni.it/1tl199rq
hudebiah.net/vyz44p8
immoclic.o2switch.net/mpzkos32
ingstroymash.ru/vi4hwfp
jd-products.nl/msjswnn
mycreativeprint.com/f9qa60q
potolok-profit.ru/w9oyt
sherlock.uvishere.com/2ujlndd
staffsolut.nichost.ru/wif31sug
tip.ub.ac.id/bzrnweoo
www.centroinfantilelmolino.com/2sgw0ch

The malware phones home to the following hosts:


51.254.240.48 (Andrey Orlov aka Relink LLC, Russia / OVH, France)
109.234.35.71 (McHost.ru, Russia)
185.82.216.61 (ITL, Bulgaria)
185.146.169.16 (Pavel Poddubniy aka CloudPro, Russia)
195.123.209.227 (ITL, Latvia)
217.12.223.88 (ITL, Ukraine)
217.12.223.89 (ITL, Ukraine)

Lots of ITL recently... you might want to block /24s here instead of single IPs.

Recommended blocklist:
51.254.240.48
109.234.35.71
185.82.216.61
185.146.169.16
195.123.209.227
217.12.223.88
217.12.223.89

Malware spam: DOC1234 / document4321 / Document56789 leads to Locky

This rather terse spam run leads to Locky ransomware and appears to come from the sender's own email account (but doesn't).

The subject is some variation of DOC / Document / document plus a number. There is a ZIP file attached with a name matching the subject, there is no body text.

Some examples

Subject: DOC541887
Attachment: DOC541887.zip

Subject: document36168
Attachment: document36168.zip

Subject: Document453567810
Attachment: Document453567810.zip

Contained within the ZIP file is one of several different .js scripts. Trusted third-party analysis (you know who you are, thank you!) shows download locations at:

calcoastlogistics.com/09ujnb76v5?yNVICJbit=nFikKFve
labthanhthanhpg.com/09ujnb76v5?yNVICJbit=nFikKFve
patmagifts.asia/09ujnb76v5?yNVICJbit=nFikKFve
shadowbi.com/09ujnb76v5?yNVICJbit=nFikKFve
www.tmdmagento.com/09ujnb76v5?yNVICJbit=nFikKFve

Detection rates for the dropped binary are 5/54. The malware phones home to the following IPs:

51.254.240.48 (Andrey Orlov aka Relink LLC, Russia / OVH, France)
217.12.223.88 (ITL, Ukraine)
195.123.209.227 (ITL, Latvia)
185.82.216.61 (ITL, Bulgaria)

Recommended blocklist:
51.254.240.48
217.12.223.88
195.123.209.227
185.82.216.61

Malware spam: "Final version of the report" probably leads to Locky

This spam leads to malware:

From:    Julianne Pittman
Date:    23 June 2016 at 09:48
Subject:    Final version of the report

Dear info,

Patrica Ramirez asked me to send you the attached Word document, which contains the final version of the report.
Please let me know if you have any trouble with the file, and please let Patrica know if you have any questions about the contents of the report.


Kind regards


Julianne Pittman
Operations Director (CEO Designate)

The names in each version of the email vary. Attached is a ZIP file with a filename containing some version of the recipients email address and the word "report" which contains in turn a malicious ZIP .js script beginning with the words "unpaid".

The payload is not known at this time and analysis is pending, but is likely to be Locky ransomware similar to this.

UPDATE 1

Hybrid Analysis of three sample scripts [1] [2] [3] show three download locations (you can bet there will be many more):

bptec.ir/kvk9leho
promoresults.com.au/gx4al
boranwebshop.nl/ggc7ld

Each one drops a slightly different binary (VirusTotal results [4] [5] [6]) but at the moment automated analysis is inconclusive [7] [8] [9] [10] [11] [12]. I will try to post the C2 servers here if I get them.

UPDATE 2

A trusted third party analysis shows the following download locations (thank you!) :

3141592.ru/wyesvj
4k18.com/u69f97
aberfoyledental.ca/6dil05
abligl.com/8v62l4i4
adbm.co.uk/1o2wejz
angeelle.nichost.ru/y6s1y9h
arogyaforhealth.com/jujg6ru
atlantaelectronics.co.id/quv7rcc1
babycotsonline.com/ph42q6ue
barum.de/c2blg
beautifulhosting.com.au/rxn80
bilgoray.com/vi5sfu
bobbysinghwpg.com/pdqcqlnr
boranwebshop.nl/ggc7ld
bptec.ir/kvk9leho
cameramartusa.info/xrfpm
capitalwomanmagazine.ca/6k1oig
century21keim.com/c7xb2xy
certifiedbanker.org/obmv6590
cg.wandashops.com/evqbfwkx
clients.seospell.co.in/fkn67zy
climairuk.com/h32k491o
climatizareonline.ro/azkqs
cond.gribochechki.ru/zibni
dentalshop4you.nl/m22brjfz
disneyexperience.com/psyyhe
elviraminkina.com/ojyq1
euro-support.be/rdl3n7u
focolareostuni.it/0k2ren
freesource.su/ijugasq1
grantica.ru/6hjli
honeystays.co.za/siu2k
ideograph.com/k7qfsxx
imetinyang.za.pl/74hd4by5
immoclic.o2switch.net/styvuwti
jd-products.nl/xjld131
karl-lee.se/x23ft
margohack.za.pl/wkiokl
matvil8.freehostia.com/64tmb1
mycreativeprint.com/mqib9te
oakashandthorn.charybdis.seedboxes.cc/f7ge4y3k
pipt.wallst.ru/qojqp2
promoresults.com.au/gx4al
redpower.com.au/xlkdld
tip.ub.ac.id/k2e32vh
www.centroinfantilelmolino.com/60wfh
www.darkhollowcoffee.com/oqlyd9m
www.ellicottcitypediatrics.com/7d6sdl
www.keven.site.aplus.net/fmlonxl

C2 servers are at:

51.254.240.48 (Rackspace, US)
91.219.29.41 (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine)
217.12.223.88 (ITL, Ukraine)
195.123.209.227 (ITL, Latvia)
93.170.169.188 (PE Dunaeivskyi Denys Leonidovich, Ukraine)

The malware uses the path /upload/_dispatch.php on the C2 servers.

Recommended blocklist:
51.254.240.48
91.219.29.41
217.12.223.88
195.123.209.227
93.170.169.188


/upload/_dispatch.php

Malware spam: "Corresponding Invoice" leads to Locky

This spam has a malicious attachment, probably leading to Locky ransomware:

From:    Althea Duke
Date:    22 June 2016 at 16:00
Subject:    Corresponding Invoice

Dear lisa:

Thank you for your email regarding your order of 21 June, and sorry for the delay in replying. I am
writing to confirm receipt of your order, and to inform you that the item you requested will be delivered
by 25 June at the latest. If you require more information regarding this order, please do not hesitate to
contact me.

Also, our records show that we have not yet received payment for the previous order of 11 June,
so I would be grateful if you could send payment as soon as possible. Please find attached the
corresponding invoice.

If there is anything else you require, our company would be pleased to help. Looking forward to
hearing from you soon.

Yours sincerely

Althea Duke
Managing Director

Who the message is "from" varies from message to message, but the body text is the same. Analysis of the payload is pending, but it is probably similar to yesterday's Locky run.

UPDATE

A little bit of analysis, via these automated reports [1] [2] [3] [4] [5] show some download locations as:

personal-architecture.nl/6gcpaey
ding-a-ling-tel.com/b289dg
plasticsmachine.com/d43ndxna
hyip-all.com/9qwmc65

Various files are dropped, including these samples [6] [7] the latter of which is a three week old version of Locky. Go figure. The comments in this report show C2 servers at:

51.254.240.48 (Andrey Orlov aka Relink LLC, Russia / OVH, France)
91.219.29.41 (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine)
185.82.216.55 (ITL, Bulgaria)
93.170.169.188 (PE Dunaeivskyi Denys Leonidovich, Ukraine)

Three out of those four servers are the same as yesterday.

Recommended blocklist:
51.254.240.48
91.219.29.41
185.82.216.55
93.170.169.188

Malware spam: "Please find attached our invoice for services rendered and additional disbursements in the above-mentioned matter."

This malicious spam leads to Locky ransomware, something that we haven't seen for several weeks:

From:    Lilian Fletcher
Date:    21 June 2016 at 20:01
Subject:    Re:

Dear lisa:

Please find attached our invoice for services rendered and additional disbursements in the above-
mentioned matter.

Hoping the above to your satisfaction, we remain.

Sincerely,
Lilian Fletcher
Head of Maintenance

These are being sent out in huge numbers at the moment. Details vary from message to message, but the body text is essentially the same. Attached is a ZIP file containing the words addition, invoice or services plus the recipients email address and a number (e.g. lisa_addition_278292.zip) containing a malicious script beginning with the word "addition".

A trusted third-party analysis (thank you, you know who you are) shows download locations at:

204.232.192.84/abjvucr
akdenizozalit.com/ixoxi
allchannel.net/lue6c4
aloprint.com/bk0f2
arabian-star.com/nay7jq7
beluxfurniture.com/0jcxx
cbactive.com/1sdfs
clerici.info/g1sd5d59
depaardestal.nl/z5htsm
ding-a-ling-tel.com/bazk3kao
easysupport.us/fl85xie
ekonova.nazwa.pl/wc0coj
ft.dol.za.pl/ymsikgp7
fuji-mig.com/awcigpa1
futuretech-iq.net/koqpy
handicraftmag.com/mrihc
heavenboundministry.com/i7a59qj
hrlpk.com/s5ibqz1
hyip-all.com/9qwmc65
iminlife.com/cqoanbzr
infocuscreative.net/didt48j
innatesynergy.com/mrgdve3
jasoncoroy.com/szlzqni
kitchenconceptagra.com/5s9xb7j
komplettraeder-24.de/w61qx92
marxforschung.de/tt18a
modelestrazackie.za.pl/zfww8nx
otolocphat.com/bv2n241r
passagegoldtravel.com/bqugo3qb
pawelbuczynski.za.pl/z1q8u
percorsipsicoarte.com/6gz707c
pub-voiture.com/dcsjrjm
racedayworld.com/808k8pd
reginamargherita96.net/hhtvomcw
rzezba-bierowiec.za.pl/y7fbo1a
samrhamburg.com/jrh9b
scpremiumbikes.com/3y1b0n4s
searchforamy.com/1fz0k9kp
stbb.pt/z59ifwj
stckwt.net/p4jlk
testfacility.awsome.pl/zc73v
totalsportnetwork.com/kpbrp2mq
ugmp.nazwa.pl/xkhhf2n
unitedprogamers.za.pl/ylxt67
vantagenetsvc.com/a7xssz
vinabuhmwoo.com/69udv
wasearch.us/6mm3hk
wbksis.com/5mxl28il
yourworshipspace.com/a3py3w

Analysis by those parties shows that it phones home to:

51.254.240.48 (Andrey Orlov aka Relink LLC, Russia / OVH, France)
91.219.29.41 (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine)
185.82.216.55 (ITL, Bulgaria)
217.12.223.83 (ITL, Ukraine)

As I mentioned before, this is Locky ransomware which has not been circulating at all since about 31st May.

Recommended blocklist:
51.254.240.48
91.219.29.41
185.82.216.55
217.12.223.83

Malware spam: "You have 1 new message from bank manager. To read it, please open the attachment down below. "

This fake financial spam has a malicious attachment:

From:    Lanna Weall
Date:    31 May 2016 at 12:18
Subject:    New Message from your bank manager

You have 1 new message from bank manager. To read it, please open the attachment down below. 

In the sample I saw there was an attachment see_it_77235678.zip containing a malicious script warning_letter_Bdrh5W.js (detection rate 4/57) and the Malwr analysis of that sample shows that it downloads a binary from:

pvprojekt.pl/oLlqvX

The dropped binary is Locky ransomware with a detection rate of 4/56. All those reports plus these analyses [1] [2] [3] show network traffic to:

85.17.19.102 (Leaseweb, Netherlands)
195.154.69.90 (Iliad Entreprises, France)
93.170.123.60 (PE Gornostay Mikhailo Ivanovich / time-host.net, Ukraine)

A trusted source (thank you) indicated that there was a earlier Locky campaign today with the following donwload locations:

101consult.com/zZVPJj
adrianschubert.pl/7s56K8
affinityee.com/jkpziP
akcord.com/R4yjhg
alex-makhinin.ru/hPBy2R
altezzatrio.com/aAS841
amande-concerts.de/LNfOKy
amansur.com/sJIEQB
andresvazquez.net/1UaAWY
arajinqayler.com/V8lL2k
asworkstation.com/1Cq0Kk
baidainhatrang.xyz/bA2xZO
balifashion.ru/FMGbdV
belov24.ru/1msPTS
bestplumbersindallas.com/UZmYow
betulbasol.com/jmS4ts
bitcoinprservices.com/4Xc6Fy
canale78.it/I52NbK
c-a-r.at/QSa8sI
fm2030.us/BznLrm
handmee.com/hIPTXx
jestempiotr.pl/IiJlGp
kickoff.ru/WNwvki
kontarkum.org/Lntxhy
ktistakis.com/UHqig6
kvarcevaya-lampa.ru/fC9qZW
kwweb.it/tNTjZ2
ladohumano.cl/bnmYOE
leatherberryconsulting.com/gXTND7
lidgroup.ru/vV9c7l
lizdion.net/9cRXIl
makarenkostyle.net/IJlEqC
marca-ce.com/n859VM
maridadiproperties.com/pQIJGB
mckinleyhigh.org/lhAfaC
metakino.ru/onryuE
metaldesign.info/o12QeD
minutemanpress-randburg.co.za/UXJnqs
most.org.mk/oiNWQ0
muslimdate.com/mlB3PW
noplacelikejones.com/hati3x
norisys.com/EwX0sO
nwa-dizel.ru/D8kTfA
ohmyg-o-d.info/Ns4gf5
pasit.heutagon.com/PyG0Oc
pgcommunitycab.com/FAlx1b
polibloki.ru/nbTURt
primeautoglass.co.nz/wMcW5Z
puliziafacile.it/JvZ9cX
pvprojekt.pl/oLlqvX
quotidianieriviste.com/WIKuLk
redcurrantjobs.co.uk/9cgwZ5
revista.motociclismo.es/4HgJ7t
riobrancoperu.org/B3AlqT
rockmind.pl/bg6kKf
rotaharita.com/5NmH3b
sanariumspb.ru/Xm9xul

Recommended blocklist:
85.17.19.102
195.154.69.90
93.170.123.60

Malware spam: "Neue Abrechnung Nr. 746441" / support@sipcall.de

This German-language spam has a malicious attachment:

From:    support@sipcall.de
Date:    27 May 2016 at 10:57
Subject:    Neue Abrechnung Nr. 746441


Guten Tag

Im Anhang erhalten Sie die neue Rechnung des vergangenen Monates mit der Abrechnungsnummer 746441.

Für eine fristgerechte Bezahlung danken wir Ihnen. Bei Fragen oder Anregungen steht Ihnen unser Kundendienst gerne zur Verfügung.


Freundliche Grüsse
Ihr VoIP Provider


Dies ist eine automatisch generierte Nachricht. Antworten auf diese E-Mail können nicht bearbeitet werden.

Reference numbers vary. Attached is a randomly-named Word document (e.g. INV842038-746441.docm). The sample I submitted to Malwr showed it downloading a binary from:

www.ding-a-ling-tel.com/98yh87nb6v4

Other sources indicate additional download locations at:

egadget.ru/98yh87nb6v4
www.samrhamburg.com/98yh87nb6v4
bridgeplacements.com/98yh87nb6v4
birlesimsucuklari.com/98yh87nb6v4
ecpi.ro/98yh87nb6v4
wondervalley.in/98yh87nb6v4
acnek.com/98yh87nb6v4
cacpa.org/98yh87nb6v4
cobrebactericida.org/98yh87nb6v4
greenwfms.com/98yh87nb6v4
iwebmediasavvy.com/98yh87nb6v4
projectodetalhe.pt/98yh87nb6v4
renaudsfurniture.ca/98yh87nb6v4
saintkatherine.orthodoxy.ru/98yh87nb6v4
www.orchidealito.it/98yh87nb6v4

There are probably other locations too.

An executable is dropped with a detection rate of 3/56. The Hybrid Analysis and DeepViz report both indicate different phone-home locations:

193.9.28.13 (FLP Kochenov Aleksej Vladislavovich / uadomen.com, Ukraine)
5.152.199.70 (Redstation, UK)

Private sources also indicate C2s at:

212.109.219.31 (JSC Server, Russia)
107.181.187.12 (Total Server Solutions, US)

The payload is Locky ransomware.

Recommended blocklist:
193.9.28.13
5.152.199.70
212.109.219.31
107.181.187.12

Malware spam: "Weekly report" / "Please find attached the Weekly report."

This fake financial spam comes from random senders and companies and has a malicious attachment:

From:    Alicia Ramirez
Date:    25 May 2016 at 14:22
Subject:    Weekly report

Hi [redacted],


Please find attached the Weekly report.


King regards,

Alicia Ramirez
Castle (A.M.) & Co.

There are a large number of these, with a ZIP file attached containing a malicious scripts with a typical detection rate of 3/56. In this sample Malwr analysis, it downloads a file from:

test.glafuri.net/yxk6s

There will certainly be a LOT of other download locations. The dropped file GSKQtcnNu8MS.exe has a detection rate of 4/55 and that same VirusTotal report indicates C2 traffic to:

138.201.93.46 (Hetzner, Germany)
91.200.14.139 (PP SKS-LUGAN, Ukraine)
104.131.182.103 (Digital Ocean, US)
164.132.40.47 (OVH, France)

Even though other automated analysis failed [1] [2] this time we have previously identified two of those IPs as being Locky ransomware, so there is little doubt that this will be more of the same.

Recommended blocklist:
138.201.93.46
91.200.14.139
104.131.182.103
164.132.40.47

Malware spam: "Per E-Mail senden: DOC0000329040"

This German-language spam comes with a malicious attachment. It appears to come from the victim themselves, but this is just a simple forgery.

From:    victim@victimdomain.tld
Date:    17 May 2016 at 13:28
Subject:    Per E-Mail senden: DOC0000329040

Folgende Dateien oder Links können jetzt als Anlage mit Ihrer Nachricht
gesendet werden:

DOC0000329040

Attached is a ZIP file that matches the reference number in the subject and body text. I have only seen one sample, downloading a binary from:

katyco.net/0uh8nb7

The VirusTotal detection rate is 4/57, the comments in that report indicate that this is Locky ransomware and the C&C servers are at:

188.127.231.124 (SmartApe, Russia)
176.53.21.105 (Radore Veri Merkezi Hizmetleri, Turkey)
217.12.199.151 (ITL, Ukraine)
107.181.174.15 (Total Server Solutions, US)

Recommended blocklist:
188.127.231.124
176.53.21.105
217.12.199.151
107.181.174.15

Malware spam: Emailing: Photo 05-11-2016, 03 26 04

This spam comes with a malicious attachment:

From:    victim@victimdomain.tld
To:    victim@victimdomain.tld
Date:    11 May 2016 at 12:39
Subject:    Emailing: Photo 05-11-2016, 03 26 04

Your message is ready to be sent with the following file or link
attachments:

Photo 05-11-2016, 03 26 04


Note: To protect against computer viruses, e-mail programs may prevent
sending or receiving certain types of file attachments.  Check your e-mail
security settings to determine how attachments are handled.

It appears to come from the sender's own email address, but this is a simple forgery (explained here). Attached is a ZIP file with a name similar to Photo 05-11-2016, 03 26 04.zip (the numbers in the attachment
match the references in the email). It contains a .js file with a similar name.

Trusted third-party analysis (thank you!) shows the various scripts downloading from:

51941656.de.strato-hosting.eu/87yg7yyb
67.222.43.30/87yg7yyb
developinghands.com/87yg7yyb
gesdes.com/87yg7yyb
helpcomm.com/87yg7yyb
neihan8.tk/87yg7yyb
oldtimerfreunde-pfinztal.de/87yg7yyb
otakutamashi.cl/87yg7yyb
sarikamisotelleri.com/87yg7yyb

This drops a file with a detection rate of 3/56. This is likely to be Locky ransomware, a full analysis is pending. However an earlier Locky campaign today phoned home to:

185.82.202.170 (Host Sailor, United Arab Emirates)
88.214.236.11 (Overoptic Systems, UK / Russia)
5.34.183.40 (ITL, Ukraine)

According to a DeepViz report,  this sample has identical characteristics.

Recommended blocklist:
185.82.202.170
88.214.236.11
5.34.183.40

Malware spam: "As promised, the document you requested is attached" leads to Locky

This fairly brief spam has a malicious attachment:

From:    Alexandra Nunez
Date:    10 May 2016 at 21:10
Subject:    Re:

hi [redacted],

As promised, the document you requested is attached

Regards,

Alexandra Nunez

The name of the sender varies. Attached is a ZIP file with a name export_xls_nnn.zip or wire_xls_nnn.zip (where nnn are random letters and numbers) which contains multiple copies of the same malicious .js file (all apparently beginning urgent). These scripts download slightly different binaries from several locations including:


4hotdeals.com.au/j47sfe
stationerypoint.com.au/cnb3kjd
floranectar.com.au/er5tsd
togopp.com/vbg5gf
printjuce.com/rt5tdf
designitlikeal.com/cvb3ujd

There are probably many more download locations.

The typical detection rate for these binariesis about 12/56 [1] [2] [3] [4] [5] and automated analysis [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] shows network traffic to:

5.34.183.40 (ITL, Ukraine)
185.82.202.170 (Host Sailor, United Arab Emirates / Romania)
185.14.28.51 (ITL, Netherlands)
92.222.71.26 (OVH, France)
88.214.236.11 (Overoptic Systems, UK / Russia)

The payload is Locky ransomware

Recommended blocklist:
5.34.183.40
185.82.202.170
185.14.28.51
92.222.71.26
88.214.236.11

Malware spam: "Third Reminder - Outstanding Account" leads to Locky

This fake financial spam has a malicious attachment. It comes from random senders. Last week a fake "Second Reminder" spam was sent out.

From:    Ernestine Perkins
Date:    3 May 2016 at 08:54
Subject:    Third Reminder - Outstanding Account

 Dear Client,

We have recently sent you a number of letters to remind you that the balance of $9308.48 was overdue.
For details please check document attached to this mail


We ask again that if you have any queries or are not able to make full payment immediately, please contact us.


Regards,

Ernestine Perkins
Franchise - Sales Manager / Director - Business Co 

Attached is a ZIP file which in the samples I have seen begins with Scan_ or Document_ each one of which contains four identical copies of the same script, e.g.:

48524088_48524088 - copy (2).js
48524088_48524088 - copy (3).js
48524088_48524088 - copy (4).js
48524088_48524088 - copy.js
48524088_48524088.js

Typical detection rates for the scripts seem to be about 3/56.  The samples I have seen download a malicious binary from one of the following locations (there are probably more):

digigoweb.in/k3lxe
rfacine.com.br/z0odld
boontur.com/b2hskde

These binaries are all slightly different, with detection rates of 4 to 6 out of 56 [1] [2] [3]. Various automated analyses [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] show that this is Locky ransomware, and it phones home to:

31.184.197.126 (Petersburg Internet Network, Russia)
78.47.110.82 (Hetzner, Germany)
91.226.93.113 (Sobis, Russia)
91.219.29.64 (FLP Kochenov Aleksej Vladislavovich / uadomen.com, Ukraine)

Recommended blocklist:
31.184.197.126
78.47.110.82
91.226.93.113
91.219.29.64

Malware spam: "Second Reminder - Unpaid Invoice"

This fake financial spam leads to malware:

From:    Janis Faulkner [FaulknerJanis8359@ono.com]
Date:    29 April 2016 at 11:13
Subject:    Second Reminder - Unpaid Invoice

 We wrote to you recently reminding you of the outstanding amount of $8212.88 for Invoice number #304667, but it appears to remain unpaid.
For details please check invoice attached to this mail

Regards,

Janis Faulkner
Chief Executive Officer - Food Packaging Company 

Attached is a ZIP file with a name similar to unpaid_invoice551.zip which contains a randomly-named script. Oddly, most of the script appears to be text copy-and-pasted from the Avira website.

The scripts I have seen download slightly different binaries from the following locations:

cafeaparis.eu/f7yhsad
amatic.in/hdy3ss
zona-sezona.com.ua/hj1lsp
avcilarinpazari.com/u7udssd

VirusTotal detection rates are in the range of 8/56 to 10/56 [1] [2] [3] [4]. In addition to those reports, various automated analyses [5] [6] [7] [8] [9] show that this is Locky ransomware phoning home to:

91.234.32.19 (FOP Sedinkin Olexandr Valeriyovuch / thehost.ua, Ukraine)
83.217.8.155 (Park-web Ltd, Russia)
31.41.44.246 (Relink Ltd, Russia)
89.108.84.155 (Agava Ltd, Russia)
51.254.240.60 (Relink, Russia / OVH, France)

I strongly recommend that you block traffic to:

91.234.32.19
83.217.8.155
31.41.44.246
89.108.84.155
51.254.240.60