This malware-laden spam comes with a variety of subjects, for example:
Emailing: Invoice (79).xls
Emailing: Sheet (189).doc
Emailing: Sheet (3352).tiff
Emailing: Document (79).doc
Emailing: Invoice (443).doc
Emailing: Sheet (679).xls
Emailing: Document (291).pdf
There is no body text. Attached is a .docm file with the same prefix as the subject (e.g. Document (291).pdf.docm) which contains a macro that downloads a malicious component from one of the following locations:
abi64.com/h78r3gfe
bikepaintpureworks.web.fc2.com/h78r3gfe
brupuoli.tempsite.ws/h78r3gfe
composit.vtrbandaancha.net/h78r3gfe
film-online.bejbiblues.cba.pl/h78r3gfe
ftp.bergamo.chiesacattolica.it/h78r3gfe
innal.com.mx/h78r3gfe
karnat.cba.pl/h78r3gfe
mbc.nekonikoban.org/h78r3gfe
potato.chottu.net/h78r3gfe
schello4u.de/h78r3gfe
tyouseikan.web.fc2.com/h78r3gfe
www.agriturismolapiana.net/h78r3gfe
www.artistsagainstwar.it/h78r3gfe
www.bwmodels.com/h78r3gfe
www.comunedicanischio.it/h78r3gfe
www.ekstraciuchy.pl/h78r3gfe
www.kishazy.hu/h78r3gfe
(Thank you to my usual source for this). The payload is Locky ransomware and the C2 servers are those found here.
Thursday, 4 August 2016
Malware spam: "Emailing: Sheet / Document / Invoice" with a .docm leads to Locky
Malware spam: "Business card" / "I have attached the new business card design." leads to Locky
This spam email has a malicious attachment:
This Hybrid Analysis of the script gives plenty of detail as to what is going on. My trusted sources tell me that the list of download locations is quite short:
escapegasmech.com/048220y5
goldjinoz.com/0a3tg
platimunjinoz.ws/13fo8lnl
regeneratewert.ws/1qvvu9lu
traveltotre.in/2c4ykij7
This drops a binary with a detection rate of 8/54. The earlier Hybrid Analysis report shows it phoning home to:
31.41.46.29/php/upload.php (Relink Ltd, Russia) [hostname: ip.cishost.ru]
185.129.148.19/php/upload.php (MWTV, Latvia)
91.219.29.35/php/upload.php (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine) [hostname: 35.29.219.91.colo.ukrservers.com]
All of those network blocks have a pretty poor reputation and I recommend that you block their entire ranges.
Recommended blocklist:
31.41.40.0/21
185.129.148.0/24
91.219.28.0/22
From: Glenna JohnsonSender names and that long hexadecimal number with vary. Attached is a randomly-named ZIP file containing a malicious .js script beginning with "business card" [example]. The payload appears to be Locky ransomware.
Date: 4 August 2016 at 10:18
Subject: Business card
Hello [redacted],
I have attached the new business card design.
Please let me know if you need a change
King regards,
Glenna Johnson
c75b53fd1ea488ebe8eaf068fd5c9dd13f1848f4d3a7
This Hybrid Analysis of the script gives plenty of detail as to what is going on. My trusted sources tell me that the list of download locations is quite short:
escapegasmech.com/048220y5
goldjinoz.com/0a3tg
platimunjinoz.ws/13fo8lnl
regeneratewert.ws/1qvvu9lu
traveltotre.in/2c4ykij7
This drops a binary with a detection rate of 8/54. The earlier Hybrid Analysis report shows it phoning home to:
31.41.46.29/php/upload.php (Relink Ltd, Russia) [hostname: ip.cishost.ru]
185.129.148.19/php/upload.php (MWTV, Latvia)
91.219.29.35/php/upload.php (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine) [hostname: 35.29.219.91.colo.ukrservers.com]
All of those network blocks have a pretty poor reputation and I recommend that you block their entire ranges.
Recommended blocklist:
31.41.40.0/21
185.129.148.0/24
91.219.28.0/22
Wednesday, 3 August 2016
Malware spam: "Confirmation letter" leads to Locky
Another spam run leading to Locky ransomware..
From: Mavis Howe [Howe.4267@croestate.com]The name of the sender varies from email to email. The malicious attachment and payload seem very close to the one described here.
Date: 3 August 2016 at 13:32
Subject: Confirmation letter
Hi [redacted],
I attached the employment confirmation letter I prepared.
Please check it before you send it out.
Best regards
Mavis Howe
Labels:
Locky,
Malware,
Ransomware,
Spam,
Viruses
Malware spam: "As you directed, I send the attachment containing the data about the new invoices"
Another day, another Locky ransomware run:
Attached is a randomly-named ZIP file which contains a highly obfuscated .js script which according to this Malwr analysis downloads a binary from..
blog-aida.cba.pl/2zensi7t
..when decrypted it creates a binary with a detection rate of 4/54. That same Malwr analysis shows it phoning home to:
93.170.104.20/php/upload.php (Breezle LLC, Netherlands) [hostname: pundik.rus.1vm.in]
This IP was seen last night and it seems that there is a concurrent Locky spam run phoning home to:
185.129.148.19/php/upload.php (MWTV, Latvia)
89.108.127.160/php/upload.php (Agava, Russia) [hostname: srv1129.commingserv.com]
Both those IPs are in known bad blocks.
Recommended blocklist:
93.170.104.20
185.129.148.0/24
89.108.127.0/24
From: Marian Mcgowan
Date: 3 August 2016 at 11:15
Subject: Fw: New invoices
As you directed, I send the attachment containing the data about the new invoices
Attached is a randomly-named ZIP file which contains a highly obfuscated .js script which according to this Malwr analysis downloads a binary from..
blog-aida.cba.pl/2zensi7t
..when decrypted it creates a binary with a detection rate of 4/54. That same Malwr analysis shows it phoning home to:
93.170.104.20/php/upload.php (Breezle LLC, Netherlands) [hostname: pundik.rus.1vm.in]
This IP was seen last night and it seems that there is a concurrent Locky spam run phoning home to:
185.129.148.19/php/upload.php (MWTV, Latvia)
89.108.127.160/php/upload.php (Agava, Russia) [hostname: srv1129.commingserv.com]
Both those IPs are in known bad blocks.
Recommended blocklist:
93.170.104.20
185.129.148.0/24
89.108.127.0/24
Labels:
Latvia,
Locky,
Malware,
Netherlands,
Ransomware,
Russia,
Spam,
Viruses
Tuesday, 2 August 2016
Malware spam: "Unable to deliver your item, #000179376" / "FedEx International Ground" leads to ransomware
This fake FedEx email has a malicious attachment.
opros.mskobr.ru
alacahukuk.com
www.ortoservis.ru
aksoypansiyon.com
samurkasgrup.com
Three of those domains are on the same IP (77.245.148.51), so we can assume that the server is completely compromised. If we extend that principle to the other servers then you might want to block traffic to:
195.208.64.20 (ROSNIIROS, Russia)
77.245.148.51 (Bilisim Teknolojileri Yazilim San. Tic. Ltd. Sti., Turkey)
5.101.153.32 (Beget Ltd, Russia)
A couple of binaries are dropped onto the system, a.exe (detection rate 2/53) [may not be malicious] and a2.exe (detection rate 7/53).
The payload seems to be Nemucod / Crypted or some related ransomware.
Recommended blocklist:
195.208.64.20
77.245.148.51
5.101.153.32
From: FedEx International Ground [terry.mcnamara@luxmap.com]Attached is a ZIP file FedEx_ID_000179376.zip which contains a malicious script FedEx_ID_000179376.doc.js which is highly obfuscated but which becomes clearer when deobfuscated. This Hybrid Analysis on the sample shows that the script downloads ransomware from opros.mskobr.ru but a quick examination of the code reveals several download locations:
Date: 2 August 2016 at 18:53
Subject: [REDACTED], Unable to deliver your item, #000179376
Dear [Redacted],
This is to confirm that one or more of your parcels has been shipped.
Please, open email attachment to print shipment label.
Thanks and best regards,
Terry Mcnamara,
Support Manager.
opros.mskobr.ru
alacahukuk.com
www.ortoservis.ru
aksoypansiyon.com
samurkasgrup.com
Three of those domains are on the same IP (77.245.148.51), so we can assume that the server is completely compromised. If we extend that principle to the other servers then you might want to block traffic to:
195.208.64.20 (ROSNIIROS, Russia)
77.245.148.51 (Bilisim Teknolojileri Yazilim San. Tic. Ltd. Sti., Turkey)
5.101.153.32 (Beget Ltd, Russia)
A couple of binaries are dropped onto the system, a.exe (detection rate 2/53) [may not be malicious] and a2.exe (detection rate 7/53).
The payload seems to be Nemucod / Crypted or some related ransomware.
Recommended blocklist:
195.208.64.20
77.245.148.51
5.101.153.32
Monday, 1 August 2016
Malware spam: "Please review the attached corrected annual report." / "Corrected report"
This spam comes with a malicious attachment:
121.83.206.211/~ftp-yama/9z6nu
12-land.co.jp/gyukmx
209.202.52.42/~wevugoja/eijz2y
213.228.128.12/~joaod/2xbjbu
213.228.128.12/~joaod/74ujkijl
217.26.70.200/~pitagora/4nm1k
218.228.19.9/~yossi/9ssfpkz
67.23.226.139/~jneccsio/2egblt4m
79.96.153.93/cxzlkz
80.109.240.71/~r.theeuwes/6c1arl9
abufarha.net/55hhso
akeseverin.com/audqp
akva-sarat.nichost.ru/xc2kao
arogyaforhealth.com/l9bwo0
b-doors.ru/l65n0 - hash
bisericaromaneasca.ro/jzvtuc
bobbysinghwpg.com/k3v1t3v4
canplus.fc2web.com/faepi1
certifiedbanker.org/lg305
climairuk.com/kmbw8q
clinic.gov.ua/sku4ql
darkhollowcoffee.com/n69xfk
darkhollowcoffee.com/xlbps
enexp.ru/r2wbp6
fotografuj.pl/8hotlfc2
fotografuj.pl/y4m2b
gp-logistics.ru/uwkop
keven.site.aplus.net/rb9skl
krovgid.ru/wooq2
libertymanuals.com/o97dh92i
mobile-kontent.com/ou6ne
openspace.pro/teg7qur
paletteswapninja.com/~playre5/0mxupm8q
programistyczni.strefa.pl/j7xk8c
ramsayconstruction.ca/b27ix9s
rom-stroy.ru/s0kphjat
schlebach.25mm.ru/ycz6sn
seahawkexports.com/7954qp3a
shagunproperty.com/8ikrr
sigovka.ru/w790cg8h
steelfs.com.mx/00ucikvv
stroymonolit.su/7oiy5i8
tvoy-android.com/i8rsoei
u2319351.plsk.regruhosting.ru/vsfvyj1j
ultramarincentr.ru/jtmms
uxeurope.com/~guest/7rj3px
visionaero.com/9grdv
wordpress.pro-tiler.ru/mk9yi4wl
www.robtozier.com/bg58a
The dropped binary then attempts to phone home to:
91.230.211.139/upload/_dispatch.php (Optizon Ltd, Russia) [hostname evradikfreeopti.ru]
37.139.30.95/upload/_dispatch.php (Digital Ocean, Netherlands) [hostname belyi.myeasy.ru]
91.219.29.48/upload/_dispatch.php (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine)
The host for that last one comes up over and over again, it's time to block that /22..
Recommended blocklist:
91.230.211.139
37.139.30.95
91.219.28.0/22
Subject: Corrected reportThe name of the sender will vary. Attached is a ZIP file with a random name, containing a malicious .WSF script beginning with "annual report". This attempts to download Locky ransomware from one of the following locations (thank you to my usual source for analysis):
From: Joey Cox (Cox.48@sodetel.net.lb)
Date: Monday, 1 August 2016, 13:37
Dear webmaster,
Please review the attached corrected annual report.
Yours faithfully
Joey Cox
121.83.206.211/~ftp-yama/9z6nu
12-land.co.jp/gyukmx
209.202.52.42/~wevugoja/eijz2y
213.228.128.12/~joaod/2xbjbu
213.228.128.12/~joaod/74ujkijl
217.26.70.200/~pitagora/4nm1k
218.228.19.9/~yossi/9ssfpkz
67.23.226.139/~jneccsio/2egblt4m
79.96.153.93/cxzlkz
80.109.240.71/~r.theeuwes/6c1arl9
abufarha.net/55hhso
akeseverin.com/audqp
akva-sarat.nichost.ru/xc2kao
arogyaforhealth.com/l9bwo0
b-doors.ru/l65n0 - hash
bisericaromaneasca.ro/jzvtuc
bobbysinghwpg.com/k3v1t3v4
canplus.fc2web.com/faepi1
certifiedbanker.org/lg305
climairuk.com/kmbw8q
clinic.gov.ua/sku4ql
darkhollowcoffee.com/n69xfk
darkhollowcoffee.com/xlbps
enexp.ru/r2wbp6
fotografuj.pl/8hotlfc2
fotografuj.pl/y4m2b
gp-logistics.ru/uwkop
keven.site.aplus.net/rb9skl
krovgid.ru/wooq2
libertymanuals.com/o97dh92i
mobile-kontent.com/ou6ne
openspace.pro/teg7qur
paletteswapninja.com/~playre5/0mxupm8q
programistyczni.strefa.pl/j7xk8c
ramsayconstruction.ca/b27ix9s
rom-stroy.ru/s0kphjat
schlebach.25mm.ru/ycz6sn
seahawkexports.com/7954qp3a
shagunproperty.com/8ikrr
sigovka.ru/w790cg8h
steelfs.com.mx/00ucikvv
stroymonolit.su/7oiy5i8
tvoy-android.com/i8rsoei
u2319351.plsk.regruhosting.ru/vsfvyj1j
ultramarincentr.ru/jtmms
uxeurope.com/~guest/7rj3px
visionaero.com/9grdv
wordpress.pro-tiler.ru/mk9yi4wl
www.robtozier.com/bg58a
The dropped binary then attempts to phone home to:
91.230.211.139/upload/_dispatch.php (Optizon Ltd, Russia) [hostname evradikfreeopti.ru]
37.139.30.95/upload/_dispatch.php (Digital Ocean, Netherlands) [hostname belyi.myeasy.ru]
91.219.29.48/upload/_dispatch.php (FLP Kochenov Aleksej Vladislavovich aka uadomen.com, Ukraine)
The host for that last one comes up over and over again, it's time to block that /22..
Recommended blocklist:
91.230.211.139
37.139.30.95
91.219.28.0/22
Labels:
Locky,
Malware,
Netherlands,
Ransomware,
Russia,
Spam,
Ukraine,
Viruses
Scam: Fanrong Europe Fund / fanrongfund.info / fanrongeuropefund.info / fanrongeuropefund.com
This spam email advertising a "too good to be true" investment is a scam:
Registrant ID: JLD4030131633
Registrant Name: James Dean
Registrant Organization:
Registrant Street: Vorstadt 20
Registrant City: Zug
Registrant State/Province:
Registrant Postal Code: 6300
Registrant Country: CH
Registrant Phone: +41.417120101
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: jd767@yahoo.com
The site is hosted (apparently) in the British Virgin Islands on an IP allocated to the Public Domain Registry (PDR). It uses nameservers from Russian company AYBHOST.COM.
The website is pretty generic looking and opens with these words of wisdom:
What next. "Buy low, sell high"? Here are some screenshots in case you see another version of this on your travels:
The "About" page carries this text:
fanrongfund.info appears to have mirrors at:
fanrongeuropefund.info
fanrongeuropefund.com
Both of these are hosted on 46.4.24.196 (Hetzner, Germany). The WHOIS details for those are inconsistent with each other.
fanrongeuropefund.info
Registrant ID: HSM1859139253
Registrant Name: Hans Messner
Registrant Organization: Fanrong Europe Fund
Registrant Street: Leutschenbachstrasse 95
Registrant City: Zurich
Registrant State/Province: Zurich
Registrant Postal Code: 8050
Registrant Country: CH
Registrant Phone: +41.445632589
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: info@fanrongeuropefund.info
fanrongeuropefund.com
Registry Registrant ID: Not Available From Registry
Registrant Name: Li Yong
Registrant Organization:
Registrant Street: Schwingerstrasse 9
Registrant City: Zurich
Registrant State/Province: Zurich
Registrant Postal Code: 8006
Registrant Country: CH
Registrant Phone: +41.442289632
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: info@fanrongeuropefund.com
For completeness, the domain fanrongcapital.com is hosted on 5.100.152.26 (the same block as fanrongfund.info) and this particular corporation seems to be using a free email address..
Registry Registrant ID: Not Available From Registry
Registrant Name: Wei Zhang
Registrant Organization: Fanrong Capital
Registrant Street: 20F, 1 Harbor View Street
Registrant City: Hong Kong
Registrant State/Province: Hong Kong
Registrant Postal Code: 111000
Registrant Country: HK
Registrant Phone: +852.58085536
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: fanrongcapital@yahoo.com
Nothing about this offer is legitimate. Avoid it, or if you have invested money in this fictitious firm then you should contact the police immediately.
From: Tim Hoffman [letter@612.com]I have received two of these emails, one coming from the IPs 188.69.207.57 and 188.69.223.168 which are both allocated to a mobile phone provider in Lithuania (UPDATE: also 188.69.223.54). The website fanrongfund.info was created just a few days ago (28th July 2016) and is registed to the following (presumably fake) registrant:
To: contact [contact@victimdomain.tld]
Date: 30 July 2016 at 09:26
Subject: Fanrong Europe Fund – 1 Half 2016 return +32.69%.
Dear Sirs,
Please be informed that the Fanrong Europe Fund reported strong 1 Half 2016 with return +32.69%.
Fanrong Europe Fund is a registered hedge fund that managed by a team of stock market experts that located in Zurich, Switzerland. The Fanrong Europe Fund Strategy is Long/Short Equity. The Fund was launched in April 2014. It is open-ended hedge fund. We are open for new investors.
We welcome you to contact us through our web-site to learn more about investing with us:
www.FanrongFund.info
Kind regards,
Tim Hoffman
e-marketing manager
Fanrong Europe Fund
www.FanrongFund.info
Reply to: marketing@fanrongfund.info
If you do not want to receive this newsletter send an email to: unsubscribe@fanrongfund.info
NOTICE: Your address was obtained from open sources where you were agreed to receive the marketing information from third parties.
Registrant ID: JLD4030131633
Registrant Name: James Dean
Registrant Organization:
Registrant Street: Vorstadt 20
Registrant City: Zug
Registrant State/Province:
Registrant Postal Code: 6300
Registrant Country: CH
Registrant Phone: +41.417120101
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: jd767@yahoo.com
The site is hosted (apparently) in the British Virgin Islands on an IP allocated to the Public Domain Registry (PDR). It uses nameservers from Russian company AYBHOST.COM.
The website is pretty generic looking and opens with these words of wisdom:
Our main trade approach is:
"Close the position if it runs to loss, and hold it if it runs to profit".
Hans Messner
fund manager "Fanrong Europe Fund"
"Close the position if it runs to loss, and hold it if it runs to profit".
Hans Messner
fund manager "Fanrong Europe Fund"
What next. "Buy low, sell high"? Here are some screenshots in case you see another version of this on your travels:
The "About" page carries this text:
We are the EU-domiciled investment manager with successful experience in stock trade in EU. Our professional assets managers have personal approach to trade with bear and bulls market. We use self-made investment strategy that allows getting the constant positive result in short-term horizon. All investment process is in full accordance with IIS (International Investment Standards) of Fanrong Capital (Hong Kong) (fanrongcapital.com).Presumably this is copied off an earlier scam site, in this case there is an official warning about that particular firm.
fanrongfund.info appears to have mirrors at:
fanrongeuropefund.info
fanrongeuropefund.com
Both of these are hosted on 46.4.24.196 (Hetzner, Germany). The WHOIS details for those are inconsistent with each other.
fanrongeuropefund.info
Registrant ID: HSM1859139253
Registrant Name: Hans Messner
Registrant Organization: Fanrong Europe Fund
Registrant Street: Leutschenbachstrasse 95
Registrant City: Zurich
Registrant State/Province: Zurich
Registrant Postal Code: 8050
Registrant Country: CH
Registrant Phone: +41.445632589
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: info@fanrongeuropefund.info
fanrongeuropefund.com
Registry Registrant ID: Not Available From Registry
Registrant Name: Li Yong
Registrant Organization:
Registrant Street: Schwingerstrasse 9
Registrant City: Zurich
Registrant State/Province: Zurich
Registrant Postal Code: 8006
Registrant Country: CH
Registrant Phone: +41.442289632
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: info@fanrongeuropefund.com
For completeness, the domain fanrongcapital.com is hosted on 5.100.152.26 (the same block as fanrongfund.info) and this particular corporation seems to be using a free email address..
Registry Registrant ID: Not Available From Registry
Registrant Name: Wei Zhang
Registrant Organization: Fanrong Capital
Registrant Street: 20F, 1 Harbor View Street
Registrant City: Hong Kong
Registrant State/Province: Hong Kong
Registrant Postal Code: 111000
Registrant Country: HK
Registrant Phone: +852.58085536
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: fanrongcapital@yahoo.com
Nothing about this offer is legitimate. Avoid it, or if you have invested money in this fictitious firm then you should contact the police immediately.
Labels:
Finance Scams,
Hetzner,
Lithuania,
Russia,
Scam,
Scams,
Spam,
Switzerland
Friday, 29 July 2016
Malware spam: "Voicemail from Anonymous" / SureVoIP [voicemailandfax@surevoip.co.uk]
This fake voicemail spam has a malicious attachment:
According to my trusted source (thank you as ever):
64.22.100.95/78h8ry
A1Engg.com/9u8jreve
am-i-evil.de/n3rv3rv
avaretv.atspace.com/n3rv3rv
cieslakwz.cba.pl/9u8jreve
curionaut.web.fc2.com/78h8ry
gim24.y0.pl/9u8jreve
guessen.privat.t-online.de/9u8jreve
gurannbania03.web.fc2.com/9u8jreve
hanokenko.web.fc2.com/n3rv3rv
hokkatsu6.web.fc2.com/78h8ry
kapiti-alpaca.co.nz/78h8ry
kathrin18.edv-kamue.de/78h8ry
kimani.dommel.be/n3rv3rv
martinezlabalsa.atspace.org/78h8ry
melzer-ferienwohnung.de/78h8ry
mertenitalia.atspace.com/78h8ry
paris82nana.cafe24.com/78h8ry
pixelacker.de/9u8jreve
rakurakutuuhang.web.fc2.com/n3rv3rv
rhodins.nu/n3rv3rv
sandalcraft.cba.pl/9u8jreve
shinryu1226.web.fc2.com/78h8ry
sspbadecz.ugu.pl/9u8jreve
www.amelander.nl/78h8ry
www.arrietayasociados.es/9u8jreve
www.atiyka.home.ro/9u8jreve
www.bobp.org.uk/9u8jreve
www.cabana.it/9u8jreve
www.corama.com/n3rv3rv
www.cs-strumentazione.it/9u8jreve
www.destine.broker.go.ro/n3rv3rv
www.diegofabbri.com/n3rv3rv
www.ecologica2000srl.eu/78h8ry
www.finnform.it/n3rv3rv
www.flamarimports.com.br/n3rv3rv
www.josegbueno.jazztel.es/9u8jreve
www.malzi.mynetcologne.de/n3rv3rv
www.markomielentz.de/78h8ry
www.nieli.de/9u8jreve
www.oliooddo.com/n3rv3rv
www.professionaldga.com/78h8ry
www.suesswarentechniker.de/78h8ry
www.techninov.fr/n3rv3rv
yohollywood.50webs.com/78h8ry
The downloaded binary is Locky ransomware, phoning home to:
178.62.232.244/upload/_dispatch.php (Digital Ocean, Netherlands) [hostname:vps-110775.freedomain.in.ua]
91.195.12.143/upload/_dispatch.php (PE Astakhov Pavel Viktorovich, aka host4.biz, Ukraine)
91.230.211.139/upload/_dispatch.php (Optizon Ltd, Russia) [hostname:evradikfreeopti.ru]
Recommended blocklist:
178.62.232.244
91.195.12.143
91.230.211.139
From SureVoIP [voicemailandfax@surevoip.co.uk]The attachment is in the format msg_7b40ef3f-90a3-c2c7-2858-f9041f1023de.zip containing a malicious .wsf script with a name similar to account record =B5D=.wsf.
Date Fri, 29 Jul 2016 17:47:41 +0700
Subject Voicemail from Anonymous <Anonymous> 00:02:15
Message From "Anonymous" AnonymousCreated: Fri, 29 Jul 2016 19:45:15 +0900Duration:
00:02:37Account: victimdomain.tld
According to my trusted source (thank you as ever):
64.22.100.95/78h8ry
A1Engg.com/9u8jreve
am-i-evil.de/n3rv3rv
avaretv.atspace.com/n3rv3rv
cieslakwz.cba.pl/9u8jreve
curionaut.web.fc2.com/78h8ry
gim24.y0.pl/9u8jreve
guessen.privat.t-online.de/9u8jreve
gurannbania03.web.fc2.com/9u8jreve
hanokenko.web.fc2.com/n3rv3rv
hokkatsu6.web.fc2.com/78h8ry
kapiti-alpaca.co.nz/78h8ry
kathrin18.edv-kamue.de/78h8ry
kimani.dommel.be/n3rv3rv
martinezlabalsa.atspace.org/78h8ry
melzer-ferienwohnung.de/78h8ry
mertenitalia.atspace.com/78h8ry
paris82nana.cafe24.com/78h8ry
pixelacker.de/9u8jreve
rakurakutuuhang.web.fc2.com/n3rv3rv
rhodins.nu/n3rv3rv
sandalcraft.cba.pl/9u8jreve
shinryu1226.web.fc2.com/78h8ry
sspbadecz.ugu.pl/9u8jreve
www.amelander.nl/78h8ry
www.arrietayasociados.es/9u8jreve
www.atiyka.home.ro/9u8jreve
www.bobp.org.uk/9u8jreve
www.cabana.it/9u8jreve
www.corama.com/n3rv3rv
www.cs-strumentazione.it/9u8jreve
www.destine.broker.go.ro/n3rv3rv
www.diegofabbri.com/n3rv3rv
www.ecologica2000srl.eu/78h8ry
www.finnform.it/n3rv3rv
www.flamarimports.com.br/n3rv3rv
www.josegbueno.jazztel.es/9u8jreve
www.malzi.mynetcologne.de/n3rv3rv
www.markomielentz.de/78h8ry
www.nieli.de/9u8jreve
www.oliooddo.com/n3rv3rv
www.professionaldga.com/78h8ry
www.suesswarentechniker.de/78h8ry
www.techninov.fr/n3rv3rv
yohollywood.50webs.com/78h8ry
The downloaded binary is Locky ransomware, phoning home to:
178.62.232.244/upload/_dispatch.php (Digital Ocean, Netherlands) [hostname:vps-110775.freedomain.in.ua]
91.195.12.143/upload/_dispatch.php (PE Astakhov Pavel Viktorovich, aka host4.biz, Ukraine)
91.230.211.139/upload/_dispatch.php (Optizon Ltd, Russia) [hostname:evradikfreeopti.ru]
Recommended blocklist:
178.62.232.244
91.195.12.143
91.230.211.139
Labels:
Locky,
Malware,
Netherlands,
Ransomware,
Russia,
Spam,
Ukraine,
Viruses,
Voice Mail
Malware spam: "Bank account record" leads to Locky
This fake financial spam leads to malware:
The sender will vary from email to email, but the "From" name is always consistent with the one in the email. Attacked is a ZIP file with a random hexadecimal number which in the sample I am looking at contains a malicious .wsf script starting with the words "account record" (sample here).
According to the Hybrid Analysis on that script and Malwr report on a partly deobfuscated version the script downloads a binary from:
oleanderhome.com/q59ldt5r
This dropped binary has a detection rate of 5/55 and is presumably Locky ransomware, but automated analysis is inconclusive [1] [2].
The is also traffic to kassa.p0.ru which is more of a puzzle and doesn't look particularly malicious. I don't know if that is common to all scripts, but it might be worth looking out for in your traffic logs.
If I get more information on this I will post it here.
UPDATE
My trusted source (thank you) gives the following download locations:
211.18.200.4/~tlas021/3rwcozqv
80.241.232.207/fefj1r
agazoumi.com/t30z6j8
alci.dommel.be/clf26lu
amandinearmand.perso.sfr.fr/6piy70m
azmusclemart.com/pb79s
bartocha-photography.com/~fib-naturfoto/99xny
blekitniproba.cba.pl/fo1k6o
chelmy.cba.pl/yv7h2r3
childmoon.web.fc2.com/coy0nl
fcc-thechamps.de/6g5vo1a
garo903.web.fc2.com/2mf4v0
handball-literatur.de/3ua7j
happurg-schulanger.atspace.org/0s6lyu6
hw.srca.org/iwg54jh
impregui.com/h3cywm
inhouserecording.atspace.com/t4wj9316
intracorpwestsidecollection.com/ifs0j92
joslinsalesltd.com/kro1gx
jyoumon.web.fc2.com/7tcec
kenestyonline.com/h782hd
minocki.republika.pl/nvlx7
minocki.republika.pl/s125d6
newt150.tripod.com/4bcsv
oleanderhome.com/q59ldt5r
ratnam.fx.perso.sfr.fr/vtpm9k
senzai.nobu-naga.net/2jv74
smc.psuti.ru/3rcxu
theuniongroup.com/5sv0c
tomart3d.cba.pl/3ivctw
voisin-sa.com/~voisin9689/vnsaumj
vova318.vline.ru/mkmkr
wbbs176.web.fc2.com/20srj
wktkwkbaaan.web.fc2.com/0mm9qx
wn420pjpa.homepage.t-online.de/046ss5
www.13one.de/vz8gl5a
www.astool.com/ljgzai
www.attivita-antroposofiche-roma.org/gpjjr5u
www.damasoinfante.com/7pmfw
www.dukewayne.talktalk.net/todga
www.erikacostruzioni.com/0z1hkf
www.ferresur.es/3k58w8z
www.fotosdelburgo.com/oerwg1
www.frank-nickel.de/7e46f9t5
www.hydroenergie.fr/yzhhkit
www.istruiscus.it/qzdy65b0
www.istruiscus.it/r5ncu
www.kassa.p0.ru
www.snvl-ptrc.go.ro/srhgx
zauber-fred.de/0zth9jfv
C2 servers are the same as found here.
178.62.232.244/upload/_dispatch.php (Digital Ocean, Netherlands) [hostname:vps-110775.freedomain.in.ua]
91.195.12.143/upload/_dispatch.php (PE Astakhov Pavel Viktorovich, aka host4.biz, Ukraine)
91.230.211.139/upload/_dispatch.php (Optizon Ltd, Russia) [hostname:evradikfreeopti.ru]
Recommended blocklist:
178.62.232.244
91.195.12.143
91.230.211.139
Subject: Bank account record
From: Stephen Ford (Ford.24850@aworkofartcontracting.com)
Date: Friday, 29 July 2016, 10:56
Good morning,
Did you forget to finish the Bank account record?
Read the attachment and let me know if there is anything I didn't make clear.
Yours sincerely,
Stephen Ford
57ad5eceb5e68fe97525ff408e9da2ecda5a97be6743bbe0fe
The sender will vary from email to email, but the "From" name is always consistent with the one in the email. Attacked is a ZIP file with a random hexadecimal number which in the sample I am looking at contains a malicious .wsf script starting with the words "account record" (sample here).
According to the Hybrid Analysis on that script and Malwr report on a partly deobfuscated version the script downloads a binary from:
oleanderhome.com/q59ldt5r
This dropped binary has a detection rate of 5/55 and is presumably Locky ransomware, but automated analysis is inconclusive [1] [2].
The is also traffic to kassa.p0.ru which is more of a puzzle and doesn't look particularly malicious. I don't know if that is common to all scripts, but it might be worth looking out for in your traffic logs.
If I get more information on this I will post it here.
UPDATE
My trusted source (thank you) gives the following download locations:
211.18.200.4/~tlas021/3rwcozqv
80.241.232.207/fefj1r
agazoumi.com/t30z6j8
alci.dommel.be/clf26lu
amandinearmand.perso.sfr.fr/6piy70m
azmusclemart.com/pb79s
bartocha-photography.com/~fib-naturfoto/99xny
blekitniproba.cba.pl/fo1k6o
chelmy.cba.pl/yv7h2r3
childmoon.web.fc2.com/coy0nl
fcc-thechamps.de/6g5vo1a
garo903.web.fc2.com/2mf4v0
handball-literatur.de/3ua7j
happurg-schulanger.atspace.org/0s6lyu6
hw.srca.org/iwg54jh
impregui.com/h3cywm
inhouserecording.atspace.com/t4wj9316
intracorpwestsidecollection.com/ifs0j92
joslinsalesltd.com/kro1gx
jyoumon.web.fc2.com/7tcec
kenestyonline.com/h782hd
minocki.republika.pl/nvlx7
minocki.republika.pl/s125d6
newt150.tripod.com/4bcsv
oleanderhome.com/q59ldt5r
ratnam.fx.perso.sfr.fr/vtpm9k
senzai.nobu-naga.net/2jv74
smc.psuti.ru/3rcxu
theuniongroup.com/5sv0c
tomart3d.cba.pl/3ivctw
voisin-sa.com/~voisin9689/vnsaumj
vova318.vline.ru/mkmkr
wbbs176.web.fc2.com/20srj
wktkwkbaaan.web.fc2.com/0mm9qx
wn420pjpa.homepage.t-online.de/046ss5
www.13one.de/vz8gl5a
www.astool.com/ljgzai
www.attivita-antroposofiche-roma.org/gpjjr5u
www.damasoinfante.com/7pmfw
www.dukewayne.talktalk.net/todga
www.erikacostruzioni.com/0z1hkf
www.ferresur.es/3k58w8z
www.fotosdelburgo.com/oerwg1
www.frank-nickel.de/7e46f9t5
www.hydroenergie.fr/yzhhkit
www.istruiscus.it/qzdy65b0
www.istruiscus.it/r5ncu
www.kassa.p0.ru
www.snvl-ptrc.go.ro/srhgx
zauber-fred.de/0zth9jfv
C2 servers are the same as found here.
178.62.232.244/upload/_dispatch.php (Digital Ocean, Netherlands) [hostname:vps-110775.freedomain.in.ua]
91.195.12.143/upload/_dispatch.php (PE Astakhov Pavel Viktorovich, aka host4.biz, Ukraine)
91.230.211.139/upload/_dispatch.php (Optizon Ltd, Russia) [hostname:evradikfreeopti.ru]
Recommended blocklist:
178.62.232.244
91.195.12.143
91.230.211.139
Labels:
Locky,
Malware,
Ransomware,
Spam,
Viruses
Thursday, 28 July 2016
Malware spam: "Self Billing Statement" / Kathryn Smith [kathryn@powersolutions.com] leads to Locky
This fake financial spam comes with a malicious attachment:
Analysis by a trusted party shows that these scripts download a component from one of the following locations:
apachost.com/j988765
avon-beraterin-mank.de/j988765
cukiernia_izabela.republika.pl/j988765
dawstaw.cba.pl/j988765
gnetgnethouse.web.fc2.com/j988765
gumka.strefa.pl/j988765
kreacjonizm.cba.pl/j988765
levivanesch.nl/j988765
maka.ken-shin.net/j988765
okhtinka.ru.hoster-ok.com/j988765
robertstefan.home.ro/j988765
sardain.fr/j988765
sonomama.kan-be.com/j988765
taityou0615.web.fc2.com/j988765
tolearn.tora.ru/j988765
www.andyschwietzer.homepage.t-online.de/j988765
www.aspadeljaen.com/j988765
www.camelu.com/j988765
www.flagships.de/j988765
www.schwarzer-baer-kastl.de/j988765
www.uasm.de/j988765
This originally dropped this payload since updated to this payload, both of which are Locky ransomware. The C2 servers to block are exactly the same as found in this earlier spam run.
From Kathryn Smith [kathryn@powersolutions.com]I do not know if there is any body text at present. Attached is a file with a name similar to Self Billing Statement_431.zip which contains a similarly named malicious script (e.g. Self Billing Statement_4424.js)
Date Thu, 28 Jul 2016 16:21:41 +0530
Subject Self Billing Statement
Analysis by a trusted party shows that these scripts download a component from one of the following locations:
apachost.com/j988765
avon-beraterin-mank.de/j988765
cukiernia_izabela.republika.pl/j988765
dawstaw.cba.pl/j988765
gnetgnethouse.web.fc2.com/j988765
gumka.strefa.pl/j988765
kreacjonizm.cba.pl/j988765
levivanesch.nl/j988765
maka.ken-shin.net/j988765
okhtinka.ru.hoster-ok.com/j988765
robertstefan.home.ro/j988765
sardain.fr/j988765
sonomama.kan-be.com/j988765
taityou0615.web.fc2.com/j988765
tolearn.tora.ru/j988765
www.andyschwietzer.homepage.t-online.de/j988765
www.aspadeljaen.com/j988765
www.camelu.com/j988765
www.flagships.de/j988765
www.schwarzer-baer-kastl.de/j988765
www.uasm.de/j988765
This originally dropped this payload since updated to this payload, both of which are Locky ransomware. The C2 servers to block are exactly the same as found in this earlier spam run.
Labels:
Locky,
Malware,
Ransomware,
Spam,
Viruses
Malware spam: "Please check the attached invoice and confirm me if I sent the right data" leads to Locky
This fake financial spam leads to malware:
The Malwr analysis for the partially deobfuscated script and this Hybrid Analysis show this particular sample downloading from:
83.235.64.44/~typecent/xvsb58
This drops a malicious Locky ransomware binary with a detection rate of 7/55. Analysis of this binary is pending.
UPDATE
Thank you to my usual source for this analysis. The download locations for the various scripts are:
01ad681.netsolhost.com/7j0jlq3
12-land.co.jp/vrquj
178.78.87.8/xjzhm
83.235.64.44/~typecent/xvsb58
arabian-horse-highlights.homepage.t-online.de/kzm2n
bajasae.grupos.usb.ve/4y13jg1
baldwinhistory.portalstream.net/rqbljjx
billy-hanjo.homepage.t-online.de/2r713u
blanquerna.eresmas.net/tt2e8s4
burkersdorf.eu/8y5n3f
campustouren.de/k6tkk
christilipp.com/cnb0o
creartnet.com/5ylah
dev12.gammat.net/oxg2m3
exclusive-closet.com/fld2h8
fremdesland.x.fc2.com/iya9qt
gkxxx.x.fc2.com/dxfom
idd00dnu.eresmas.net/wdmlqe
it4cio.servicos.ws/u8c3x
jozefow.cba.pl/ouini6
karumaengeki.web.fc2.com/f3ry4
kbridge.web.fc2.com/hj1fr
lacrima.ru/hvn1c
luzdevelas.es/9belfi
mbiurorachunkowe.republika.pl/6t6sz
motorkote.org/0gq654
okhtinka.ru.hoster-ok.com/qdiqooeo
papamama.com.sg/zhbepez
piggy.riffle.be/~gniff/r9bzz
robertstefan.home.ro/pycz4o
sav-krelingen.de/36r3qe8
schefman.info/snjqz
slit.xxxxxxxx.jp/l58gd3p
sv-r.ru/btawsoc
www.acheri.it/magii
www.andyschwietzer.homepage.t-online.de/r3a0tw
www.chantale.force9.co.uk/lsyeuw
www.clefranceitalie.org/cj937f7l
www.inari.net/ov5u1k
www.kan-therm.ru/qara9i
www.marinoderosas.com/59nue8uo
www.panella.org/eo9lk
www.rgtalp14.it/ykb84n40
www.ruyssinck-demeyer.be/v4xo5r28
www.schwarzer-baer-kastl.de/tt7ea
www.uasm.de/qwqiyk
yourparty.cba.pl/5avhe
zckupila.republika.pl/m6w6uu5f
C2 locations:
178.62.232.244/upload/_dispatch.php (Digital Ocean, Netherlands)
193.124.180.6/upload/_dispatch.php (Marosnet, Russia)
139.59.147.0/upload/_dispatch.php (Digital Ocean, Germany)
Recommended blocklist:
178.62.232.244
193.124.180.6
139.59.147.0
Subject: InvoiceThe name of the sender and the hexadecimal number at the bottom varies. Attached is a randomly-named ZIP file which in the sample I analysed contains a malicious .wsf script beginning with the word "redacted".
From: Kendall Harrison (Harrison.59349@chazsmedley.com)
Date: Thursday, 28 July 2016, 10:33
Hello,
Please check the attached invoice and confirm me if I sent the right data
Yours sincerely,
Kendall Harrison
320907cb16fbe856062a081d4f925b39cb3f007b8818d40dd3
The Malwr analysis for the partially deobfuscated script and this Hybrid Analysis show this particular sample downloading from:
83.235.64.44/~typecent/xvsb58
This drops a malicious Locky ransomware binary with a detection rate of 7/55. Analysis of this binary is pending.
UPDATE
Thank you to my usual source for this analysis. The download locations for the various scripts are:
01ad681.netsolhost.com/7j0jlq3
12-land.co.jp/vrquj
178.78.87.8/xjzhm
83.235.64.44/~typecent/xvsb58
arabian-horse-highlights.homepage.t-online.de/kzm2n
bajasae.grupos.usb.ve/4y13jg1
baldwinhistory.portalstream.net/rqbljjx
billy-hanjo.homepage.t-online.de/2r713u
blanquerna.eresmas.net/tt2e8s4
burkersdorf.eu/8y5n3f
campustouren.de/k6tkk
christilipp.com/cnb0o
creartnet.com/5ylah
dev12.gammat.net/oxg2m3
exclusive-closet.com/fld2h8
fremdesland.x.fc2.com/iya9qt
gkxxx.x.fc2.com/dxfom
idd00dnu.eresmas.net/wdmlqe
it4cio.servicos.ws/u8c3x
jozefow.cba.pl/ouini6
karumaengeki.web.fc2.com/f3ry4
kbridge.web.fc2.com/hj1fr
lacrima.ru/hvn1c
luzdevelas.es/9belfi
mbiurorachunkowe.republika.pl/6t6sz
motorkote.org/0gq654
okhtinka.ru.hoster-ok.com/qdiqooeo
papamama.com.sg/zhbepez
piggy.riffle.be/~gniff/r9bzz
robertstefan.home.ro/pycz4o
sav-krelingen.de/36r3qe8
schefman.info/snjqz
slit.xxxxxxxx.jp/l58gd3p
sv-r.ru/btawsoc
www.acheri.it/magii
www.andyschwietzer.homepage.t-online.de/r3a0tw
www.chantale.force9.co.uk/lsyeuw
www.clefranceitalie.org/cj937f7l
www.inari.net/ov5u1k
www.kan-therm.ru/qara9i
www.marinoderosas.com/59nue8uo
www.panella.org/eo9lk
www.rgtalp14.it/ykb84n40
www.ruyssinck-demeyer.be/v4xo5r28
www.schwarzer-baer-kastl.de/tt7ea
www.uasm.de/qwqiyk
yourparty.cba.pl/5avhe
zckupila.republika.pl/m6w6uu5f
C2 locations:
178.62.232.244/upload/_dispatch.php (Digital Ocean, Netherlands)
193.124.180.6/upload/_dispatch.php (Marosnet, Russia)
139.59.147.0/upload/_dispatch.php (Digital Ocean, Germany)
Recommended blocklist:
178.62.232.244
193.124.180.6
139.59.147.0
Labels:
Germany,
Locky,
Malware,
Netherlands,
Ransomware,
Russia,
Spam,
Viruses
Wednesday, 27 July 2016
Malware spam: "Attached is the updated details about the company account you needed"
This spam has a malicious attachment:
beauty-jasmine.ru/6dc2y
There will be many more download locations in addition to that. It drops an executable which appears to be Locky ransomware with a detection rate of 7/55. Analysis of this payload is pending, however the C2 servers may well be the same as found here.
UPDATE
The C2 locations for this variant are:
5.9.253.173/upload/_dispatch.php (Dmitry Zheltov, Russia / Hetzner, Germany)
178.62.232.244/upload/_dispatch.php (Digital Ocean, Netherlands)
151.80.207.170/upload/_dispatch.php (Evgenij Rusachenko, Russia / OVH, France)
Recommended blocklist:
5.9.253.160/27
178.62.232.244
151.80.207.168/30
Subject: updated detailsThe spam comes from different senders with a different hexadecimal number in it. Attached is a ZIP file with a random name, containing a malicious .wsf script. Analysis of a sample shows the script download from:
From: Faith Davidson (Davidson.43198@optimaestate.com)
Date: Wednesday, 27 July 2016, 11:13
Attached is the updated details about the company account you needed
King regards
Faith Davidson
c57b98d01fd8a94bbf77f902b84f7c0ee46c514051b555c2be
beauty-jasmine.ru/6dc2y
There will be many more download locations in addition to that. It drops an executable which appears to be Locky ransomware with a detection rate of 7/55. Analysis of this payload is pending, however the C2 servers may well be the same as found here.
UPDATE
The C2 locations for this variant are:
5.9.253.173/upload/_dispatch.php (Dmitry Zheltov, Russia / Hetzner, Germany)
178.62.232.244/upload/_dispatch.php (Digital Ocean, Netherlands)
151.80.207.170/upload/_dispatch.php (Evgenij Rusachenko, Russia / OVH, France)
Recommended blocklist:
5.9.253.160/27
178.62.232.244
151.80.207.168/30
Malware spam: "Sent from my Samsung device" leads to Locky
This spam comes in a few different variations:
The subject can be "SCAN", "scan" or "COPY" with a random number. Attached is a .DOCM file with a name that matches the subject. This file contains a malicious macro which downloads a component from one of the following locations:
alldesu.web.fc2.com/j988765
dslandscape.50webs.com/j988765
gmp.home.ro/j988765
hobbyfraeser.homepage.t-online.de/j988765
italcase.ve.it/j988765
mendikurconsulting.com/j988765
uladekoracje.republika.pl/j988765
wac80v41f.homepage.t-online.de/j988765
www.holzrueckewagen.de/j988765
www.milleniumitaly.com/j988765
yogamaruco.web.fc2.com/j988765
The dropped file is Locky ransomware and it has a detection rate of 2/52. It phones home to the following locations:
5.9.253.173/upload/_dispatch.php (Dmitry Zheltov, Russia / Hetzner, Germany)
178.62.232.244/upload/_dispatch.php (Digital Ocean, Netherlands)
(Thank you to my usual source for this data)
There is nothing of value in the 5.9.253.160/27 range, and several IPs appear to have been hosting malware in the past.
Recommended blocklist:
5.9.253.160/27
178.62.232.244
From: Lottie
Date: 27 July 2016 at 10:38
Subject: scan0000510
Sent from my Samsung device
The subject can be "SCAN", "scan" or "COPY" with a random number. Attached is a .DOCM file with a name that matches the subject. This file contains a malicious macro which downloads a component from one of the following locations:
alldesu.web.fc2.com/j988765
dslandscape.50webs.com/j988765
gmp.home.ro/j988765
hobbyfraeser.homepage.t-online.de/j988765
italcase.ve.it/j988765
mendikurconsulting.com/j988765
uladekoracje.republika.pl/j988765
wac80v41f.homepage.t-online.de/j988765
www.holzrueckewagen.de/j988765
www.milleniumitaly.com/j988765
yogamaruco.web.fc2.com/j988765
The dropped file is Locky ransomware and it has a detection rate of 2/52. It phones home to the following locations:
5.9.253.173/upload/_dispatch.php (Dmitry Zheltov, Russia / Hetzner, Germany)
178.62.232.244/upload/_dispatch.php (Digital Ocean, Netherlands)
(Thank you to my usual source for this data)
There is nothing of value in the 5.9.253.160/27 range, and several IPs appear to have been hosting malware in the past.
Recommended blocklist:
5.9.253.160/27
178.62.232.244
Labels:
DOC,
Germany,
Hetzner,
Locky,
Malware,
Netherlands,
Ransomware,
Russia,
Spam,
Viruses
Tuesday, 26 July 2016
Malware spam: "list of activities" leads to Locky
This fake business spam has a malicious attachment:
akva-sarat.nichost.ru/bokkdolx
There will be many other download locations in addition to this. The downloaded file is Locky ransomware with a detection rate of 8/55. Further analysis is pending, however it is quite likely that this sample uses the same C2 servers as seen earlier today.
From "Penelope Phelps"The sender's name, company and "Security-ID" vary. Attached is a ZIP file with elements of the recipient's email address in, containing a malicious .wsf script that looks like this. This Malwr report and this Hybrid Analysis show this particular sample downloading from:
Date Tue, 26 Jul 2016 23:02:43 +1100
Subject list of activities
Hello,
Attached is the list of activities to help you arrange for the coming presentation.
Please read it carefully and write to me if you have any concern.
Warm regards,
Penelope Phelps
ALLIED MINDS LTD
Security-ID: 4d2c95a750fe26a3560ffddfe374ff5c5c064bd78fea30
akva-sarat.nichost.ru/bokkdolx
There will be many other download locations in addition to this. The downloaded file is Locky ransomware with a detection rate of 8/55. Further analysis is pending, however it is quite likely that this sample uses the same C2 servers as seen earlier today.
Labels:
Locky,
Malware,
Ransomware,
Spam,
Viruses
Malware spam: "Attached Image" leads to Locky
This spam appears to come from the user's own email address, but this is just a simple forgery. It has a malicious attachment.
www.isleofwightcomputerrepairs.talktalk.net/okp987g7v
There will be many other scripts with different download locations and perhaps other binaries. The file downloaded is Locky ransomware with a detection rate of 4/54. The Hybrid Analysis for the dropped file shows it phoning home to:
31.41.47.41/upload/_dispatch.php (Relink Ltd, Russia)
91.234.35.216/upload/_dispatch.php (FOP Sedinkin Olexandr Valeriyovuch aka thehost.ua, Ukraine)
Recommended blocklist:
31.41.47.41
91.234.35.216
From: victim@victimdomain.tldAttached is a ZIP file with a name apparently made up of random numbers, containing a malicious .js script with another random number, such as this one. In this example the script downloads a malicious binary from:
To: victim@victimdomain.tld
Date: 26 July 2016 at 10:27
Subject: Attached Image
**********************************************************************
The information in this email is confidential and may be privileged.
If you are not the intended recipient, please destroy this message
and notify the sender immediately.
**********************************************************************
www.isleofwightcomputerrepairs.talktalk.net/okp987g7v
There will be many other scripts with different download locations and perhaps other binaries. The file downloaded is Locky ransomware with a detection rate of 4/54. The Hybrid Analysis for the dropped file shows it phoning home to:
31.41.47.41/upload/_dispatch.php (Relink Ltd, Russia)
91.234.35.216/upload/_dispatch.php (FOP Sedinkin Olexandr Valeriyovuch aka thehost.ua, Ukraine)
Recommended blocklist:
31.41.47.41
91.234.35.216
Monday, 25 July 2016
Malware spam: "Emailing: Photo 25-07-2016, 34 80 10" / "Emailing: Document 25-07-2016, 72 35 48"
This spam appears to come from various senders within the victim's own domain, but this is a simple forgery. It has a malicious attachment:
Attached is a .rar archive with a name matching the subject. Inside is a malicious .js script beginning with "Photo 25-07-2016".
An alternative variant comes with a malicious Word document:
This analysis is done by my usual trusted source (thank you). These scripts and macros download a component from one of the following locations:
0urkarachi.atspace.com/7h8gbiuomp
cantrell.biz/7h8gbiuomp
czemarserwis.home.pl/7h8gbiuomp
exploromania4x4club.ro/7h8gbiuomp
finaledithon.web.fc2.com/7h8gbiuomp
koushuen.co.jp/7h8gbiuomp
moehakiba.web.fc2.com/7h8gbiuomp
ostseeurlaub-tk.homepage.t-online.de/7h8gbiuomp
r-p-b.de/7h8gbiuomp
topmanagers.claas.fr/7h8gbiuomp
tpllaw.com/7h8gbiuomp
tutomogiya.web.fc2.com/7h8gbiuomp
vplegat.dk/7h8gbiuomp
www.aproso.de/7h8gbiuomp
www.ciapparelli.com/7h8gbiuomp
www.foto-aeree.it/7h8gbiuomp
www.gruetzi.es/7h8gbiuomp
www.isleofwightcomputerrepairs.talktalk.net/7h8gbiuomp
www.louislechien.net/7h8gbiuomp
www.motoslittetrecime.com/7h8gbiuomp
www.sistronic.com.co/7h8gbiuomp
www.tridi.be/7h8gbiuomp
www.vakantiehuisjeameland.nl/7h8gbiuomp
www.westline.it/7h8gbiuomp
zemlya.web.fc2.com/7h8gbiuomp
The payload here is Locky ransomware, and it phones home to the following addresses:
77.222.54.202/upload/_dispatch.php (SpaceWeb CJSC, Russia)
194.1.236.126/upload/_dispatch.php (Internet Hosting Ltd, Russia)
185.117.153.176/upload/_dispatch.php (Marosnet, Russia)
Recommended blocklist:
77.222.54.202
194.1.236.126
185.117.153.176
From: Rebeca [Rebeca3@victimdomain.tld]
Date: 25 July 2016 at 10:16
Subject: Emailing: Photo 25-07-2016, 34 80 10
Your message is ready to be sent with the following file or link
attachments:
Photo 25-07-2016, 34 80 10
Note: To protect against computer viruses, e-mail programs may prevent
sending or receiving certain types of file attachments. Check your e-mail
security settings to determine how attachments are handled.
Attached is a .rar archive with a name matching the subject. Inside is a malicious .js script beginning with "Photo 25-07-2016".
An alternative variant comes with a malicious Word document:
From: Alan [Alan306@victimdomain.tld]The attachment is this case is a .DOCM filed named in a similar way as before.
Date: 25 July 2016 at 12:40
Subject: Emailing: Document 25-07-2016, 72 35 48
Your message is ready to be sent with the following file or link
attachments:
Document 25-07-2016, 72 35 48
Note: To protect against computer viruses, e-mail programs may prevent
sending or receiving certain types of file attachments. Check your e-mail
security settings to determine how attachments are handled.
This analysis is done by my usual trusted source (thank you). These scripts and macros download a component from one of the following locations:
0urkarachi.atspace.com/7h8gbiuomp
cantrell.biz/7h8gbiuomp
czemarserwis.home.pl/7h8gbiuomp
exploromania4x4club.ro/7h8gbiuomp
finaledithon.web.fc2.com/7h8gbiuomp
koushuen.co.jp/7h8gbiuomp
moehakiba.web.fc2.com/7h8gbiuomp
ostseeurlaub-tk.homepage.t-online.de/7h8gbiuomp
r-p-b.de/7h8gbiuomp
topmanagers.claas.fr/7h8gbiuomp
tpllaw.com/7h8gbiuomp
tutomogiya.web.fc2.com/7h8gbiuomp
vplegat.dk/7h8gbiuomp
www.aproso.de/7h8gbiuomp
www.ciapparelli.com/7h8gbiuomp
www.foto-aeree.it/7h8gbiuomp
www.gruetzi.es/7h8gbiuomp
www.isleofwightcomputerrepairs.talktalk.net/7h8gbiuomp
www.louislechien.net/7h8gbiuomp
www.motoslittetrecime.com/7h8gbiuomp
www.sistronic.com.co/7h8gbiuomp
www.tridi.be/7h8gbiuomp
www.vakantiehuisjeameland.nl/7h8gbiuomp
www.westline.it/7h8gbiuomp
zemlya.web.fc2.com/7h8gbiuomp
The payload here is Locky ransomware, and it phones home to the following addresses:
77.222.54.202/upload/_dispatch.php (SpaceWeb CJSC, Russia)
194.1.236.126/upload/_dispatch.php (Internet Hosting Ltd, Russia)
185.117.153.176/upload/_dispatch.php (Marosnet, Russia)
Recommended blocklist:
77.222.54.202
194.1.236.126
185.117.153.176
Friday, 22 July 2016
Malware spam: "I am truly sorry that I was not available at the time you called me yesterday."
This spam has a malicious attachment:
The sender is randomly generated. Attached is a ZIP file combining elements of the recipients email address and a random number, which in turn contains a malicious .wsf script beginning with "sales report".
In a change from recent malware runs, the script does not directly download a binary from a remote location but instead has the entire binary executable Base64 encoded in the script.
This executable has a detection rate of 4/54 and trusted analysis says that it is Locky ransomware, phoning home to:
77.222.54.202/upload/_dispatch.php (SpaceWeb CJSC, Russia)
194.1.236.126/upload/_dispatch.php (Internet Hosting Ltd, Russia)
185.117.153.176/upload/_dispatch.php (Marosnet, Russia)
176.111.63.51/upload/_dispatch.php (United Networks of Ukraine Ltd, Ukraine)
Recommended blocklist:
77.222.54.202
194.1.236.126
185.117.153.176
176.111.63.51
From: "Lizzie Carpenter"
Subject: sales report
Date: Fri, 22 Jul 2016 21:38:25 +0800
I am truly sorry that I was not available at the time you called me yesterday.
I attached the report with details on sales figures.
----- Best of luck, Lizzie Carpenter
SCHRODER GLOBAL REAL ESTATE SEC LTD Phone: +1 (773) 812-15-66 Fax: +1 (773) 812-15-86
The sender is randomly generated. Attached is a ZIP file combining elements of the recipients email address and a random number, which in turn contains a malicious .wsf script beginning with "sales report".
In a change from recent malware runs, the script does not directly download a binary from a remote location but instead has the entire binary executable Base64 encoded in the script.
This executable has a detection rate of 4/54 and trusted analysis says that it is Locky ransomware, phoning home to:
77.222.54.202/upload/_dispatch.php (SpaceWeb CJSC, Russia)
194.1.236.126/upload/_dispatch.php (Internet Hosting Ltd, Russia)
185.117.153.176/upload/_dispatch.php (Marosnet, Russia)
176.111.63.51/upload/_dispatch.php (United Networks of Ukraine Ltd, Ukraine)
Recommended blocklist:
77.222.54.202
194.1.236.126
185.117.153.176
176.111.63.51
Labels:
Locky,
Malware,
Ransomware,
Spam,
Viruses
Marketing1.net spam: "Nous vous offrons toutes nos bases de données européennes avant de fermer"
I recently noted that the spammers at Marketing1.net were at it again, but despite assurances from their host Coreix that they had been suspended, they continue to send out spam. This time in French.
The link in the email goes to marketing1.site hosted on 66.96.161.163 (Endurance International Group, US) and then redirects to a landing page at marketing1apps.net on 89.187.85.8 (Coreix, UK) which is just a gateway to marketing1.net on that same IP. The email comes from 87.253.234.168, a Mailjet IP in France.
As I mentioned previously, Marketing1.net are always having a closing down sale (but never close down) and if their sample data is anything to go by, it is complete crap. That's in addition to spamming domain contacts. Avoid.
From: Audrey Martin [info@mapps-fr.net] via bnc3.mailjet.com
Date: 22 July 2016 at 09:10
Subject: Nous vous offrons toutes nos bases de données européennes avant de fermer
Signed by: bnc3.mailjet.com
Cher Gérant, Chère Gérante,
Nous nous permettons de vous contacter car vous avez visité notre site Internet dans le passé. Comme vous le savez déjà peut-être, nous avons développé les plus grands annuaires d'entreprises sur CD en Europe. Le logiciel fourni avec les annuaires permet aux utilisateurs d'effectuer des recherches illimitées par secteur d'activité, lieu, tranche de revenus ou fonction, et d'exporter les résultats vers Excel.
Au cours de ces dernières années, des milliers d'entreprises à travers l'Europe ont utilisé nos applications pour générer des listes ciblées pour mener des campagnes de prospection à succès. Nous avons décidé de retirer nos produits du marché parce que la mise à jour des données est trop onéreuse.
Avant de fermer, nous avons décidé, comme ultime geste, de vous offrir quelque chose d'inimaginable.
Nous avons décidé de vous donner toutes nos bases de données européennes. Cela représente un accès à des millions d'entreprises à travers l'Europe. Si vous souhaitez développer votre entreprise à l'étranger maintenant ou dans l'avenir, cela est un cadeau exceptionnel.
Nous vous offrons les 7 applications suivantes:
1) Marketing1 France 2016: 5 million d'entreprises françaises. 650'000 entreprises avec email. export illimité.
2) Top Managers France 2015: 35'000 cadres supérieurs auprès des plus grandes entreprises de France. e-mail fourni avec chaque enregistrement. Base de données complète fournie sous format Excel.
3) Marketing1 UK (Royaume-Uni) 2016 (en anglais): 5,8 million d'entreprises britanniques. 800'000 entreprises avec email. export illimité.
4) Top Managers UK (Royaume-Uni) 2015: 30'000 cadres supérieurs auprès des plus grandes entreprises du Royaume-Uni. e-mail fourni avec chaque enregistrement. Base de données complète fournie sous format Excel.
5) Marketing1 Belgique 2015 (en anglais): 1,8 million d'entreprises belges. 500'000 entreprises avec email. export illimité.
6) Marketing1 Allemagne 2016 (en allemand): 5 million d'entreprises allemandes. 1,7 million d'entreprises avec email. export illimité.
7) Top Managers Allemagne 2015: 50'000 cadres supérieurs auprès des plus grandes entreprises d'Allemagne. e-mail fourni avec chaque enregistrement. Base de données complète fournie sous format Excel.
La valeur pour toutes ces bases de données est d'environ 5000 euros. Nous vous offrons le tout pour un prix symbolique de 49 euros. Vous avez seulement à payer 49 euros et vous obtiendrez toutes les applications ci-dessus. L'offre se termine aujourd'hui à 17 heures.
Vous aurez accès immédiatement à une page de téléchargement depuis laquelle vous pouvez télécharger toutes les applications. La page de téléchargement va rester en ligne pendant six mois (de sorte que vous puissiez les télécharger à une date ultérieure, si vous le souhaitez).
Comment passer commande. échantillons gratuit.
Cliquez ici pour accéder à la page de l'offre. La page contient les liens vers tous les sites. Vous pouvez télécharger des échantillons gratuits pour toutes les applications depuis la même page.
L'offre se termine aujourd'hui à 17 heures. Ne la ratez pas.
J'espère que je ne ai pas pris trop de votre temps précieux, et je vous souhaite plein de succès.
Meilleures salutations,
Audrey Martin
Marketing1 Team
Unsubscribe:
Veuillez cliquer ici si vous ne souhaitez plus recevoir d'emails de notre part
M1 Solutions. 152 City Road, London EC1V 2NX
The link in the email goes to marketing1.site hosted on 66.96.161.163 (Endurance International Group, US) and then redirects to a landing page at marketing1apps.net on 89.187.85.8 (Coreix, UK) which is just a gateway to marketing1.net on that same IP. The email comes from 87.253.234.168, a Mailjet IP in France.
As I mentioned previously, Marketing1.net are always having a closing down sale (but never close down) and if their sample data is anything to go by, it is complete crap. That's in addition to spamming domain contacts. Avoid.
Labels:
Endurance International Group,
Spam
Tuesday, 19 July 2016
Malware spam: "Documents from work." / "Untitled(1).docm" leads to Locky
This rather terse spam appears to come from the victim themselves (but doesn't). It has a malicious attachment.
aerosfera.ru/0hb765
biovinci.com.br/0hb765
choogo.net/0hb765
control3.com.br/0hb765
dealsbro.com/0hb765
heonybaby.synology.me/0hb765
hiramteran.com/0hb765
lifecare-hc.com/0hb765
ostrovokkrasoty.ru/0hb765
tvernedra.ru/0hb765
valsystem.cl/0hb765
wacker-etm.ru/0hb765
webidator.co.il/0hb765
wineroutes.ru/0hb765
www.mystyleparrucchieri.com/0hb765
The dropped payload has a detection rate of 3/54 and it phones home to the following locations:
77.222.54.202/upload/_dispatch.php (SpaceWeb CJSC, Russia)
194.1.236.126/upload/_dispatch.php (Internet Hosting Ltd, Russia)
185.117.153.176/upload/_dispatch.php (MAROSNET Telecommunication Company, Russia)
That's a subset of the locations found here. The payload is Locky ransomware.
Recommended blocklist:
77.222.54.202
194.1.236.126
185.117.153.176
176.111.63.51
From: recipient@victim.tldThere is no body text, however there is an attachment named Untitled(1).docm. Analysis by a trusted source (thank you) indicates that the various versions of this attachment download a component from on of the following locations:
To: recipient@victim.tld
Subject: Documents from work.
Date: 19 July 2016 at 12:20
aerosfera.ru/0hb765
biovinci.com.br/0hb765
choogo.net/0hb765
control3.com.br/0hb765
dealsbro.com/0hb765
heonybaby.synology.me/0hb765
hiramteran.com/0hb765
lifecare-hc.com/0hb765
ostrovokkrasoty.ru/0hb765
tvernedra.ru/0hb765
valsystem.cl/0hb765
wacker-etm.ru/0hb765
webidator.co.il/0hb765
wineroutes.ru/0hb765
www.mystyleparrucchieri.com/0hb765
The dropped payload has a detection rate of 3/54 and it phones home to the following locations:
77.222.54.202/upload/_dispatch.php (SpaceWeb CJSC, Russia)
194.1.236.126/upload/_dispatch.php (Internet Hosting Ltd, Russia)
185.117.153.176/upload/_dispatch.php (MAROSNET Telecommunication Company, Russia)
That's a subset of the locations found here. The payload is Locky ransomware.
Recommended blocklist:
77.222.54.202
194.1.236.126
185.117.153.176
176.111.63.51
Malware spam: "Documents" / "Natalie Pywell" / "Natalie.Pywell6@abbeyglassuk.com"
This spam does not come from Abbey Glass UK, but is instead a simple forgery with a malicious attachment:
Analysis is pending, but it looks like Locky ransomware and is probably similar to the one found in this spam run.
From Natalie Pywell [Natalie.Pywell6@abbeyglassuk.com]The sender's email address varies somewhat. Attached is a randomly named ZIP file which contains a malicious .js script.
Date Tue, 19 Jul 2016 15:27:20 +0530
Subject Documents
Message text
Dear Customer
Please find your documents attached.
If you have any questions please reply by email or contact me on 01443 238787.
Kind regards
Natalie Pywell
**This email has generated from an automated system**
This email has been sent via the Fusemail mail filtering service provided by Pro-Copy
Limited
Analysis is pending, but it looks like Locky ransomware and is probably similar to the one found in this spam run.
Subscribe to:
Posts (Atom)