2016-12-12 - "OSIRIS" VARIANT LOCKY MALSPAM WITH ZIP ATTACHMENTS CONTAINING .JSE FILES
ASSOCIATED FILES:
- ZIP archive of the spreadsheet: 2016-12-12-Locky-malspam-info.csv.zip 4 kB (3636 bytes)
- ZIP archive of the sample pcap: 2016-12-12-Locky-malspam-traffic-example.pcap.zip 285 kB (284,689 bytes)
- ZIP archive of the emails: 2016-12-12-Locky-malspam-emails.zip 184 kB (183,877 bytes)
- ZIP archive of the attachments: 2016-12-12-Locky-malspam-attachments.zip 164 kB (163,876 bytes)
- ZIP archive of the extracted .jse files: 2016-12-12-Locky-extracted-jse-files.zip 129 kB (129,099 bytes)
- ZIP archive of artifacts from an infected host: 2016-12-12-Locky-malspam-artifacts-from-infected-host.zip 240 kB (240,492 bytes)
NOTES:
- The entry point for today's Locky DLL is sample get_str in case anyone wants to run it with rundll32.exe in a controlled environment.
Shown above: Chain of events for an infection from this malspam.
EMAILS
SUBJECT LINES:
- Order Confirmation 001612 Hexstone Ltd
- Order Confirmation 028621 Hexstone Ltd
- Order Confirmation 03522791 Hexstone Ltd
- Order Confirmation 24138317 Hexstone Ltd
- Order Confirmation 297654 Hexstone Ltd
- Order Confirmation 329029761 Hexstone Ltd
- Order Confirmation 3842026 Hexstone Ltd
- Order Confirmation 3910005641 Hexstone Ltd
- Order Confirmation 435889 Hexstone Ltd
- Order Confirmation 4984764 Hexstone Ltd
- Order Confirmation 588883091 Hexstone Ltd
- Order Confirmation 625925256 Hexstone Ltd
- Order Confirmation 6923803141 Hexstone Ltd
- Order Confirmation 7186641643 Hexstone Ltd
- Order Confirmation 7308828900 Hexstone Ltd
- Order Confirmation 792066140 Hexstone Ltd
- Order Confirmation 892163 Hexstone Ltd
- Order Confirmation 9211029700 Hexstone Ltd
- Order Confirmation 943917502 Hexstone Ltd
- Order Confirmation 951095429 Hexstone Ltd
Shown above: Data from 20 Locky malspam examples (part 1 of 2).
Shown above: Data from 20 Locky malspam examples (part 2 of 2).
Shown above: An example from these emails.
TRAFFIC
Shown above: An example of infection traffic by the Excel sheets from one of the emails.
EXAMPLES OF TRAFFIC GENERATED BY THE .JSE FILES RETRIEVING THE LOCKY BINARY:
- 23.229.166.185 - www.refereccu.com - GET /874ghv3?nMLywcbnOTX=qSItmcUxmhh
- 23.229.244.196 - autorijschoolpedro.nl - GET /874ghv3?hycFjlX=oGiPAd
- 27.254.55.25 - ratchadaphoto.com - GET /874ghv3?hnkOIEBk=tSKqWJ
- 27.254.96.195 - 3ainstrument.com - GET /874ghv3?JzaRmsLJ=jmdcFfxw
- 50.87.147.76 - cardbuilderplus.com - GET /874ghv3?sqfGdkvGc=kKVrJrzDTHa
- 64.34.68.80 - zasm.info - GET /874ghv3?nlyJYnQkWaY=uIqfjj
- 64.34.68.80 - zasm.info - GET /874ghv3?qVAILL=SgKgbROPT
- 66.147.240.172 - indiaclubdayton.org - GET /874ghv3?nlyJYnQkWaY=uIqfjj
- 66.96.149.19 - omnibusiness-solutions.com - GET /874ghv3?hycFjlX=oGiPAd
- 67.20.110.214 - sunwayautoparts.com - GET /874ghv3?bWRIatzeL=KrrBMXyVxD
- 69.162.74.116 - 69.162.74.116 - GET /874ghv3?vsXdyT=hrjTKHowz
- 69.89.31.111 - mer-pro.com - GET /874ghv3?nMLywcbnOTX=qSItmcUxmhh
- 70.33.246.100 - waterplusmaroc.com - GET /874ghv3?vsXdyT=hrjTKHowz
- 77.104.129.124 - ibfnetwork.com - GET /874ghv3?Iwvele=cffkCir
- 96.0.115.240 - olpharm.com - GET /874ghv3?yOtmOBXXQK=TqFJdur
- 103.27.52.92 - 103.27.52.92 - GET /874ghv3?feWkug=wOopBPy
- 103.27.52.92 - 103.27.52.92 - GET /874ghv3?qSzzdCEa=EIWRey
- 103.27.52.92 - 103.27.52.92 - GET /874ghv3?sqfGdkvGc=kKVrJrzDTHa
- 103.27.72.10 - www.pspmrsmag.com - GET /874ghv3?nMLywcbnOTX=qSItmcUxmhh
- 104.152.168.25 - muhammadmafazine.com - GET /874ghv3?feWkug=wOopBPy
- 104.152.168.25 - muhammadmafazine.com - GET /874ghv3?hnkOIEBk=tSKqWJ
- 104.152.168.25 - muhammadmafazine.com - GET /874ghv3?sqfGdkvGc=kKVrJrzDTHa
- 107.180.23.49 - icclicks.com - GET /874ghv3?vsXdyT=hrjTKHowz
- 107.180.4.37 - mynamepixs.com - GET /874ghv3?aXDVMP=wdpYzilI
- 107.180.4.37 - mynamepixs.com - GET /874ghv3?BEzJvyaiMCH=PlXEsFDdzY
- 107.180.4.37 - mynamepixs.com - GET /874ghv3?FbqqWm=vprrenIO
- 107.180.4.37 - mynamepixs.com - GET /874ghv3?nlyJYnQkWaY=uIqfjj
- 107.180.47.13 - megapowercash.com - GET /874ghv3?JzaRmsLJ=jmdcFfxw
- 108.168.206.100 - naacllc.com - GET /874ghv3?bWRIatzeL=KrrBMXyVxD
- 108.178.13.98 - www.kroyme.com - GET /874ghv3?aXDVMP=wdpYzilI
- 108.178.13.98 - www.kroyme.com - GET /874ghv3?BEzJvyaiMCH=PlXEsFDdzY
- 108.178.13.98 - www.kroyme.com - GET /874ghv3?FbqqWm=vprrenIO
- 108.178.13.98 - www.kroyme.com - GET /874ghv3?nlyJYnQkWaY=uIqfjj
- 108.178.13.98 - www.kroyme.com - GET /874ghv3?qVAILL=SgKgbROPT
- 111.67.22.192 - indigenouspromotions.com.au - GET /874ghv3?qSzzdCEa=EIWRey
- 117.239.70.228 - 117.239.70.228 - GET /874ghv3?qVAILL=SgKgbROPT
- 131.153.38.170 - www.russwat.org - GET /874ghv3?hnkOIEBk=tSKqWJ
- 150.107.31.57 - tifa-awards.net - GET /874ghv3?Iwvele=cffkCir
- 160.153.75.66 - tvctraffic.com - GET /874ghv3?hycFjlX=oGiPAd
- 160.153.75.66 - tvctraffic.com - GET /874ghv3?Iwvele=cffkCir
- 162.251.83.254 - w3care.com - GET /874ghv3?vsXdyT=hrjTKHowz
- 166.62.10.143 - onedotm.com - GET /874ghv3?yOtmOBXXQK=TqFJdur
- 166.62.10.29 - mebdco.com - GET /874ghv3?feWkug=wOopBPy
- 166.62.10.29 - mebdco.com - GET /874ghv3?hnkOIEBk=tSKqWJ
- 174.136.13.97 - thetravelbug.org - GET /874ghv3?qSzzdCEa=EIWRey
- 192.185.189.96 - soulanimtech.com - GET /874ghv3?yOtmOBXXQK=TqFJdur
- 192.185.225.231 - gudangg.com - GET /874ghv3?feWkug=wOopBPy
- 192.185.232.11 - filesdiamond.com - GET /874ghv3?JzaRmsLJ=jmdcFfxw
- 193.33.186.185 - mstest2.co.uk - GET /874ghv3?bWRIatzeL=KrrBMXyVxD
- 198.154.213.13 - therapymarketinginstitute.com - GET /874ghv3?JzaRmsLJ=jmdcFfxw
- 198.252.64.188 - envisorusa.com - GET /874ghv3?qVAILL=SgKgbROPT
- 198.54.120.18 - www.bfsa.gov.bd - GET /874ghv3?nMLywcbnOTX=qSItmcUxmhh
- 198.54.120.18 - www.ifs-b.org - GET /874ghv3?bWRIatzeL=KrrBMXyVxD
- 203.223.135.38 - www.pspmrsmtumpat.com - GET /874ghv3?qSzzdCEa=EIWRey
- 203.223.135.38 - www.pspmrsmtumpat.com - GET /874ghv3?sqfGdkvGc=kKVrJrzDTHa
- 206.72.192.15 - galtechprojects.com - GET /874ghv3?hycFjlX=oGiPAd
- 206.72.192.15 - galtechprojects.com - GET /874ghv3?yOtmOBXXQK=TqFJdur
- 208.113.172.228 - workandplaytherapy.com - GET /874ghv3?aXDVMP=wdpYzilI
- 208.113.172.228 - workandplaytherapy.com - GET /874ghv3?BEzJvyaiMCH=PlXEsFDdzY
- 08.113.172.228 - workandplaytherapy.com - GET /874ghv3?FbqqWm=vprrenIO
POST-INFECTION CALLBACK FROM THE LOCKY SAMPLE:
- 176.121.14.95 port 80 - 176.121.14.95 - POST /checkupdate
TOR DOMAIN FROM THE DECRYPTION INSTRUCTIONS:
- g46mbrrzpfszonuk.onion
FILE HASHES
LOCKY DLL FILE:
- SHA256 hash: 77be68d55cc051d234dd24b9305e832ebc49bc8160ddc415919946f39fc0b265 (225,280 bytes)
- File name: C:\Users\[username]\AppData\Local\Temp\[various names].dll
- DLL entry point: get_str
ZIP ATTACHMENTS FROM THE MALSPAM (SHA256 HASH - FILE NAME):
- 0beadadb56e845af97faab552f7b0ea98105a6d9a421f257873ff72b5a790818 - Ord3910005641.dzip
- 0e8f3e2e54fe388f9ac1c24dc8ad75ececb12e2b60d804fa340d7b5ec0c79fdc - Ord001612.dzip
- 3cab212819b335bc7b77180af8a50ee9cccb9872ee23bd7bc7030f19e66d658a - Ord329029761.dzip
- 4da2e1e4b728858433d7e01cdac6e1bce9f9d6d1ad9e9e1cda242afe60c071c4 - Ord7308828900.dzip
- 57682af268ef423438ec1fb44875224fc492a3a32b98ae8821f47e6d5581d11d - Ord9211029700.dzip
- 587c52a0f3aa8fd0a76a85d61a1808abccfd02a25678876e91acba2f80255955 - Ord435889.dzip , Ord943917502.dzip
- 659c3845cd756a968858f1c0395ef1b95aefb55924b905ff22928e3d2852a047 - Ord625925256.dzip
- 65e2482927dd452282e4139cd7cc588886ec8009feace9ca00617b15287c9eab - Ord4984764.dzip
- 675fc86cdf53ccbdec9ba9823f70b4cc84a844e362a5e0a35f81bd5b0b6eef46 - Ord588883091.dzip , Ord892163.dzip
- 897c662976a773815b25e39141d55246ea8d9cd1501b92700f9823da4fff5613 - Ord297654.dzip
- 983999dee418fcc733fa0231b30d164744e0453e5b0ddc7b0819e61aaa18b553 - Ord792066140.dzip
- a7f60cdf194759b44b7a992a9485caf3d5b3d1a1b5bbd76a40d49b8dc7cc2ea3 - Ord951095429.dzip
- b7463bdf6affb2d85c71384545130ebaaf86f5ceaa32ac98148cc30aa3d93f6f - Ord24138317.dzip , Ord6923803141.dzip
- ba0f6b1e187613647bb973070f6aafba6dcf4d637533498938710a605cb09acf - Ord3842026.dzip
- d45f9362e02c8234662f56125c577863cbf5463465936c7b44a37bffca5bfd24 - Ord028621.dzip , Ord7186641643.dzip
- f212e63b85644550a0196c11904704ba9a21cad80afe2a4a9df09e3a806aed3c - Ord03522791.dzip
.JSE FILES EXTRACTED FROM THE ZIP ATTACHMENTS (SHA256 HASH - FILE NAME):
- 0a1b051fa7a5154cdc0cad64b54969822e84620940f81ba011b29298f2984149 - Scan(829).jse
- 16940b20d1aa1eea7d17233f9330819ae87919cabd2ec636a15cb9e62cb04521 - Receipt(456).jse
- 215619cf44ee770bf3bc57a16cdb9fe8f656b7bb40f572fd43d71b36a6bd5135 - Document(186).jse
- 2a86c0068a71ebb186ec70fea38d9127c3210e3c67cc93178796a0e877ea35a1 - Receipt(546).jse
- 355fd9ff898fe5c74fa9135375b196345680b732805eaefd5fffb57cdf3c0138 - Receipt(391).jse
- 500b3c02fdb3a7140a8e5a8ac6ce757d40239641ee0ad0a90bc374006d9920e3 - Scan(772).jse
- 702a7dca681c9e6a8018b74c48a04f1fc34ca0129298b8645f522cf9dfc54610 - Receipt(500).jse
- 76b5aaef307fb29be3e0c57b0805eaf0e07014b320de14a5d148229cc82201ad - Receipt(564).jse
- 822a35bccb502bfdf7b87a6a8f446a6e1852e803c9f23f33beed55b291ff4ad9 - Document(112).jse
- 922c1a649ed8791b477faf6e6136f76dbfcdf390aef55a0e7a06ddf8d7400849 - Document(128).jse
- 9901714ca289db876d180d435888b8e8f19c596ba3162181c3a53ff319098250 - Receipt(360).jse
- 9a52c869a25cc75aa592515a9cfc106d7918de92dd1749c9ab63aa2d2e275a8f - Document(208).jse
- b5413c921d7457b6870a84ef97b07fab6fbf1a3954dd6e69236aa632c1dfcfb7 - Scan(850).jse
- d54cbe5fce186d50d8af0351838d1a7d5238ccddf101a9a1b8cffa9533896ce9 - Receipt(327).jse
- d7244801a18f3d5b7f9869a557d44f8ddbd862df38e09489dcab0b6a6c560f74 - Scan(799).jse
- de20216783c60d5806ca74886e5a9f6bfb16d1305c1e9dbf946de947ddd77773 - Receipt(407).jse
IMAGES
Shown above: Screen shot from an infected Windows desktop. Note the .osiris file extension.
Shown above: Ransom payment was 1.5 bitcoin for the infections I generated.
Shown above: There was an error in emails from this wave of malspam, causing .dzip attachments instead of .zip attachments.
FINAL NOTES
Once again, here are the associated archives:
- ZIP archive of the spreadsheet: 2016-12-12-Locky-malspam-info.csv.zip 4 kB (3636 bytes)
- ZIP archive of the sample pcap: 2016-12-12-Locky-malspam-traffic-example.pcap.zip 285 kB (284,689 bytes)
- ZIP archive of the emails: 2016-12-12-Locky-malspam-emails.zip 184 kB (183,877 bytes)
- ZIP archive of the attachments: 2016-12-12-Locky-malspam-attachments.zip 164 kB (163,876 bytes)
- ZIP archive of the extracted .jse files: 2016-12-12-Locky-extracted-jse-files.zip 129 kB (129,099 bytes)
- ZIP archive of artifacts from an infected host: 2016-12-12-Locky-malspam-artifacts-from-infected-host.zip 240 kB (240,492 bytes)
ZIP files are password-protected with the standard password. If you don't know it, look at the "about" page of this website.
Click here to return to the main page.