Malspam email which contains two attachments. One being an avast logo to state the email has been scanned by Avast antivirus and that it is clean and the second behing a MHT file. The MHT will auto download an HTA file which will download and run an EXE which appears to be Lokibot.
Date/time:
2018-05-28T10:22:26
"sender" from:
Account Paybles/Credit Control Unit <accounts@hydraulicsoman[.]com>
Sender IP: 46.32.70.27
Shodan.io / Censys.io for lasthop(s):
https://www.shodan.io/46.32.70.27
https://www.censys.io/ipv4/46.32.70.27
Headers received:
from hydraulicsoman[.]com (unknown [46.32.70.27]) by internal (Postfix) with ESMTP id 7A26360AF9 for redacted@email; Mon, 28 May 2018 10:22:28 +0000 (UTC)
Helo:
hydraulicsoman[.]com
Headers x-mailer:
none
Subject line(s):
FW: RE: VERIFY THE DETAILS (invoice no./amount/Payment details)
Message Body:
“Good day, Kindly confirm the attached invoice No., amount and Bank details to enable us process with payment . Thanks as your prompt and immediate action will be highly appreciated Best Regards. Account Paybles/Credit Control Unit Please consider the environment before printing this message. This email has been checked for viruses by Avast antivirus software. www[.]avast[.]com”
Attachments:
Name: Payment Info.mht
MD5: bc321968943c3f968c7ee8aba0dd3ec4
SHA1: 973a4f69e57c6459c4b2fb9afa4ec5b524b19b4e
SHA256: 13d05dc373ead5a6add97c96b824163c720d1583bb9d9b4f028b110895c26421
SHA512: b2196f7b223f98c0de0a0df75e101f5a76b704c4a07c3930a3576fcc82ba72b580a0482384a8da2670fb24f507557f2e238b77d4a562283d417a28eb4bd3536c
File type: ASCII text, with CRLF line terminators
File size: 189
Downloads:
hxxp://www.mva[.]by/tags/Inv.hta
93.125.99.41
Name: Inv.hta
MD5: ee6b51dc0ce1a37ae9c3908fe37012f8
SHA1: aa2472368d4ee2e7e509beefa2eeb441632b3190
SHA256: d28e61b6548b6fc32667b9646ca2e52c05fbf5a2a200b24bff7cf532d1c974e4
File type: HTML document, ASCII text, with very long lines, with CRLF line terminators
File size: 1265
– 2nd –
hxxp://www.mva[.]by/tags/za.exe
93.125.99.41
Name: za.exe
MD5: 010dce8f1727f2ac367098673b556849
SHA1: 614800afc0122aa94ce9ccedddfa97bbad284bfa
SHA256: cd895b4f2d4616fa74d7c3a5d56c7edc2969e7347b6284ad8938582224fbe653
File type: PE32 executable for MS Windows (GUI) Intel 80386 32-bit Mono/.Net assembly
File size: 262144
Connections / HTTP requests:
hxxp://hiepphat[.]com[.]vn/appi/wip/Panel/five/fre.php
112.213.89.167
iheuche009[.]hopto[.]org (https://www.virustotal.com/#/domain/iheuche009.hopto.org)
185.208.211.22:1199