Locky "Business card"

2016-08-04 #locky email phishing campaign "Business card"

Email sample (sender name and email varies between emails):
-------------------------------------------------------------------------------------------
From: "Colton Armstrong"
To: [REDACTED]
Subject: Business card

Hello [REDACTED],

I have attached the new business card design.
Please let me know if you need a change

King regards,
Colton Armstrong
0a436c9b09c3c9a9b14e751d6c5d4e7668a072
-------------------------------------------------------------------------------------------
Attachment: [random hexa chars].zip, containing "business card [random hexa chars]-.js", JScript downloader.

Download sites:
http://escapegasmech.com/048220y5
http://goldjinoz.com/0a3tg
http://platimunjinoz.ws/13fo8lnl
http://regeneratewert.ws/1qvvu9lu
http://traveltotre.in/2c4ykij7

Encrypted malware, filesize 146948:
30249f5c789292f137f6b2f5716e2e0565c63404007894f77b31faaeb32a1dd8  http___goldjinoz.com_0a3tg
1fcd00c5fa33ca7f1afee81eaa7fcb62433a7e215af7b04bbefef0854ab134e5  http___platimunjinoz.ws_13fo8lnl