Locky "bank account report"

2016-07-18 #locky email phishing campaign "bank account report"

Email sample:
------------------------------------------------------------------------------------------------
From: "Garce Alvarez"
To: [REDACTED]
Subject: bank account report

Hi [REDACTED]

Thank you very much for responding my email in a very short time. Attached is the bank account report. Please look at it again and see if you have any disapproval.

--Warm regards,
Grace Alvarez
Eurotherm
Phone: +1 (918) 372-74-95, Fax: +1 (918) 372-74-09
------------------------------------------------------------------------------------------------
Downloads from (payload encrypted/coded):

http://acnek.com/fyxxbcsz
http://ahatv.com.au/twh7xv
http://anchortron.com/hiqsij
http://aquatixbottle.com/ygyngc
http://bailamecuba.com/4uyh5bex
http://banthaoduoc.com/v5g9z0s
http://BenavidezHoy.com/8zrg48k
http://bigislandhawaiihilorealestate.com/16h9p
http://bizconsulting.ro/bm8s7
http://blackdildo.net/h9kyu
http://bridgeplacements.com/dhbuk
http://calcoastlogistics.com/pda6bms
http://candobetter.net/5nt3ayk
http://cbactive.com/jw7l6mlr
http://christian-view.com/rwe24t
http://colleenthestylist.com/rdrfp
http://containermx.com/tb4u2v
http://davisdoherty.co.nz/g0vi70
http://deanstum.com/z9opr
http://dnp9.com/zpfqk2l
http://ecpi.ro/cqema
http://equalityindonesia.com/b229mg
http://eurasian.fc2web.com/18nws9
http://findmobileauto.com/gh8ft
http://fusofrance.fr/nengga
http://gruposoluciomatica.com.br/ryi81
http://gv.com.my/qbnuau
http://kouzoncorporation.com/jikkhl
http://leeplastic.com/w49a80y
http://matthewmccright.org/sl8wu
http://my-result.ru/0j1nlpj8
http://ormanstressrelief.com/uhgoz3b
http://otwayorchard.net/u96kt
http://quest.agency/0ovl6v5z
http://rsxxx.com/3vp8s83
http://s2mgmt.com/do40lc
http://serviceautoiasi.com/4tbvsfcz
http://smp.com.mx/hcoyv
http://thegracefamilychurch.com/ltxm3t
http://trans-free.ru/2hx1l
http://travoxsb.com/qmi5u0n
http://vakantiehuisinauvergne.com/apyd17
http://wcouto.com.br/9d207v

https://www.reverse.it/sample/16af8d4d02ed1116c8361c0890e48a201e7436e267798ab8d4a32ad4efc0b88d?environmentId=100
https://www.reverse.it/sample/0ce25582c413fca6c6abe5d3892c88164126d8545037b7a3e3479d85a414888d?environmentId=100
https://www.reverse.it/sample/b673ac789e3e4bd91ba570a121f0d39a8adfa3e066bb9ccb48f2acf7a8d05e7e?environmentId=100