Locky "Bank account record"

2016-08-29 Locky "Bank account record"

Email sample:
-----------------------------------------------------------------------------------------------------
From: Weeks.4059@[REDACTED]
To: [REDACTED]
Subject: Bank account record

Good morning,

Did you forget to finish the Bank account record?
Read the attachment and let me know if there is anything I didn't make clear.

Yours sincerely,
Alejandra Weeks

7371bfa961c1a78bfabfd77bc4e23502d371dfa71528d83d9c1aed
-----------------------------------------------------------------------------------------------------

Attachment: c650adad51a.zip containing file "account record =936=..wsf"; JScript downloader.
http://211.18.200.4/~tlas021/3rwcozqv
http://80.241.232.207/fefj1r
http://agazoumi.com/t30z6j8
http://alci.dommel.be/clf26lu
http://amandinearmand.perso.sfr.fr/6piy70m
http://azmusclemart.com/pb79s
http://bartocha-photography.com/~fib-naturfoto/99xny
http://blekitniproba.cba.pl/fo1k6o
http://chelmy.cba.pl/yv7h2r3
http://childmoon.web.fc2.com/coy0nl
http://fcc-thechamps.de/6g5vo1a
http://garo903.web.fc2.com/2mf4v0
http://handball-literatur.de/3ua7j
http://happurg-schulanger.atspace.org/0s6lyu6
http://hw.srca.org/iwg54jh
http://impregui.com/h3cywm
http://inhouserecording.atspace.com/t4wj9316
http://intracorpwestsidecollection.com/ifs0j92
http://joslinsalesltd.com/kro1gx
http://jyoumon.web.fc2.com/7tcec
http://kenestyonline.com/h782hd
http://minocki.republika.pl/nvlx7
http://minocki.republika.pl/s125d6
http://newt150.tripod.com/4bcsv
http://oleanderhome.com/q59ldt5r
http://ratnam.fx.perso.sfr.fr/vtpm9k
http://senzai.nobu-naga.net/2jv74
http://smc.psuti.ru/3rcxu
http://theuniongroup.com/5sv0c
http://tomart3d.cba.pl/3ivctw
http://voisin-sa.com/~voisin9689/vnsaumj
http://vova318.vline.ru/mkmkr
http://wbbs176.web.fc2.com/20srj
http://wktkwkbaaan.web.fc2.com/0mm9qx
http://wn420pjpa.homepage.t-online.de/046ss5
http://www.13one.de/vz8gl5a
http://www.astool.com/ljgzai
http://www.attivita-antroposofiche-roma.org/gpjjr5u
http://www.damasoinfante.com/7pmfw
http://www.dukewayne.talktalk.net/todga
http://www.erikacostruzioni.com/0z1hkf
http://www.ferresur.es/3k58w8z
http://www.fotosdelburgo.com/oerwg1
http://www.frank-nickel.de/7e46f9t5
http://www.hydroenergie.fr/yzhhkit
http://www.istruiscus.it/qzdy65b0
http://www.istruiscus.it/r5ncu
http://www.kassa.p0.ru
http://www.snvl-ptrc.go.ro/srhgx
http://zauber-fred.de/0zth9jfv

Encrypted malware, size 139780 bytes:
8cc3c3db29280421682424dfd6f22c5748fb7f2877cf9b314d4f7def1011b514  http___211.18.200.4_~tlas021_3rwcozqv
6904cd47b0fd85bf68625e76a1e9e5b346ef0a8f91cd87c44ecbd7d2b676f43a  http___80.241.232.207_fefj1r
171993a2bbf149ff92048b5063bac412fb213da3f60f283a02f80d067152a1b3  http___agazoumi.com_t30z6j8
f7578cacbd28a314d31264ced961b4e54a8ac00132f59293dc55239b424b1ae1  http___alci.dommel.be_clf26lu
c82dfb957d3750da1e0433c01434703f329c9eee745c8dc5fc9276df3ad2c003  http___amandinearmand.perso.sfr.fr_6piy70m
ad0390448d621ec1de33a7ca86aa93ed300816ce53f2f09d6f34121ec10ec533  http___bartocha-photography.com_~fib-naturfoto_99xny
86486bbbfc43998a462e5953cfae684c2b785307be61e1ae0bd9db4d4e21fb3c  http___blekitniproba.cba.pl_fo1k6o
43bda066c9adb774af37fface5fc1e27f4caa8812c6b6630ef718b55a2702a59  http___chelmy.cba.pl_yv7h2r3
aa28a315a5e9d6811c4dd370800eafbae422c6fb2f26b77db402907eda83bcd4  http___childmoon.web.fc2.com_coy0nl
07030901b999353d57737d56ac03058b71f5254449ed442e54646656cc2fa3bf  http___fcc-thechamps.de_6g5vo1a
57a96f048656d34c303d5b2e8ef0cb22e4eac6b8131efd313831acaefa0f221b  http___garo903.web.fc2.com_2mf4v0
15c8f8ca22cf4770443c6c9059d789eae7f9cfbf07ca12d811f537f4c25a414b  http___handball-literatur.de_3ua7j
ca85bb00f8abb331360f17922cbabf3e90402c991b62a9e4892cba6403010e61  http___happurg-schulanger.atspace.org_0s6lyu6
c5afae4a31be6032267ec0f3f7e17c5b305904db1ddd649b3ed51ecacc094e06  http___hw.srca.org_iwg54jh
ed8fd95836b810691f794ff039001d5d4163925582d6060cdd4d88035776005e  http___impregui.com_h3cywm
fdacd9e20bd41016be32ecb1a7a9899294bc75ddaf4f6e9c6df5c43a6e0f2a70  http___inhouserecording.atspace.com_t4wj9316
8e3193c34a663e2a379a78bfb95ecfeaf6e1358f43848bf02e4457e10bdaa66d  http___intracorpwestsidecollection.com_ifs0j92
3f78e37f39c30110b091d168b73677bf4df15b97bb3624eb073e9a33c70f2ebb  http___joslinsalesltd.com_kro1gx
af74798fd5052aac894554f6e77f7707f82be71f678662a16559bc79ef4cc836  http___jyoumon.web.fc2.com_7tcec
fc99bacda3de2ec894085702726231a05e39225053070d4ff38b00ea6f6e3df1  http___kenestyonline.com_h782hd
02fbfb59b96eeb5c97b59b398a6edc91b6368e5baa21407cc3f3f175867fe584  http___minocki.republika.pl_nvlx7
326fcc066456e83e9a72c189c37a4e2c5ca7e4c9e76ea116b137a9c03310b0a0  http___minocki.republika.pl_s125d6
3248eebe0f47730f9ef4c9d3cf9625dfdc55ef678ec48d4c814caea75997a67f  http___newt150.tripod.com_4bcsv
fe492b9f3cc4f31f2796d9a2b795efac7d80c0097b863eea1f8db9ead603327f  http___oleanderhome.com_q59ldt5r
3024d65021eba85323ebbd1f5ed4e74275dd75e3f36ca347dff185075052e69b  http___ratnam.fx.perso.sfr.fr_vtpm9k
2ac197f9c4ff45ba0dbd0a52ef40d237400f4b166efdf7dff98b94f36e2c9cee  http___senzai.nobu-naga.net_2jv74
eab4a7952f90ecbac690a1ec89e863d3beb6475ab2a27535fa3a69cd4d54d54b  http___smc.psuti.ru_3rcxu
01244a9d0f8a5623279c6e95648a22e586e85d9372bfddf7ce08c58422039da5  http___theuniongroup.com_5sv0c
0c35d63cb67b320c2937c57a91dea19d36e3c8cc60cc0eedc14618b3cf71c5d0  http___tomart3d.cba.pl_3ivctw
d862f78e06e711060e1ac7fc3e46e13f61511f8c3e6ed19aa3a1e30ae145e990  http___voisin-sa.com_~voisin9689_vnsaumj
f8f98a5f21eedfca6bb27ce12094682419d2c214105b0f944cb9cc6875217298  http___vova318.vline.ru_mkmkr
32a536a3aef3c2c2d1d0ec208e3079a48eb9bd106565bfb46f99517b272818d9  http___wbbs176.web.fc2.com_20srj
45738a62902b1ab4ebfe2aa44a2a6f8d9a2023b87103d95a9a93f2b47029e04e  http___wktkwkbaaan.web.fc2.com_0mm9qx
46978c4813935fc6afd390e7c3e5bc5aa469fc87106577dc8492d81e0f2ca498  http___wn420pjpa.homepage.t-online.de_046ss5
c170028215cabacdce2d35a1d4ecb63f18d1849b440f0e3d9173983acbe4b233  http___www.13one.de_vz8gl5a
cba875cb2a255d7f14a1319021de08ee15e5dbbc2aeca69e9a9b1d04fb5ff830  http___www.attivita-antroposofiche-roma.org_gpjjr5u
5f91e7e44e486b7f6fca362d2250b1af854072610acc9078ed790a7d23ac035c  http___www.damasoinfante.com_7pmfw
df852abbd1abb8fa484768e29c4cd78b4d8f3884ad0e5eed8df8e1b50e8f4971  http___www.dukewayne.talktalk.net_todga
15f038d7864f182bd7af0a8319317aed77a112481aa823cf6eacb06e7846d596  http___www.erikacostruzioni.com_0z1hkf
e6f384f47218e65f5e41ca2087c6244ad72a662785d56d260d879e1637f87497  http___www.ferresur.es_3k58w8z
3daa20b961e097aeddc6bc4e5b035e6be0cd64b5f98671ccf20521f49469f2ed  http___www.fotosdelburgo.com_oerwg1
9f3a53e47109ab3e27ad4390e8c66b4a8b51573b3c30d45e72a1ae9973917958  http___www.frank-nickel.de_7e46f9t5
881ba05d4d2941fa5939e9c552faa80ad87d7000959a1c16edcbedcf34d7e5c2  http___www.hydroenergie.fr_yzhhkit
375116ac4dfeafa81511d9a7aa5412745ee3502a2988633662d594cb51fa0bcb  http___www.istruiscus.it_qzdy65b0
b53e4524e544a3f141a394db9110abcf4c7a301fa3859393b5bf69a8f30725ea  http___www.istruiscus.it_r5ncu
f1b0c33f0e0818487421f284f16df23b2f4e43b19c0ace9370aa94617c4d5c80  http___www.snvl-ptrc.go.ro_srhgx
8a8ef5734e2af25993ab78f796fbc57be091be71f15cabf0538800c72d0ad67c  http___zauber-fred.de_0zth9jfv