Locky "old office facilities"

2016-09-02 #locky email phishing campaign "old office facilities"

Email sample (sender address varies):
-----------------------------------------------------------------------------------------
From: "Antone Boone"
To: [REDACTED]
Subject: old office facilities

Hi Reed,

Attached is the list of old office facilities that need to be replaced. Please copy the list into the purchase order form.


Best wishes,
Antone Boone
-----------------------------------------------------------------------------------------
Attachment: "<random_hexa_chars>.zip" containing 2 duplicate files "office_facilities_<8_hexachars>.js" and "office_facilities_<8_hexachars> - 1.js"; a JSCript downloader

Download sites:
http://bookinghotworld.ws/1rh05
http://brothermalw.ws/57f6ug7
http://clubofmalw.ws/e5rp34i
http://malwinstall.wang/ezr08tjd
http://mambarambaro.ws/if62u021
http://onlybest76.xyz/ixuxux
http://rejoincomp2.in/qmvczbh
http://savuchtettu.xyz/w8g0em
http://sopranolady7.wang/yvq75
http://timetobuymlw.in/zk1u2v