2016-11-09 Locky "Fuel Card E-bill"

2016-11-09 #locky email phishing campaign "Fuel Card E-bill"

Email sample:
---------------------------------------------------------------------------------------------------------------
From: "ADELINE WILLETT" <[email protected]>
To: [REDACTED]
Subject: Shell Fuel Card E-bill 910934 for Account (rnd(B, S, F, H, A, D, C, N, M, L)}}920433 08/11/2016
Date: Wed, 09 Nov 2016 18:11:30 +0530

ADELINE WILLETT

Last & Tricker Partnership

3 Lower Brook Mews
Lower Brook Street
Ipswich Suffolk IP4 1RA
T: 01473 252961  F: 01473 233709  M: 07778464004
email: [email protected]
This e-mail and any attachments may contain confidential and privileged
information and is intended only for the use of the individual or entity to
which it is addressed. If you are not the intended recipient, please notify
the sender immediately by return e-mail, delete this e-mail and destroy any
copies from your system; you should not copy the message or disclose its
contents to anyone. Any dissemination, distribution or use of this
information by a person other than the intended recipient is unauthorized
and may be illegal. We cannot accept liability for any damage sustained as a
result of software viruses and advise you to carry out your own virus checks
before opening any attachment.

Attachment: ebill910934.zip
---------------------------------------------------------------------------------------------------------------
- sender varies between emails
- subject is "<BP|Shell> Fuel Card E-bill <number> for Account (rnd(B, S, F, H, A, D, C, N, M, L)}}920433 08/11/2016"
- attached file "ebill<number>.zip" contains file "<2 digits><2-7 letters><8 digits>.wsf", a JScript downloader

The URLs, malware etc ... are same as for campaign "Message from KMBT_C220" http://pastebin.com/aYyBzU0U