2017-09-20 Locky "Your Payment # NNNN"

2017-09-20: #locky email phishing camapign "Your Payment # NNNN"

Email sample:
----------------------------------------------------------------------------------------------------
From: "Lou Drennan" <Lou.Drennan@[REDACTED]>
Subject: Your Payment # 5505
Date: Wed, 20 Sep 2017 08:24:27 -0300

Your Payment is attached.

Attachment: 7596_Payment.7z -> 7873_Payment.vbs
----------------------------------------------------------------------------------------------------
- sender is forged to come from same domain as recipient
- To: field is missing in the email
- subject is "Your Payment # <4 digits>"
- attached file "<4 digits>_Payment.7z" contain file "<4 digits>_Payment.vbs", a VBScript downloader

Download sites and malware are same as in previous "Status of invoice A217NNNN-NN" campaign https://pastebin.com/F5K6BKQX