From: Mary MathisThe sender's name, references and name of the attachment will vary, the attachment itself is named something similar to remittance_advice40502329.doc. So far I have seen two versions with detection rates of 3/54   and the Malwr reports   indicate a download from the following locations:
Date: 19 January 2016 at 12:21
Subject: Remittance Advice For Invoice 40502329 From C-Tech
Please find attached our current remittance advice.
Mary Mathis MAAT
Tel: +44 (0)1903 268599
Fax: +44 (0)1903 795454
These IPs can be considered to be malicious and are allocated to:
184.108.40.206 (Mir Telematiki Ltd, Netherlands)
220.127.116.11 (PE Skurykhin Mukola Volodumurovuch, Ukraine)
The attack is very similar to this Dridex 120 spam run earlier today, except the download locations and dropped binary has changed to this one [VT] with an MD5 of c19959c2d372a7d40d4ba0f99745f114. According to this Malwr report, it phones home to the same evil IP address of 18.104.22.168 as before.