From: AMAZON.COM [Mailerfirstname.lastname@example.org]
Date: 11 March 2016 at 09:09
Subject: Your Amazon order #137-89653734-2688148
Thank you for your order. We'll let you know once your item(s) have dispatched.You can check the status of your order or make changes to it by visiting Your Orders on Amazon.com.
Order #137-89653734-2688148 Placed on March 11, 2016
Order details and invoice in attached file.
Need to make changes to your order? Visit our Help page for more information and video guides.
We hope to see you again soon.
Reference numbers vary from email to email. Attached is a file with a name similar to ORD137-89653734-2688148.zip which contains a malicious script of which I have seen just a single sample with a detection rate of 5/56. According to this Malwr report, the script downloads a binary from:
That binary has a detection rate of 4/55. According to the Malwr report for the script and this Malwr report for the binary, it phones home to:
22.214.171.124 (Petersburg Internet Network, Russia)
126.96.36.199 (FLP Kochenov Aleksej Vladislavovich, Ukraine)
There are probably other download locations and C2s, I will update this post if I find out what they are.
Some additional C2s from various sources:
188.8.131.52 (PS Internet Company LLC. Kazakhstan)
184.108.40.206 (Petersburg Internet Network, Russia)
220.127.116.11 (FOP Sedinkin Olexandr Valeriyovuch, Ukraine)
Some additional download locations for this and other locky spam runs today: