Malware spam: "Additional Costs" leads to Locky

About the 9000th malicious spam run of the week so far, this one drops Locky ransomware. Again.

From:    Gregg gale
Date:    30 March 2016 at 13:42
Subject:    Additional Costs

Based on our contact (#084715), we're required to inform you about additional costs associated with your account, more information attached.

Reference numbers and sender names vary, the attachments are similar to the ones in this spam run. Various Malwr analyses for the samples I captured [1] [2] [3] [4] [5] show download locations at:

cssrd.org.lb/Wji57q.exe
fabiocaminero.com/2L5pGE.exe

This binary has a detection rate of 7/56. Analysis of the binary [6] [7] [8] shows that it phones home to the same IPs reported here.