It is a windows script file and call a rundll32 process.

So, it seem to be a Locky subspecies.

However, extension of files were changed to "odin" not "zepto".

C & C server IP is in Russia.

It was blocked by TrojanCut.