Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- THREAT IDENTIFICATION: HANCITOR / COBALT STRIKE
- HANCITOR BUILD NUMBER
- BUILD: 1504_wtpc
- SUBJECTS OBSERVED
- You got invoice from DocuSign Electronic Service
- You got invoice from DocuSign Electronic Signature Service
- You got invoice from DocuSign Service
- You got invoice from DocuSign Signature Service
- You got notification from DocuSign Electronic Service
- You got notification from DocuSign Service
- You got notification from DocuSign Signature Service
- You received invoice from DocuSign Electronic Signature Service
- You received invoice from DocuSign Service
- You received invoice from DocuSign Signature Service
- You received notification from DocuSign Electronic Service
- You received notification from DocuSign Electronic Signature Service
- You received notification from DocuSign Service
- You received notification from DocuSign Signature Service
- SENDERS OBSERVED
- agjyg@aw-engineering.com
- awe@aw-engineering.com
- beyur@aw-engineering.com
- ccoisy@aw-engineering.com
- deowtna@aw-engineering.com
- dy@aw-engineering.com
- dylfo@aw-engineering.com
- ebuuwyp@aw-engineering.com
- emyi@aw-engineering.com
- enivyzl@aw-engineering.com
- ezo@aw-engineering.com
- fytut@aw-engineering.com
- gageve@aw-engineering.com
- gooiaxu@aw-engineering.com
- iacqbop@aw-engineering.com
- ip@aw-engineering.com
- iuna@aw-engineering.com
- j@aw-engineering.com
- jajoi@aw-engineering.com
- ji@aw-engineering.com
- jyivew@aw-engineering.com
- la@aw-engineering.com
- leceje@aw-engineering.com
- lihjaof@aw-engineering.com
- mooz@aw-engineering.com
- n@aw-engineering.com
- ohzxzug@aw-engineering.com
- oqi@aw-engineering.com
- ozyzedh@aw-engineering.com
- pivuli@aw-engineering.com
- qodyzxy@aw-engineering.com
- r@aw-engineering.com
- rg@aw-engineering.com
- swa@aw-engineering.com
- syeiduz@aw-engineering.com
- ty@aw-engineering.com
- uevqouh@aw-engineering.com
- uop@aw-engineering.com
- vmerny@aw-engineering.com
- wifun@aw-engineering.com
- xijuv@aw-engineering.com
- xkuchaa@aw-engineering.com
- yqixugi@aw-engineering.com
- ysyurya@aw-engineering.com
- zagsi@aw-engineering.com
- zte@aw-engineering.com
- MALDOC LANDING PAGE URLS
- https://docs.google.com/document/d/e/2PACX-1vQhiAF5gQNv28y45nwniqKxavLe1Mvpdao5rnqtoPWyX83z9g9zZlH7t1oVDfV2rALM2LC8_hzcMFpr/pub
- https://docs.google.com/document/d/e/2PACX-1vQJP4BvT8ibhh9kmz8EGNP0AkTu1brlpLja1hIyWchaXhUOQcIOPYFb5iGPtC0OL-VOiG_svp2ad-S-/pub
- https://docs.google.com/document/d/e/2PACX-1vQMQnFvEkafqeq1mnrLv0qhssdfGAOTJRsMDrIglcic7mw06MT0RjlvIh5yc9L-P8RYMjKhU3YB-Idx/pub
- https://docs.google.com/document/d/e/2PACX-1vQqpmaKzFUmKXIprKjopTsfipiv-565kIoagGODhIEKUoqXiiE_cazGCp5VmX6emW4Kn57SoTj1Puh8/pub
- https://docs.google.com/document/d/e/2PACX-1vQrC8GXtRyfmEGp4oafst9zTA8E6HuQd3w2EEipYO9UixUQn8CoAuuvqH2fHY9Av1JX6iwUyvZXhIIk/pub
- https://docs.google.com/document/d/e/2PACX-1vQYAgs-EMLDWqPlZxiLam8gHKkn_5s5yoycAIq8SwlXw1YJxoOcnZVketUVeiLYwkMof-9MK0CCQC4Z/pub
- https://docs.google.com/document/d/e/2PACX-1vQYvPn0DGNyEVCNPHhFIp2ECH5yWHtLgpjsYHvaewAm4bLI9ic02-K6ZnKh0ZrDoFjpdNagTSNDHeS6/pub
- https://docs.google.com/document/d/e/2PACX-1vQzGwWM78Cmg9TDWVWMjIwTWQ8TrcT9qCA9zE-NBq8uY3F8plsFHrw3qDkxR-du94sqaKcvT5VE-l8d/pub
- https://docs.google.com/document/d/e/2PACX-1vR5Sumn6eg4qfv_UGyg3v9YFdiNab8UX8IfNLKM55T9wtOFl5Torn-syATH8tgZ1x0LdsBkNYXUm2nE/pub
- https://docs.google.com/document/d/e/2PACX-1vR77nL3sONpxkMPl5sQDkFDypI2jBee6FQIH1lUP7jsufSfHhMq18foSdFsETf0OVPrwQhrEodIClat/pub
- https://docs.google.com/document/d/e/2PACX-1vRB4uyo_-sExlmgIt09jJFUObhLRB0A9V2lsvVwVjQJU_CUfoDu7wum4MYx-DtQKvC2LGbXGzuhcARA/pub
- https://docs.google.com/document/d/e/2PACX-1vRe2XXcQC3oyBXs2tpYAgVSyVgjVo5_hN5NC-2k3rDBTiNZSkV8V67he05k8KwIAUEYwRW_6ZMXRtL1/pub
- https://docs.google.com/document/d/e/2PACX-1vRf0jjCjquvWKXPMPUkJ8db9crsHmUdjBiuvmWxLO4m1zsJSinDmQMzpZYvLHBbEmCZVF53qy9ovL6N/pub
- https://docs.google.com/document/d/e/2PACX-1vRglM4LT6gGUwBzivoe0NgHO8C4KvuNIgOBJdj-2HaquDuhYKRJi-OXNKsSldpe4ZRQbQciye8DWmjh/pub
- https://docs.google.com/document/d/e/2PACX-1vRHgs7PXe8lwdtgSpuY1711oF6sYr1Vj1Z4qAHCiVIUuoZ246z8hzwxSloFRil7jx3BZdO23sojz1jo/pub
- https://docs.google.com/document/d/e/2PACX-1vRKTlMr7LA3vGp-u9eErgY9jJSd0IwwGTxxQt4YlnxcVgwBepdjORDsb11jfp32G--Tf86rPvtNLBd9/pub
- https://docs.google.com/document/d/e/2PACX-1vRnnwDHYt3sLU40A0px5JI8RYbAjiOp0ppkt0BWw8roKIKzhGh2cmLcR39pZ9eMa0wWwdgH0lw3_HHh/pub
- https://docs.google.com/document/d/e/2PACX-1vRqJzsiUOqO7cuGbsKk1VGGx40rMxDNaLjJmTXyHxkao1bDn-zIc0hnH55MrGKv3XlbR3IJGHbW88LS/pub
- https://docs.google.com/document/d/e/2PACX-1vRs_Ln6CQgoce-Gf_aS3XFpsT1THP8ih_0cdyxLj8oT6vPXlg_DVEN-fGQCmlDqpmzFwUFKaShfbUF9/pub
- https://docs.google.com/document/d/e/2PACX-1vRUW3XNlW2MlbTlXK-sLdsxlhlhYSdXLYTjbTG7j8EG3L_10zhrGL3ehGvbh6q6PCD5iJKrbwDEPKJW/pub
- https://docs.google.com/document/d/e/2PACX-1vRXybvqef5r5F4pZzWT2G6puEZA9eiv8sC44fkJKA8kzWldzTXoRVdeE53RGktGz-N38rMqqWMlhgM8/pub
- https://docs.google.com/document/d/e/2PACX-1vSamCreZYOgAmveo04q8gu15PIzA5vT_xwy57ThaXpjteaioQeKrzkx5rAdRNbUstDbsO2NGtQY3Jeg/pub
- https://docs.google.com/document/d/e/2PACX-1vSGar165um7mu1tBLjT_edfZFBv8RYzN5CLto2374tGN7OQiC8uMB4OKuaZa_nFTI1Sp6qIK3FSOX7B/pub
- https://docs.google.com/document/d/e/2PACX-1vSh1NaJ6pt-Pmtv3qLAQ-1d8BxfU1JwxrS1UH3-eou8LPxAdfhPisJroQ0J6sPPMNJLuPawvC4Hai9g/pub
- https://docs.google.com/document/d/e/2PACX-1vSq_xgjB1aRZlhS3bcrAbTD6Tc0WLwK5tWU9CbMEmRlg8fsW8Y0tuy5EZjNdAYKtKlJ6d6Gkdq2qc8-/pub
- https://docs.google.com/document/d/e/2PACX-1vSsRZVi4F6AaVMKGDbcxfOmbuSwYPiOFZXKNUzY5qWwEBZex3ZGwm8y0sYePyiuqCZgjlOAAjm5HKxp/pub
- https://docs.google.com/document/d/e/2PACX-1vSzWS8cxL6m40c1RxW7QraFYIglzCfIPzciw4HCMpokLg0egJCd8w1kX4A4ZNpkP9woQCnrR7O7eaE2/pub
- https://docs.google.com/document/d/e/2PACX-1vT1w5hUAG8DDGsd8X2vF42bDI7cTGw-6uImVbmotRsXI0b_6pAwPV9K1fpHAQop5PaIZTlnm3MKMcBc/pub
- https://docs.google.com/document/d/e/2PACX-1vT3q4T9OcJJ8QsdmWphqZooWxQ51CTxMbeRIB7_YqoZw2nmf0uWmERssEuXCvqni1FjaCHXT3_1KhAu/pub
- https://docs.google.com/document/d/e/2PACX-1vTB0f227l4EqmHur6dLh_0O2dF0MPVetT5XWt3Msb-bMWXhY53HngKJYFM3w5DlN3KFaFOuQMHMmZTi/pub
- https://docs.google.com/document/d/e/2PACX-1vTEJ3_yZK2vLbCixsjT9nAvMhx2FFvz7ymybEBCmNR0uO5LyDzwUSASbjcz4no5i04KKeXSc-fxiXi0/pub
- https://docs.google.com/document/d/e/2PACX-1vTqEvrVNoqjCcChavXFlufls5Tqg23ym_JeMgfJLaho9oOmEIbHPI6adV-hV6OHhzGdZIumf4QVbyrl/pub
- https://docs.google.com/document/d/e/2PACX-1vTvHFYMJc548uyEjxM8jmoR4f5Del3Uv1UHJqjrGpRfCqTQ1jdBGS6YwcipZ0Z123KnRpU2ChPtkjK8/pub
- https://docs.google.com/document/d/e/2PACX-1vTzsg8X6kU2mjyDeiy38mbNPmJyqucNoKBPUI1ZkUV5WLBClhMmGOlD0k_P7DE-ekV5rR6a6xBtVgxh/pub
- MALDOC DISTRIBUTION URLS
- http://lormano.com/aproval.php
- https://forms.saurashtrauniversity.edu/photomask.php
- https://api.cdmvertical.com/augmentability.php
- https://sieuthiacc.vn/indeclinable.php
- https://forms.saurashtrauniversity.edu/believing.php
- cdmvertical.com
- lormano.com
- saurashtrauniversity.edu
- sieuthiacc.vn
- HANCITOR MALDOC FILE HASHES
- d612619487b653f2df244a7394e9fa46
- HANCITOR PAYLOAD FILE HASH
- edge.dll
- be8f099ce03e4e031f8263a3656812de
- HANCITOR C2
- http://regatimmish.com/8/forum.php
- http://wilewgracted.ru/8/forum.php
- http://thimolkanivind.ru/8/forum.php
- COBALT STRIKE PAYLOAD URLS
- http://45des29.ru/1504.bin
- http://45des29.ru/1504s.bin
- COBALT STRIKE STAGER FILE HASHES
- 1504.bin
- 5fa38110e78a8c71ee52e6990e967322
- 1504s.bin
- 29f9fbe86100a927a879990d838cd0a3
- COBALT STRIKE BEACON
- http://173.199.115.116/QOEw
- COBALT STRIKE C2
- http://173.199.115.116/pixel.gif
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement