2018-07-16 Hancitor with Azorult

2018-07-16 Hancitor Maldoc from Apple themed phishing emails. Now dropping AZORult password stealer.

HANCITOR MALDOC
MD5 dea9f155d76b545a3fbcb96d867bf546
SHA1 1261efbe21cc208f9b7654cb19cbdf2ada5b65c3
SHA256 0efbcb5119248f08e05c31d7538c26b5277162ddc2891f7740be29bf279c79e4

.PIF HANCITOR STILL BEING DROPPED TO APPDATA\Local\Temp\
MD5 8eb96b02f5c263977186227644c8182c
SHA1 c805361f3d7241db7117426f7c2740bc65130622
SHA256 f05f65841f2fce9fbaf86daf2baf010e8d6eaf87e571b41de5be19fe5b058aee

PANDA BANKER
MD5 4211d49072b65a6180f308b70c951140
SHA1 d7bcbb78873d11f53c1c800f50fb663fbece0236
SHA256 59cb68c61b25ec01a6a0b649c3e031cc8275fcf68821a6bcec5fbf7fbe2267c6

AZORULT / EVILPONY / PANDA BANKER PAYLOAD URLS
http://www.charityshofner.com/wp-content/plugins/jetpack/modules/11
http://www.charityshofner.com/wp-content/plugins/jetpack/modules/2
http://www.charityshofner.com/wp-content/plugins/jetpack/modules/3

HANCITOR C2
http://lehadonthet.com/4/forum.php

AZORULT C2
http://rothenpares.com/index.php

EVILPONY C2
http://lehadonthet.com/d2/about.php