Hancitor August 28, 2017 Fake DocuSign phish IOC

Hancitor August 28, 2017 Fake Docusign phish
August 28, 2017

From:Greg Taylor & Associates, via DocuSign  <[email protected]>
Subject: Your document Settlement 637421 is ready for signature!
Downloaded document name: Document_<digits>.doc
Document SHA256: a984f3241483a2ba8c5eb0e269b397fadbbd2e444140af57599aa9772f738ae2

Phishing URLs
http://susannahope.com/d.php?d=
http://writerbloggers.com/d.php?d=
http://heymamaradio.com/d.php?d=
http://thechristianblog.com/d.php?d=
http://codeltadentalplans.com/d.php?d=
http://lakewoodcoinsurance.com/d.php?d=
http://coloradohealthbenefitexchange.com/d.php?d=
http://myoutdoorchild.com/d.php?d=

Botnet CNC URLs
http://gusuptofttert.com/ls5/forum.php
http://witwronatwi.ru/ls5/forum.php
http://fyheculdugh.ru/ls5/forum.php

Malware delivery URLs
File 1 SHA256 563b6db2f97bf5eabcf0adc325edd49127dd7b92bff53eea443278aa13f97eda
File 2 SHA256 8da2d56e651d5ef0093b0240dfaed177d8277c95cc79335e012a7c58c3accb11
File 3 SHA256 4290685d7b468712f3dfc11c6aa75ed59fa6084fed8003a3694ded37ad31adf2
http://www.pki.info.pl/wp-content/plugins/si-contact-form/1
http://www.bogomolov-product.com/wp-admin/includes/2
http://www.podersubliminal.es/wp-admin/3
http://charli-salon.hr/wp-admin/includes/2
http://memento.fi/wp-content/themes/twentyfourteen/2
http://www.tertialis.fr/wp-content/plugins/text-hover/3
http://www.pki.info.pl/wp-content/plugins/si-contact-form/3
http://www.bogomolov-product.com/wp-admin/includes/3
http://www.podersubliminal.es/wp-admin/3
http://charli-salon.hr/wp-admin/includes/3
http://memento.fi/wp-content/themes/twentyfourteen/3