Hancitor Fake Invoice Sep 18, 2017

Hancitor fake invoice
September 18, 2017
From Giovanni Coan <[email protected]>
Subject: RE: RE: sept invoice <6 digits>
Download document name: invoice_<6 digits>.doc
Doducment SHA-256: f2dbdb12feb70f883e567a53d38c58081289134676c5f7ec09fefb031c559230

Phishing URLS
1234care.com/i.php?n=
1234care.nyc
1234medical.net
1234medical.org
123care.info
123care.net
123care.nyc
123care.org
javajazzers.com
carbonated-crystals.com
huntsvilleairductcleaning.com
mustardseedboutiquenash.com
popalls.com

C2 URLs
http://hatgutifi.com/ls5/forum.php
http://ardoofse.ru/ls5/forum.php
http://sogotthein.ru/ls5/forum.php

Malware Delivery URLs
File 1 SHA-256: 7ea99ce884b48ed76e0a7fa944873e7f49273f891aef8dae86163fba32c84621
File 2 SHA-256: f768c9ff4f99f7225e48e5143b7815ca5db11eec7df38e74497a772a29e1a649
File 3 SHA-256: e3e9ce50b483f2b3fc938e2df64958cbbbf7ad7c2165da244bd62a5a6ac78344
http://www.jukeboxexperten.dk/wp-content/plugins/improved-include-page/2
http://lingtonandbernie.com/2
http://prosperenterprises.com/2
http://labee-advocaten.nl/2
http://zengonyil.hu/2
http://cepd.info/wp-content/plugins/perth-portfolio/3