Oct 3, 2017 Hancitor fake Ring Central phish IOCs

Hancitor  Oct 3, 2017 fake Ring Central fax
From: ringcentral@servicemasterqr.com and ringcentral@cisonic.com
Subject: New incoming fax from xxx-xxx-xxx
Downloaded document name: fax_299407.doc
Document SHA256: 435c0c15f9fde201c221cdd60c25843230b0be00c5e84c35a23b2482d95e4d78

Phishing URLs
capstratconsulting.info
capstratconsulting.net
capstratconsulting.org
capstratconsulting.us
codepalpreplanviewer.info
codepalpreplanviewer.net
codepalpreplanviewer.org
codepaltoolkitxa.com
codepaltoolkitxa.info
codepaltoolkitxa.net
codepaltoolkitxa.org
codepalxa.com
codepalxa.info
codepalxa.net
codepalxa.us
gcpumpparts.com
gcpumpparts.net
golfpumpparts.com
golfpumpparts.net
golfstationparts.com
golfstationparts.net
golfstationpumpparts.com
waterbornepumps.net

C2 Domains
http://idsurinle.com/ls5/forum.php
http://higocoeveng.ru/ls5/forum.php
http://gauldtigot.ru/ls5/forum.php

Malware Delivery links
http://totalmss.co.za/wp-content/plugins/really-simple-captcha/3
http://bodyco.ru/wp-content/plugins/category-seo-meta-tags/3
http://christiangans.de/wp-content/plugins/simple-facebook-comments-for-wordpress/3
http://odeonradio.nl/wp-content/plugins/sm-facebook-comments/3
http://blog.thegemden.com.au/wp-content/plugins/wp-slimbox2/3
http://marok.info/core/functions/3

File1 SHA256: c22a81ab297a5b1aff4bb7a7616726d4286a7aeee654de5ffd870a1760c297bc
File2 SHA256: 161b534092bc58f9745e772e6ff59b84555af729d335bb98b9062c29fbdb407a
File3 SHA256: 95597e97cb9ce10e99ae71a637d08e58c640628f759e07fde77f407b65d18245