Hancitor

https://www.virustotal.com/file/2f83ebb3e02c511c08f6cae87b03f4e0711fbd2aa40fb2ad1ef4c93ac7f549dd/analysis/1504190504/
https://www.threatcrowd.org/ip.php?ip=54.84.39.209
https://packettotal.com/cgi-bin/view-analysis.cgi?id=343eca737e9ac3036ce50e9f80c7e033

hancitor dl links
http://zasbiopharmaceuticals.com/list.php?d=
http://zassys.com/list.php?d=
http://zashealth.com/list.php?d=

c2
http://perewfabet.com/ls5/forum.php
http://hertsirobla.ru/ls5/forum.php
http://dohecrysit.ru/ls5/forum.php

dl
http://halletts.com/wp-content/plugins/wp-db-backup-made/1
http://halletts.com/wp-content/plugins/wp-db-backup-made/2
http://halletts.com/wp-content/plugins/wp-db-backup-made/3

zloader c2
http://hertuglighbe.com/bdl/gate.php
http://oneranjusfo.com/bdl/gate.php


Received: from [94.199.26.82] (HELO ctssystems.com)
  with SMTP id 694505109 for user@domain; Thu, 31 Aug 2017 10:37:29 -0400
Message-ID: <937CBB39.5BB88487@ctssystems.com>
Date: Thu, 31 Aug 2017 15:36:12 +0100
Reply-To: "Domenic Golliday" <accounting@ctssystems.com>
From: "Domenic Golliday" <accounting@ctssystems.com>
X-Mailer: iPhone Mail (13A404)
MIME-Version: 1.0
To: <user@domain>
Subject: RE: domain services price list
Content-Type: text/html;
	charset="utf-8"
Content-Transfer-Encoding: 7bit


<html>
		<p>
			<span style="font-family:arial,helvetica,sans-serif;">These prices are
higher than on your website.</span></p>
		<p>
			<span style="font-family:arial,helvetica,sans-serif;">Are you trying to
make a buck?</span></p>
		<p>
			<span style="font-family:arial,helvetica,sans-serif;">Thank
you.</span></p>
		<div>
			<span style="font-family:arial,helvetica,sans-serif;">Domenic
Golliday</span></div>
		<div>
			<span style="font-family:arial,helvetica,sans-serif;">Telephone:
717-221-8124 x271</span></div>
		<div>
			<span style="font-family:arial,helvetica,sans-serif;">Estimating Fax:
746-234-4628</span></div>
		<div>
			<span style="font-family:arial,helvetica,sans-serif;">Main Office Fax:
707-242-7548</span></div>
		<div>
			<span style="font-family:arial,helvetica,sans-serif;">Email:
accounting@ctssystems.com</span></div>
		<p>
			<span style="font-family:arial,helvetica,sans-serif;">Sent from my
iPhone</span></p>
		<p>
			<span style="font-family:arial,helvetica,sans-serif;">On Wednesday,
August 30 2017, at 02:53 , user@domain wrote:</span></p>
		<div>
			<span style="font-family:arial,helvetica,sans-serif;">&nbsp; &nbsp;
&nbsp;You can find the price list below here:</span></div>
		<div>
			<span style="font-family:arial,helvetica,sans-serif;">&nbsp; &nbsp;
&nbsp;<a href="http://zashealth.com/list.php?d=bmFuY3lrQHdpbmNvZm9vZHMuY29t"
>http://domain/offers/price_list_8664.doc</a></span>
		<div>
			<span style="font-family:arial,helvetica,sans-serif;">&nbsp; &nbsp;
&nbsp;</span></div>
		<div>
			<span style="font-family:arial,helvetica,sans-serif;">&nbsp; &nbsp;
&nbsp;Let me know when you are ready to do business.</span></div>
		<div>
			<span style="font-family:arial,helvetica,sans-serif;">&nbsp; &nbsp;
&nbsp;</span></div>
		<div>
			<span style="font-family:arial,helvetica,sans-serif;">&nbsp; &nbsp;
&nbsp;Thank you!</span></div>
		<p>
</html>