Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- THREAT ATTRIBUTION: HANCITOR
- SUBJECTS OBSERVED
- You got invoice from DocuSign Signature Service
- You got notification from DocuSign Electronic Service
- You got notification from DocuSign Service
- You received notification from DocuSign Signature Service
- SENDERS OBSERVED
- b@nelsonfallsafeinc.net
- gachiq@nelsonfallsafeinc.net
- iapuill@nelsonfallsafeinc.net
- pjrya@nelsonfallsafeinc.net
- MALDOC DISTRIBUTION URLS
- https://docs.google.com/document/d/e/2PACX-1vSYcP7kvGXGJjGAXg4qzj-Jfi0vLojCdCdFTLgxg_8mZuwLK32DYEVUo7LTFGiucGE4arlAWvO-TIlZ/pub
- https://docs.google.com/document/d/e/2PACX-1vTMBXvwgGd4DU8rmBf6FomQ8sQAXv3924gEeWg8cBH7l7xlYW897PWcHCRf-BVa3moVQLr81MfoNe0t/pub
- https://docs.google.com/document/d/e/2PACX-1vTvaHCNCRkx6c0oZCC376vrth8kdGZ5bYDtJ-xVeKUsKkbGA0sSpBYvFViAodeSeaE6dPxg21IVWBpr/pub
- HANCITOR DOWNLOAD URLS
- https://akashcrusher.webscript.co.in/credibility.php
- https://aryfa.com/pelter.php
- https://www.razwerks.com/devilishly.php
- aryfa.com
- razwerks.com
- webscript.co.in
- MALDOC FILE HASHES
- 1210_262874651.doc
- 34f20f2fdde3d4311e27c23733ae2734
- HANCITOR PAYLOAD FILE HASHES
- W0rd.dll
- 8a46cd66d6f65b40e6ecdce3d29a4d2e
- HANCITOR C2
- http://nuatanste.com/8/forum.php
- http://thircussovirom.ru/8/forum.php
- http://otsoebabe.com/8/forum.php
- FICKER STEALER PAYLOAD
- http://gadeforsenate.com/sjh7843.exe
- FICKER STEALER FILE HASH
- sjh7843.exe
- 107f4a58dc56c803088abb23d29b279c
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
