2021-05-20 Hancitor IOCs

THREAT IDENTIFICATION:  HANCITOR / FICKER STEALER

HANCITOR BUILD NUMBER
BUILD=2005_mesbn

SUBJECTS OBSERVED
You got invoice from DocuSign Electronic Service
You got invoice from DocuSign Signature Service
You got notification from DocuSign Service
You received invoice from DocuSign Electronic Service
You received invoice from DocuSign Electronic Signature Service
You received invoice from DocuSign Signature Service
You received notification from DocuSign Service
You received notification from DocuSign Signature Service

SENDERS OBSERVED
adyesob@DENVERBANKRUPTCYLAW.COM
eafkam@DENVERBANKRUPTCYLAW.COM
i@DENVERBANKRUPTCYLAW.COM
iqazoj@DENVERBANKRUPTCYLAW.COM
loun@DENVERBANKRUPTCYLAW.COM
mufadz@DENVERBANKRUPTCYLAW.COM
o@DENVERBANKRUPTCYLAW.COM
swekou@DENVERBANKRUPTCYLAW.COM
x@DENVERBANKRUPTCYLAW.COM
xabuiru@DENVERBANKRUPTCYLAW.COM

MALDOC LANDING PAGE URLS
https://docs.google.com/document/d/e/2PACX-1vQdgtNuLxD48C4JhUaesn_ZFgAFsZ_EJaSCBpbDItEYzNdf_SAu2s6gLNjPBqRXnBDNKwmyA4Y3THsW/pub
https://docs.google.com/document/d/e/2PACX-1vQk5kwI89J1WNz2CiNd_oADJyY29FmwknX_ZHCyAzK5KQ2wn4p2H1wAvy9kS2mi54-62KRxrox-iFrF/pub

MALDOC DISTRIBUTION URLS
https://skillsit.com.br/centrality.php

HANCITOR MALDOC FILE HASHES
24047349658d77867ee29c89735655a0

HANCITOR PAYLOAD FILE HASH
rem.r
705864ea2d02aa4e6d66f673fac35fe9

HANCITOR C2
http://vaethemanic.com/8/forum.php
http://tembovewinated.ru/8/forum.php
http://prournauseent.ru/8/forum.php

FICKER STEALER PAYLOAD URL
http://q09pi7.ru/6jkio9ukds.exe

FICKER STEALER FILE HASH
6jkio9ukds.exe
77be0dd6570301acac3634801676b5d7

FICKER STEALER C2
http://sweyblidian.com