2019-08-26 Amadey/Hancitor

13c726dca03799a4d97a114acdb857abad19c063bb0410db7c5ea6d553f822f5  16387592478.vbs
b0410db7c5ea6d553f822f5 (GET)
********************************************************************************
* Information for 13c726dca03799a4d97a114acdb857abad19c063bb0410db7c5ea6d553f822f5
* Observable type: hash.sha256 (Auto-detected: True)
********************************************************************************
Not seeing what you expect? Likely not a valid site. Try running with --list-sites

[+] VirusTotal File Report Results
    [-] Date submitted: 2019-08-26 13:33:19
    [-] Detected engines: 15
    [-] Total engines: 56
    [-] Scans: ('F-Prot', 'VBS/Agent[.]TO')
    [-] Scans: ('Symantec', 'JS[.]Dropper')
    [-] Scans: ('Kaspersky', 'Trojan-Dropper.VBS[.]Agent[.]mi')
    [-] Scans: ('Rising', 'Trojan[.]Obfus/VBS!1[.]BB5E (CLASSIC)')
    [-] Scans: ('Sophos', 'VBS/Drop-BHX')
    [-] Scans: ('Comodo', 'Malware@#ghwfb6oydfsu')
    [-] Scans: ('DrWeb', 'VBS[.]Siggen.7923')
    [-] Scans: ('Emsisoft', 'Trojan[.]Script (A)')
    [-] Scans: ('Cyren', 'VBS/Agent[.]TO')
    [-] Scans: ('ZoneAlarm', 'Trojan-Dropper.VBS[.]Agent[.]mi')
    [-] Scans: ('Microsoft', 'Trojan:VBS/Obfuse')
    [-] Scans: ('Tencent', 'Vbs.Trojan-dropper[.]Agent[.]Amlz')
    [-] Scans: ('Ikarus', 'Trojan[.]VBS[.]Obfuse')
    [-] Scans: ('GData', 'Script.Trojan[.]Agent[.]RERXUM')
    [-] Scans: ('Qihoo-360', 'virus[.]vbs[.]qexvmc.1080')

36e75ea189f2f96f370bfa6296116a13d36caf46537a834889ce1241e9e813cf  dh7Report_28_BIm.vbs
37a834889ce1241e9e813cf (GET)
********************************************************************************
* Information for 36e75ea189f2f96f370bfa6296116a13d36caf46537a834889ce1241e9e813cf
* Observable type: hash.sha256 (Auto-detected: True)
********************************************************************************
Not seeing what you expect? Likely not a valid site. Try running with --list-sites

[+] VirusTotal File Report Results
    [-] Date submitted: 2019-08-23 01:36:44
    [-] Detected engines: 3
    [-] Total engines: 57
    [-] Scans: ('Cyren', 'VBS/Danabot.A[.]gen!Camelot')

Links from email that are still working:
========================================
http://wanchoychili.com/testtest.wanchoychili.com/page1/
http://virtualteamonline.com/virtualsolutionprovider.com/page4/
 -- Login: [email protected] Password: 35d72c1f
http://thegigasgroup.com/wp-admin/page1/ --> Zip file was no longer available though
 -- Username: [email protected] Password: 258b9ebe

Links from email that are not working:
======================================
http://strommashina.by/wp-admin/vp3/
http://tarakangroupsro.com/wp-admin/vp3/
http://wangjiaolian.club/wp-admin/page5/
http://unplasticomenos.com/wp-includes/page3/
http://amanda.cl/wp-admin/page3/
http://ywp-ng.org/cgi-bin/vp3/

Subjects of emails over the last 7 days from [email protected]
==========================================================
An automatic Income tax Refund Notification
An automatic Tax Refund Message
Automated Tax Refund Reminder
Automated Tax Return Reminder
Automatic Tax Return Message
An automatic Tax Return Notice
Automatic Income tax Return Reminder
Automatic Tax Refund Notice
Automatic Tax Return Notice
Automatic Tax Return Reminder
Electronic Income tax Refund Reminder
Electronic Tax Refund Notification
Electronic Tax Return Notice
An automatic Income tax Return Reminder
An automatic Tax Refund Notice
An automatic Tax Return Alert
Automated Income tax Refund Message
Automated Income tax Refund Notification
Automated Income tax Return Notice
Automated Tax Refund Message
Automated Tax Refund Notice
Automated Tax Return Alert
Automatic Income tax Return Message
Automatic Tax Refund Reminder
Electronic Income tax Return Reminder
Electronic Tax Refund Alert
Electronic Tax Return Alert
An automatic Income tax Refund Alert
An automatic Income tax Refund Message
An automatic Income tax Refund Reminder
An automatic Income tax Return Notice
An automatic Income tax Return Notification
An automatic Tax Return Message
Automated Income tax Refund Alert
Automated Income tax Refund Notice
Automated Income tax Refund Reminder
Automated Income tax Return Alert
Automated Income tax Return Message
Automated Income tax Return Notification
Automated Income tax Return Reminder
Automated Tax Refund Alert
Automated Tax Refund Notification
Automated Tax Return Message
Automated Tax Return Notice
Automated Tax Return Notification
Automatic Income tax Refund Message
Automatic Income tax Refund Notice
Automatic Income tax Refund Notification
Automatic Income tax Refund Reminder
Automatic Income tax Return Notice
Automatic Tax Refund Alert
Automatic Tax Refund Message
Automatic Tax Return Alert
Automatic Tax Return Notification
Book top rated generic treatment products here!
Electronic Income tax Refund Notification
Electronic Income tax Return Alert
Electronic Income tax Return Message
Electronic Income tax Return Notice
Electronic Income tax Return Notification
Electronic Tax Refund Notice
Electronic Tax Return Notification

IP address of sender:
=====================
85.214.22.84
https://www.abuseipdb.com/check/85.214.22.84
 - 	ISP	Strato AG
 - 	Usage Type	Data Center/Web Hosting/Transit
 -	Hostname(s)	sb-konzept.de
 -	Domain Name	strato.de
 -	Country	 Germany
 -	City	Berlin, Berlin