Hancitor Ring Central Phish Sep 13, 2017

From: RingCentral <[email protected]>
Subject: ncoming RingCentral fax from Varies-Varies-Varies
Downloaded document name: fax_<6 digits>.doc
Document SHA-256: 1c72f575d0c9574afcfcaab7e0b89fe0083dbe8ac20c0132a978eb1f6be59641

Phishing URLs
http://cleanairacandheating.info/v.php?n=
http://cleanairacandheating.net/v.php?n=
http://cleanairacandheating.com/
http://lsgsettlements.net/v.php?n=
http://lsgsettlements.com/v.php?n=
http://fitnesskitchenlv.com/v.php?n=
http://myinternetsweepstakes.com/v.php?n=
http://comfortadvisorteams.com/v.php?n=
http://abcpromotions.net/v.php?n=
http://morninbreakcafe.com/v.php?n=
http://coronanorthern.com/v.php?n=

CNC URLs
http://cyfievengtont.com/ls5/forum.php
http://cyfievengtont.com/mlu/forum.php
http://cyfievengtont.com/d2/about.php
http://witcahinrab.ru/ls5/forum.php
http://dingletorsspar.ru/ls5/forum.php

Zloader
http://tonslysedding.ru/bdl/gate.php
http://botoldrithap.ru

Malware delivery link
File 1 SHA-256 1e22c81ec2c9b5223c857c1a67d67b7a3c1d9b6ed3ae3a8c97535faa8249a124
File 2 SHA-256 f4a5e304730183c86a35a18efae698da9e210377463a13d2620838db1470215e
File 3 SHA-256 e71917e8db4db42bfed3242765718125c12cc345e89d408ad70a4cdcb7f11eda
http://www.pennisonlawllc.com/wp-content/themes/twentysixteen/inc/3

IPs
174.129.241.106
31.41.45.17
208.113.183.151
185.81.113.162
216.146.43.70
171.25.193.77
37.59.46.159
46.165.230.5