Hancitor fake UPS phish Sep 20, 2017

Hancitor fake UPS phish Sep 20, 2017
From: Karl ROBINSON <[email protected]>  LAST NAME VARIES
Subject: RE: RE: shipping inquiry regarding order <6 digits>
Downloaded document name: receipt_<6 digits>.doc
Document SHA-256: 5c583b552d4abc33090c077b3093071cd195e1f3a6bc6559c13e81cc1e0685b4

Phishing URLs
bluebottlebar.com/up.php?n=
bluebottlesaloon.com
diman.net
eastburnpublichouse.com
iexscargo.net
karoscene.com
lci.ltd
myrestaurantfix.com
pacificrimpizza.com
precisiondoorriverside.com
precisiondoorriverside.net
raindropbrewing.com
tipplinghouse.com

C2
http://dinyresi.com/ls5/forum.php
http://atnehartin.ru/ls5/forum.php
http://rowinwrondo.ru/ls5/forum.php

Malware links
File 1 SHA256 ed8903f61920b42476827350deaab597186846b6462f96a5fee2876aff74f95a
File 2 SHA256 bbc4435363c34faa1e30ec71a951083c9bf359ef1e2c187fef604ee669444062
File 3 SHA256 810ffb9d372b9c3bc584d4732c132cc78fd20c8edc64be867eeb15090bb54b85
http://itades.fr/site/wp-content/plugins/strong-testimonials/2
http://www.fleetresolutions.com/wp-content/plugins/super-simple-google-analytics/3
http://cvcop.com/wp-content/plugins/soundy-background-music/3
http://atakoydegunlukkiralikdaireler.com/wp-content/plugins/seo-keyword-page/3
http://hubofitsolutions.com/3
http://www.fleetresolutions.com/wp-content/plugins/theme-my-login/3