2021-02-09 Hancitor IOCs

THREAT ATTRIBUTION:  HANCITOR

HANCITOR BUILD
BUILD=0902_ntcwe4

SUBJECTS OBSERVED
KeyBank Platform Notice
KeyBank System Message
KeyBank System Notice
KeyBank System Notification

SENDERS OBSERVED
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

MALDOC LANDING PAGES
https://docs.google.com/document/d/e/2PACX-1vRw2I0KDZHTZfUkXHIKA-It65nXEqhi8ybWS2nVm_yQwdOVg388PfwfBFFZchFsssKQflUbfCuAHWnY/pub
https://docs.google.com/document/d/e/2PACX-1vS4eGHO3lJ5nQb09wLzvCxlk4WVUYcZQR1UGrcKtAY99Jz7Vqoix4OAgCvZKQM3yxvLLreG3jM-m7zR/pub
https://docs.google.com/document/d/e/2PACX-1vSrd5ET1gc4wl2mW0FnOtgA7xG2LXZKwPhu0VwMFttRqAf89PIDs4QX1Sio6FobIP1ohxUe9CuDUnR2/pub
https://docs.google.com/document/d/e/2PACX-1vSsf1gL56xQGmvAnEOCYpjpl2f1zcEvV5kIQUZAn8ZhG4DWKtXbe4InQqxR_ILwlGecr6nUWumpApxG/pub
https://docs.google.com/document/d/e/2PACX-1vSYr0SPVSJOQLtF96wqwsmwZiHmtj_pHpq1eJiYvJDsDjmeoaKXcffMmjTAbrUEYTOPQa0Ck9SqCcGU/pub
https://docs.google.com/document/d/e/2PACX-1vTBqY1EHOR6rBSsIJxfAEayczUyKGFFSboMoQy0ZQGMo1GvazkUXqJIBtnew7drlDipf0Bw6rOk0-Pr/pub

MALDOC DOWNLOAD URLS
https://www.keepsmilinglog.com/includes/cache/nob.php
https://pepselectricailservice.co.uk/dangerous.php
https://facturasenlineamarx.com/numskull.php
https://facturasenlineamarx.com/socials.php

facturasenlineamarx.com
keepsmilinglog.com
pepselectricailservice.co.uk

MALDOC FILE HASHES
0209_2385408482604.doc
aca88c452204462e7be913009fd38199

HANCITOR PAYLOAD FILE HASHES
W0rd.dll
deb1e328feb39c49c0a39cd37d4f7792

HANCITOR C2
http://sibetaver.com/8/forum.php
http://ceirsitsin.ru/8/forum.php
http://formawas.ru/8/forum.php