Hancitor DocuSign phish Sep 6, 2017

Hancitor fake docusign
September 6, 2017
From: Josh Cammarata via DocuSign <[email protected]>
Subject: Your Bill <6 digits > for <your domain name> Document is Ready for Signature
Download document name: Bill_<6 digits>.doc
Document SHA-256: a0dd72b63810f1d2580e4d21ab34b34d38c0df60e786854174d4346073738b9b

Phishing URLs
http://jadyngrimes.com/doc.php?d=
http://superiorcomfortpro.com/doc.php?d=
http://gagesutton.com/doc.php?d=
http://christopherwadleigh.com/doc.php?d=
http://metropolitanrealtor.com/doc.php?d=
http://cullomfamily.com/doc.php?d=
http://maverickmarina.com/doc.php?d=
http://LEXIGRIMES.COM/doc.php?d=
http://SUPERIORCOMFORTPRO.COM/doc.php?d=
http://thecullomfamily.com/doc.php?d=
http://sellashack.org/doc.php?d=

C2 URLs
http://laruhanligh.com/ls5/forum.php
http://sotoldrenha.ru/ls5/forum.php
http://thetrepsofren.ru/ls5/forum.php

Malware links
File 1 SHA-256 faa49085f3276592fc6b8cee77c4f7c1bea5a168a48715f54668bf7b0ca6fcde
File 2 SHA-256 e081d234fa6a856fd36fa0188d3050f301bd1db279838046b52ccc5694124254
File 3 SHA-256 d6450b9560e5e41ed112039ae9c6840be098add4e961d7104fa8f97dea76e339
http://wallico.com/wp-content/plugins/jetpack/2
http://juvelyra.lt/wp-content/plugins/price-calc/2
http://helalinden.net/wp-content/plugins/responsive-lightbox/2
http://conniemackbaseball.com/wp-content/plugins/google-analytics-dashboard/2
http://noroadnoproblem.com/wp-content/plugins/gd-star-rating/options/2
http://eliya-s.ru/wp-content/plugins/debug-bar-console/3