Hancitor August 30, 2017 fake Delta ticket phish

August 30, 2017

From: Delta Airlines Inc. <[email protected]>
Subject: Your order DELTA<8 digits> has been approved!
Downloaded document ticket_<6 digits>.doc
Document SHA256: 8b48d6965f3222b877211f8b17be3ffc559071da36aae668a6302692ec38901e

Phishing URLs
http://myhearthstonehomes.info/i.php?d=
http://myhearthstonehomes.org/i.php?d=
http://ourrealtyguy.org/i.php?d=
http://ourrealtyguy.info/i.php?d=
http://ourrealtyguy.net/i.php?d=
http://antoineandmuse.com/i.php?d=
http://package2china.com/i.php?d=


Botnet CNC URLs
http://uneventrendi.com/ls5/forum.php
http://ketofonerof.ru/ls5/forum.php
http://thettertrefbab.ru/ls5/forum.php

Malware delivery URLs
File 1 SHA256: 292265dcc0cee853b42bdace25c4fba3315ca945ae9020e11cdccad1490ea44d
File 2 SHA256: ccc93185d8ad2c3016bad403b36571a9ed419af1e63f70ffef45c6a9933f216e
File 3 SHA256: 538d990dc6c21073715baabb4b98a5135d291a70e862ea163fa60e3230c4f71d
http://mebelucci.com.ua/wp-content/plugins/bwp-google-xml-sitemaps/1
http://mutznutzpetcare.com/wp-content/plugins/category-posts/2
http://ozkayyapi.com.tr/wp-content/plugins/revslider/inc_php/3
http://www.x3host.net/wp-content/plugins/wordpress-importer/2
http://www.madhunt.xyz/wp-content/plugins/featured-video-plus/2
http://sgs36.ru/wp-content/plugins/lightbox-plus/2