Hancitor Oct 4, 2017 bill for September IOCs

Hancitor Oct 4, 2017 bill for September
From: [email protected]
Subject: RE: FW: bill for september
Downloaded document name: invoice_309454.doc
Document SHA256: 025fda9d7cafd219263eed912ee1559331aa93bfdbc375e5c2a8d5843a9376ba

Phishing URLs
bealsautobody.com
gkiconline.com
gkicrenegademovement.com
gkicrenegadeportal.com
magneticmkg.com
prime2cure.com
renegademillionaire.net
renegademillionaire.org
renegademillionairebootcamp.com
renegademillionairebootcamp.net
renegademillionairebootcamp.org
renegademillionairemarketing.net
renegademillionairemarketing.org
renegademovmt.com
renegadeportal.com

C2
http://etledkeor.com/ls5/forum.php
http://verorwabu.ru/ls5/forum.php
http://rikinpartoft.ru/ls5/forum.php

Malware Delivery links
http://divyalifecare.com/wp-content/plugins/contact-form-with-captcha/2
http://panelchair.com/wp-content/plugins/huzzaz-video-gallery/2
http://emdom.ru/.well-known/pki-validation/2
http://quadrisufi.com/wp-content/plugins/googleanalytics/2
http://www.stefanialeto.it/wp-content/plugins/three-column-screen-layout/2
http://designingcustomerexperience.com/wp-content/plugins/cookie-law-info/3

File1 SHA256 c7c94e3ac2b20b1bc05e0f6568c88543b69151961a68b780cacbe5a378cc0920
File2 SHA256 cb7dfe65660e4e8102e326c31ce909e5cef58595507d5cd79cc184ccaa4248fc
File3 SHA256 93d27448f8f15b4987b4af535b1a45fc4f0fb073b6cd86921b28bfec7d32fe8d