Hancitor fake invoice debit phish IOCs Sep 28, 2017

Hancitor fake invoice debit phish Sep 28, 2017
From: Cameron WALKER(Random Names) <[email protected]>
Subject: RE: invoice <7 digits> debit
Downloaded Document Name: invoice_<6 digits>.doc
Document SHA256: ce65eaca0d86a6b00680e428f2901e3b4f0a822ebff39b1dfaca3c7387d9b52f

/vs.php?XXX=  where XXX is random
Phishing URLs
livenrich.cn/[email protected]
livenrich.com.cn
livenrich.net.cn
livenrich.org.cn
livenrich.us
livenrich88.com
livenrichjuice.info
livenrichjuice.net
loangenuity.net
livenrich.org.cn

C2 domains
http://renbimado.com/ls5/forum.php
http://bableftteret.ru/ls5/forum.php
http://fowastaso.ru/ls5/forum.php

Malware Delivery URLs
File1 SHA256: f1853d267e30b01d13dd1b9067f675bdf0114a998cb1a2db30a86dab5a84d6b1
File2 SHA256: c4d454227c9f7bc5e85ff114b03f4cd78a43fbd96aa24bf9e55c5e827dbfe7a3
File3 SHA256: e7f863bb61f3f4e5f224dec33c5977bdef6c3751112f97b133e0a625f5d86bec
http://tttconstruction.co.za/wp-content/plugins/google-sitemap-generator/1
http://portfolio.julianwilke.com/wp-snapshots/1
http://shensnaps.com/wp-content/plugins/assets/1
http://allinfilms.com/wp-content/plugins/custom-contact-forms/1
http://domainedupech.com/wp-content/plugins/tinymce-advanced/2
http://optics-karlsruhe.de/parseopmla/2
zloader rc4 key:
TyweJ848wWb7o0JfQMfY6pyd6YEp0pI2