2018-08-21 eFax themed Hancitor

2018-08-21 eFax themed Hancitor

sender:  efax@redelephantpizza.com

maldoc distribution URLs
hxxp://agggt.com
hxxp://agggtm.com
hxxp://avatarhotleads.com
hxxp://avatarhottransfers.com
hxxp://colemanpreowned.com
hxxp://colemanused.com
hxxp://discountsaunastore.com
hxxp://ernestocigars.com
hxxp://exercisesupercenter.com
hxxp://greenrivergoods.com
hxxp://indicatrading.com
hxxp://indicatrading.info
hxxp://smarthomeiconnect.com
hxxp://steampunktfunk.com
hxxp://taylornewgenerations.com
hxxp://totallyconneted.com
hxxp://warp9computers.me
hxxp://warp9computers.org
hxxp://www.smarthomeiconnect.com

maldoc from distro URLs
MD5 f2e4ac5d86d1ccbc322746a0f4d03f36
SHA1 e19cfa4a0b5e886f715d1ed86d4798d9b95e8b11
SHA256 bceaa25d38775cf8ba6c21e77d62a1ea204b37bda59a25c0a4a56b97d97f0da4

hancitor c2
http://sparthenymo.com/4/forum.php
http://idathothet.ru/4/forum.php
http://veusegory.ru/4/forum.php

pony/evilpony/panda banker payload urls
http://vides.org/1
http://jaros.at/wp-content/plugins/1
http://vides.org/2
http://jaros.at/wp-content/plugins/2
http://vides.org/3
http://jaros.at/wp-content/plugins/3

pony c2
http://sparthenymo.com/mlu/forum.php
http://idathothet.ru/mlu/forum.php
http://veusegory.ru/mlu/forum.php

evilpony c2
http://sparthenymo.com/d2/about.php

panda banker payload
3bb28c35fb927eea849d4804f40d593b
6237c65ef7cc7be9c4e23669f27a4c0190c92181
1f9ea3ac34fa5a770c3827ed5aa800a284f57bd921160e307af4353789537599

potential panda banker domain
cemoottal.ru