Hancitor IRS and SolarWinds Phishing IOCs Oct 5, 2017

Hancitor Oct 5, 2017 IRS and SolarWinds Phish IOCs
From: [email protected]
Subject: FW: IRS
From: [email protected]
Subject: Make Hacking Difficult

SolarWinds Downloaded document name: ebook_<6 digits >.doc
SolarWindows SHA256: 3ab1f686ce7355bd4405e66aacb148cea198ceb26cd1c0b15b9ddd7c3d68a682

IRS Downloaded document name: subpoena_<6 digits>.doc
IRS Document SHA256:3ab1f686ce7355bd4405e66aacb148cea198ceb26cd1c0b15b9ddd7c3d68a682

Phishing URLs
all4insurance.com/[email protected]
creatingmiracleswithmalas.com
creatingmiracleswithmalas.net
goal-link.com
integralund.com
prayersmalasandmiracle.com
prayersmalasandmiracles.com
prayersmalasandmiracles.net
satyainstitute.biz
satyainstitute.com
satyainstitute.info
satyainstitute.net
satyawholesale.com

C2 domains
http://talwilwasled.com/ls5/forum.php
http://wasidrinve.ru/ls5/forum.php
http://dapahedtsed.ru/ls5/forum.php

Malware Download URLs
http://timwaters.com.au/wp-includes/pomo/2
http://thijsfeuth.nl/plugins/files/2
http://lelukauppa.pro/wp-includes/pomo/3
http://timwaters.com.au/wp-includes/pomo/3
http://thijsfeuth.nl/plugins/files/3

File1 SHA256: b10ca7fcbce3fa534f7a53c366ee823817465a49b004998fd80e07e5c64e14d8
File2 SHA256: d85a58776e5230c18fd1e5cf8f3c7cc5efb4bac4efe741958a3118168ea5414b
File3 SHA256: 5ac18efce332a9bebcc46fbcb2c7944ae7ed382be3460b0bacb00aea8e1b14e0