2018-04-25-Hancitor

Malspam sender: [email protected]
Malspam Subjects:
Please revew and sign a document from HelloSign
Please revew and sign a document
Review and sign a document from HelloSign
Review and sign a document
You've received a document

Document loader domains:
bchng.org
iqprofitmarketing.com
remkiks.com
olivechildren.org
packthepack.com
sauceydinners.com
newenglanddivingservices.com
hornycheerleaders.org
umsteadsystems.org
umsteadsystems.net
iqprofitmarketing.com

Payload Domains:
hxxp://www.sight-admissions.com/wp-content/plugins/soundcloud-shortcode/1
hxxp://ahomesuitehome.com/wp-content/plugins/litespeed-cache/includes/1
hxxp://mail.tasteoffresh.com/wp-content/plugins/floating-social-media-icon/includes/1
hxxp://www.valcocchiararetreat.com/wp-content/plugins/replace-image/1
hxxp://tabandehgostar.com/wp-content/plugins/wp-db-backup/1

hxxp://www.sight-admissions.com/wp-content/plugins/soundcloud-shortcode/2
hxxp://ahomesuitehome.com/wp-content/plugins/litespeed-cache/includes/2
hxxp://mail.tasteoffresh.com/wp-content/plugins/floating-social-media-icon/includes/2
hxxp://www.valcocchiararetreat.com/wp-content/plugins/replace-image/2
hxxp://tabandehgostar.com/wp-content/plugins/wp-db-backup/2

hxxp://www.sight-admissions.com/wp-content/plugins/soundcloud-shortcode/3
hxxp://ahomesuitehome.com/wp-content/plugins/litespeed-cache/includes/3
hxxp://mail.tasteoffresh.com/wp-content/plugins/floating-social-media-icon/includes/3
hxxp://www.valcocchiararetreat.com/wp-content/plugins/replace-image/3
hxxp://tabandehgostar.com/wp-content/plugins/wp-db-backup/3

Hancitor C2s:
facabeand.com/4/forum.php
hadcaldintheck.ru/4/forum.php
withersmebet.ru/4/forum.php

Panda URLs:
"url_config":	"https://wilhedseddin.com/1axvabouldukiwuesenva.dat",
"url_webinjects":	"https://wilhedseddin.com/68webinjects.dat",
"url_update":	"https://wilhedseddin.com/1axvabouldukiwuesenva.exe",
"url_plugin_webinject32":	"https://wilhedseddin.com/68webinject32.bin",
"url_plugin_webinject64":	"https://wilhedseddin.com/68webinject64.bin",
"url_plugin_vnc32":	"https://wilhedseddin.com/68vnc32.bin",
"url_plugin_vnc64":	"https://wilhedseddin.com/68vnc64.bin",
"url_plugin_backsocks":	"https://wilhedseddin.com/68backsocks.bin",
"url_plugin_grabber":	"https://wilhedseddin.com/68grabber.bin",
"url_plugin_keylogger":	"https://wilhedseddin.com/68keylogger.bin",