Hancitor price list phish August 31, 2017

Hancitor fake price list
August 31, 2017

From: Two different emails
Max Ryans <[email protected]>
Kerry Client <[email protected]>
Subject: RE: <Your domain> services price list
Downloaded document name: price_list_<6 digits>.doc
Document SHA-256:

Phishing URLs
http://apadriana.com/list.php?d=
http://verumpharmaceuticals.com/list.php?d=
http://zasbiopharm.com/list.php?d=
http://zashealth.com/list.php?d=
http://zasholdings.com/list.php?d=
http://zaspharma.com/list.php?d=
http://zasproperties.com/list.php?d=
http://zassys.com/list.php?d=

Botnet CNC URLs
http://perewfabet.com/ls5/forum.php
http://hertsirobla.ru/ls5/forum.php
http://dohecrysit.ru/ls5/forum.php

Malware delivery links
File 1 SHA-256: 9bcac2d5dfdf7d408038e0ed4daee70f10eb8d78c6c964650356a166d62067d0
File 2 SHA-256: 72d101eec0c92510cb77b8a934f3233d7f1dfcd78643dce7f9c8df5f6a793bbe
File 3 SHA-256: a8d0df4668bc4325391f838ec09e85ac5b39ffc8a77325f1d53888f3d35919ae
http://utilitia.com/wp-content/plugins/custom-post-type-ui/2
http://microtech-bio.com/wp-content/plugins/post-templates/2
http://manchafactory.com/2
http://spidermobil.com/wp-content/plugins/velocityPortfolio/2
http://devorahmedwin.com/wp-content/themes/shopera/inc/2
http://halletts.com/wp-content/plugins/wp-db-backup-made/3