2018-07-31 Hancitor/Panda

Sender: irs@aubodyshop.com
Subjects: IRS Notification, Internal Revenue Service, IRS Notice to the Taxpayer, IRS Taxpayer Notice, IRS Taxpayer Notification, Internal Revenue Service Taxpayer Notice, IRS Notice of intent to levy, IRS Final Notice, Internal Revenue Service Important Notification

#Word doc loader domains
cliptrips.org
greatharvestfranchising.com
destinationvasectomy.net
greatharvestbreadco.info
greatharvestbread.info
destinationvasectomy.info
greatharvestbirmingham.com
greatharvest.info
govdelivery.co
marychurchphotography.net
racheldessinphotography.net
racheldessinphotography.com
richlandbrewingco.com
marychurchphotography.co
great-harvest.us
great-harvest.biz

#Hancitor C2s
fortryhowpar.com/4/forum.php
terabsedsand.ru/4/forum.php
widingwild.ru/4/forum.php

#Hancitor payload URLs
{l:
hxxp://uptowndermatologyandaesthetics.com/wp-content/plugins/header-footer/lib/easytabs/1
hxxp://powerplaygenerators.com/wp-content/plugins/et-shortcodes/1
hxxp://newswriting.com/wp-content/plugins/disable-comments/includes/1
hxxp://www.geriatricdementiaconsulting.com/wp-content/plugins/gravityforms/includes/1
hxxp://vermontlinestriping.com/wp-content/plugins/wp-super-cache/1
}

{b:
hxxp://uptowndermatologyandaesthetics.com/wp-content/plugins/header-footer/lib/easytabs/2
hxxp://powerplaygenerators.com/wp-content/plugins/et-shortcodes/2
hxxp://newswriting.com/wp-content/plugins/disable-comments/includes/2
hxxp://www.geriatricdementiaconsulting.com/wp-content/plugins/gravityforms/includes/2
hxxp://vermontlinestriping.com/wp-content/plugins/wp-super-cache/2
}

{r:
hxxp://uptowndermatologyandaesthetics.com/wp-content/plugins/header-footer/lib/easytabs/3
hxxp://powerplaygenerators.com/wp-content/plugins/et-shortcodes/3
hxxp://newswriting.com/wp-content/plugins/disable-comments/includes/3
hxxp://www.geriatricdementiaconsulting.com/wp-content/plugins/gravityforms/includes/3
hxxp://vermontlinestriping.com/wp-content/plugins/wp-super-cache/3
}

#Panda C2
nauseorofte.ru

#Panda Config
t":	"2.6.10",
"check_config":	327685,
"send_report":	655370,
"check_update":	1966110,
"url_config":	"https://nauseorofte.ru/1ifmuybbolakuotegepma.dat",
"url_webinjects":	"https://nauseorofte.ru/610webinjects.dat",
"url_update":	"https://nauseorofte.ru/1ifmuybbolakuotegepma.exe",
"url_plugin_webinject32":	"https://nauseorofte.ru/610webinject32.bin",
"url_plugin_webinject64":	"https://nauseorofte.ru/610webinject64.bin",
"remove_csp":	0,
"inject_vnc":	0,
"url_plugin_vnc32":	"https://nauseorofte.ru/610vnc32.bin",
"url_plugin_vnc64":	"https://nauseorofte.ru/610vnc64.bin",
"url_plugin_vnc_backserver":	"Z2KvEWWIVjHCjeytKlg4Ls8=",
"url_plugin_backsocks":	"https://nauseorofte.ru/610backsocks.bin",
"url_plugin_backsocks_backserver":	"Z2KvEWWIVjHCjeytKlg4Ls8=",
"url_plugin_grabber":	"https://nauseorofte.ru/610grabber.bin",
"grabber_pause":	2,
"grab_softlist":	1,
"grab_pass":	1,
"grab_form":	1,
"grab_cert":	1,
"grab_cookie":	1,
"grab_del_cookie":	0,
"grab_del_cache":	0,
"url_plugin_keylogger":	"https://nauseorofte.ru/610keylogger.bin",
"keylog_process":	"cHV0dHkuZXhlAAA=",
"screen_process":	"cHV0dHkuZXhlAAA=",
"reserved":	"EHWYzK2iP0NmeKxDwa0DPfOuV0QjVC0GY4BCSoGmr5mPGXJMBt07AMq1yJ7+Sea