API tools faq
paste
ExecuteMalware

2020-12-17 Hancitor IOCs

ExecuteMalware
Dec 17th, 2020
4,985
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.90 KB | None | 0 0
raw download clone embed print report
  1. THREAT ATTRIBUTION: HANCITOR
  2.  
  3. HANCITOR BUILD
  4. BUILD=1712_undet67
  5.  
  6. SUBJECTS OBSERVED
  7. You got invoice from DocuSign Electronic Service
  8. You got invoice from DocuSign Electronic Signature Service
  9. You got invoice from DocuSign Service
  10. You got invoice from DocuSign Signature Service
  11. You got notification from DocuSign Service
  12. You received invoice from DocuSign Electronic Service
  13. You received invoice from DocuSign Signature Service
  14. You received notification from DocuSign Signature Service
  15.  
  16. SENDERS OBSERVED
  17. [email protected]
  18. [email protected]
  19. [email protected]
  20. [email protected]
  21. [email protected]
  22. [email protected]
  23. [email protected]
  24. [email protected]
  25. [email protected]
  26. [email protected]
  27. [email protected]
  28.  
  29. MALDOC LANDING PAGE URLS
  30. https://docs.google.com/document/d/e/2PACX-1vQ2QXfOGpxae9IyFfzasZP1u-mT03K1S-TW7hTa6bnitTQMBfXjo7jFQ9CToMfSsnpYDzpdMlct6sjR/pub
  31. https://docs.google.com/document/d/e/2PACX-1vQ_k8CrPpNCrPsDUbfD9hmKcz_-eyncjNzturXJ9iFeaz8Hwwa4sM2tGvm4niK9WiwUMo96YYPi3XYG/pub
  32. https://docs.google.com/document/d/e/2PACX-1vQe-03qu-wutEmftaeT_Uf53buI_EdCg5Ux-9gGzE2vgz6cu2ZBQkN7wg8EhniRDX9z4bQSlzwas_B_/pub
  33. https://docs.google.com/document/d/e/2PACX-1vQl03hxnXxTir2zvOvGekN9OJ06ON1J_6Tsnn31c007_1oFTuZGx-zrBOpsrDPqYXPZ_Ic9sehitTj2/pub
  34. https://docs.google.com/document/d/e/2PACX-1vRROYyqkkZIRkNmvjxJPT7kwstgEIIzt4cGk4O6rSdeNuP0_oIONLbUCSR5nPCcEK9kdZZqLA3NwWsd/pub
  35. https://docs.google.com/document/d/e/2PACX-1vSt-e2k0HQpUADMTE9MBcr66CJzY6VXGKO5BWGiLbCI5tRsF2QiZcwqP8gElzZwS1wHoPQ9tr1HniE9/pub
  36. https://docs.google.com/document/d/e/2PACX-1vSWuuLYx4vpv7ZFB2xQdtt_sK838DR_r-9pxEJX4HIDMdiWAk8JSW1szCGmYchkgOi7FjrYRdVQLgNo/pub
  37. https://docs.google.com/document/d/e/2PACX-1vT4cIgiI75tt8LddzyNAnUTZ8zgpKxIB4DPsyry9xrdrQHZmhOlS0AW25qQz-c4eO8ibE65_DtTUHl-/pub
  38. https://docs.google.com/document/d/e/2PACX-1vTNZjcpwpglRscfZfD7-0BtQSrz-vygWKDNpmUG-pd2hii2olti5Z97sIueHp0j0HrfhJefd90S2a3j/pub
  39.  
  40. MALDOC DISTRIBUTION URLS
  41. http://clientpreview.site/counterfeit.php
  42. http://clientpreview.site/sheepdog.php
  43. http://crm.brees.com.au/multilist.php
  44. http://crm.brees.com.au/november.php
  45. http://plataforma.iestpasco.edu.pe/madera.php
  46. https://hvlegal.com.mx/twitchily.php
  47. https://phqindia.paramwebinfo.in/hardship.php
  48. https://phqindia.paramwebinfo.in/ubiety.php
  49. https://store.matstijmes.com/trephines.php
  50.  
  51. brees.com.au
  52. clientpreview.site
  53. hvlegal.com.mx
  54. iestpasco.edu.pe
  55. matstijmes.com
  56. paramwebinfo.in
  57.  
  58. MALDOC FILE HASHES
  59. 1217_1005636132.doc
  60. 173be5ae82d52008905fbcf25c7b5677
  61.  
  62. 1217_776111571.doc
  63. e62fbfc3525edd9fd0e18002e996cdb6
  64.  
  65. HANCITOR PAYLOAD FILE HASHES
  66. W0rd.dll
  67. 82302391c9e003e5796abee20a6134fa
  68.  
  69. 1217_776111571.doc_ya.wav
  70. 82302391c9e003e5796abee20a6134fa
  71.  
  72. 1217_1005636132.doc_ya.wav
  73. e75c6b79339fed8026e913c8092f9f2f
  74.  
  75. HANCITOR C2
  76. http://wourionlion.ru/8/forum.php
  77. http://peasseal.com/8/forum.php
  78.  
  79.  
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!