Hancitor fake FedEx Delivery Invoice Phish IOC Oct 2, 2017

Hancitor fake FedEx Delivery Notice Invoice Oct 2, 2017
From: FedEx Shipments <[email protected]>
Subject: Delivery complete for parcel # <8 Digits>
Downloaded document name: invoice_<6 digits>.doc
Document SHA256: 76e21c186f3d673aeb836740a3db31fd51fb08c98b78d8d7a8cfecab71d9ec5a

Phishing URLs
cleanairexperts.com
gonegreensupply.com
http://palmbeachautomotive.com/f.php?hgb=
palmbeachautomotives.com
palmbeachmarinecontractor.com
palmbeachstrykers.com
southfloridamarinecontractor.com
southfloridasupply.com

C2 Domains
http://kedmolorop.com/ls5/forum.php
http://veledguse.ru/ls5/forum.php
http://etidhimand.ru/ls5/forum.php
pahattitbut.com
sehiscefo.com

Malware Delivery links
http://edgemarcenter.org/wp-content/plugins/link-to-url-post/2
http://fatpetesbbq.com/wp-content/plugins/advanced-custom-fields/2
http://priyonodr.com/wp-content/plugins/display-categories-widget/2
http://ufep.org/wp-content/plugins/events-manager/2
http://tttconstruction.co.za/wp-content/plugins/google-sitemap-generator/3
http://icarusplays.com/3
File1 SHA256: 5dd5b207e7238a51e8ae20e2f6c5b732e5110e3cbe99bf5cf3f9d9a174577687
File2 SHA256: c9ad51ae4fd981fc736ff0aac0a158e9973f4225be8c0fb2274ca4f86021bc2e
File3 SHA256: 33f205475f32ee45fc764e54441704c4e8bdb90a8aef881b77b7c4e25754517c

zloader rc4 key Thanks to James in the Box
TyweJ848wWb7o0JfQMfY6pyd6YEp0pI2