2018-07-10 Hancitor/Pony/EvilPony/Panda

2018-07-10 Hancitor / Pony / EvilPony / Panda Banker

SENDER
hellosign@forkliftsparts.com

HANCITOR MALDOC
970e3e702d5418f8f4be8e883bff49b3
18f174568a7811d84baa3f5dc8c9a6c412090c31
9ea79e7036b293d6a0023270957729dd21eaf73b738332f2ef73cd41d679f676

Dropped executable PIF
d837ecbe44ef9465d2910c0d8ea2e215
a9482b98b5ced2149869c7cf702b24967ad9ef6d
f219305714330e9d06f39c334efa40c7014fe735b6999eacf5cf7936c623cc8c

HANCITOR C2
hxxp://onerefrepnot.com/4/forum.php
hxxp://talighutsin.ru/4/forum.php
hxxp://undsuphesgot.ru/4/forum.php

PONY / EVILPONY / PANDA BANKER PAYLOAD URLS
hxxp://aakaii.com/wp-content/plugins/post-thumbnail-editor/2
hxxp://aakaii.com/wp-content/plugins/post-thumbnail-editor/1
hxxp://aakaii.com/wp-content/plugins/post-thumbnail-editor/3

PONY / EVIL PONY C2
hxxp://onerefrepnot.com/mlu/forum.php
hxxp://onerefrepnot.com/d2/about.php

PANDA BANKER PAYLOAD
7fd9f29628c0cdb54963b49615045f9b
c2b8eea32554f7562f024a074d902bc8dfda7b9c
8a26412234ec7cb43b07bae7e9910eb0f7eb807cf8581abed56aafaf514ac4a2

PANADA BANKER DOMAIN
encitimefoan.ru


https://app.any.run/tasks/a24570df-fb0a-4c04-9209-07f04fdce555 -- hancitor
https://app.any.run/tasks/41fb76e9-36fc-45d8-a842-ba6d277c2be7  -- panda