Hancitor fake invoice September 21, 2017

Hancitor fake invocie phish September 21, 2017
From: Advanced Maintenance Inc. <[email protected]>
Subject: FW: Your Invoice I11<7 digits> from Advanced Maintenance
Downloaded document name: invoice_<6 digits>.doc
Document SHA256: 39d99fdcc0bd9bb9c7ccf65af499eec073265424f1310bc02b51954b8f6f9782

Phishing URLs   (email not base64 encoded)
eafgi.com/in.php?n=
elefson.com/in.php?n=
elefson.info/in.php?n=
elefsonhvac.biz/in.php?n=
howtobeanemployee.com/in.php?n=
ktraintrucking.com/in.php?n=
trustdeedcapital.info/in.php?n=
trustdeedcapital.net/in.php?n=
trustdeedcapital.org
wpipm.net/in.php?n=
wpipm.org/in.php?n=

C2 domains
http://saritbida.com/ls5/forum.php
http://getinwithme.ru/ls5/forum.php
http://maheckkejec.ru/ls5/forum.php

Malware download sites
File 1 SHA256 969f1d78a5f40302af23ad52c03755db678118673ba55bd9947a241e51f148a2
File 2 SHA256 0a2a674f6f2c8bb7181b5140925875c4e71165e1e432507950b742bc4a8d909e
File 3 SHA256 6b8d6fab9f6b12a41b9a4380cd9f48f51aef4bfff4d837a7fefcd4e0e79306e9
http://3dprintbudapest.com/wp-content/plugins/all-in-one-seo-pack/2
http://www.photo4passion.at/wp-content/plugins/lumen-gallery/2
http://alvesmarcia.com.br/wp-content/plugins/tilt-social-share-widget/2
http://brs4.com.br/wp-content/plugins/duplicate-post/2
http://aidiag.azurewebsites.net/wp-content/plugins/polylang/2
http://marketresearchlosangeles.com/wp-content/themes/twentythirteen/inc/2