2018-05-02-Hancitor

Sender: [email protected]
Subjects: Your Verizon Wireless invoice, Here is your Verizon Wireless bill, Your mobile bill, Here is your mobile invoice, Here is your Verizon Wireless invoice, Here is your Verizon cellular bill, Your Verizon cellular invoice, Here is your Verizon cellular invoice, Your Verizon cellular bill

#Doc Download Domains:
countywidememorials.com
ryanandrie.me
kwrn1550am.com
countywidemonuments.com
youngsvillehousevalues.com
sleeplavish.com
prescriptionerrorlawyer.com
solutionsforsanjose.info
solutionsforsanjose.net
sawgrasspark.com
youngsvilleproperties.com

#Hancitor C2
hxxp://hemfeketro.com/4/forum.php
hxxp://gejohntorsar.ru/4/forum.php
hxxp://tonstinnotna.ru/4/forum.php

#Hancitor Payload Links
hxxp://fatcowcoupon.us/wp-content/plugins/nofollow-for-external-link/1
hxxp://alphafinancialservices.net/wp-content/themes/twentyeleven/inc/1
hxxp://buckscountybass.com/wp-content/themes/canvas-bcac/1
hxxp://mattbennett.ca/wp-content/themes/spark/inc/1
hxxp://hugefrigginarms.com/wp-content/themes/twentyfifteen/1

hxxp://fatcowcoupon.us/wp-content/plugins/nofollow-for-external-link/2
hxxp://alphafinancialservices.net/wp-content/themes/twentyeleven/inc/2
hxxp://buckscountybass.com/wp-content/themes/canvas-bcac/2
hxxp://mattbennett.ca/wp-content/themes/spark/inc/2
hxxp://hugefrigginarms.com/wp-content/themes/twentyfifteen/2

hxxp://fatcowcoupon.us/wp-content/plugins/nofollow-for-external-link/3
hxxp://alphafinancialservices.net/wp-content/themes/twentyeleven/inc/3
hxxp://buckscountybass.com/wp-content/themes/canvas-bcac/3
hxxp://mattbennett.ca/wp-content/themes/spark/inc/3
hxxp://hugefrigginarms.com/wp-content/themes/twentyfifteen/3

#Pony C2
hxxp://hemfeketro.com/mlu/forum.php
hxxp://gejohntorsar.ru/mlu/forum.php
hxxp://tonstinnotna.ru/mlu/forum.php

#Panda Config
t":	"2.6.8",
"check_config":	327685,
"send_report":	655370,
"check_update":	1966110,
"url_config":	"https://robwassotdint.ru/1kewoimzatybewoliowof.dat",
"url_webinjects":	"https://robwassotdint.ru/68webinjects.dat",
"url_update":	"https://robwassotdint.ru/1kewoimzatybewoliowof.exe",
"url_plugin_webinject32":	"https://robwassotdint.ru/68webinject32.bin",
"url_plugin_webinject64":	"https://robwassotdint.ru/68webinject64.bin",
"remove_csp":	0,
"inject_vnc":	0,
"url_plugin_vnc32":	"https://robwassotdint.ru/68vnc32.bin",
"url_plugin_vnc64":	"https://robwassotdint.ru/68vnc64.bin",
"url_plugin_vnc_backserver":	"Z2KvEWWIVjHCjeytKlg4Ls8=",
"url_plugin_backsocks":	"https://robwassotdint.ru/68backsocks.bin",
"url_plugin_backsocks_backserver":	"Z2KvEWWIVjHCjeytKlg4Ls8=",
"url_plugin_grabber":	"https://robwassotdint.ru/68grabber.bin",
"grabber_pause":	2,
"grab_softlist":	1,
"grab_pass":	1,
"grab_form":	1,
"grab_cert":	1,
"grab_cookie":	1,
"grab_del_cookie":	0,
"grab_del_cache":	0,
"url_plugin_keylogger":	"https://robwassotdint.ru/68keylogger.bin",
"keylog_process":	"cHV0dHkuZXhlAAA=",
"screen_process":	"cHV0dHkuZXhlAAA=",
"reserved":	"EHWYzK2iP0NudL9QxrsRIfKqEAkvVm8bPoNaVoe6sIaDCm5FCsU7HMa/0JKyA+OKKL0gGIXEqmWsckB+8m+LUK6ohAJv2qQOTBRVPiJ9P7sN8BMNbfRQFgMayV1dpjMm9C8V7gI="
}