2018-08-07 eFax themed Hancitor malspam

2018-08-07 eFax themed Hancitor malspam
sender: efax@ramatmed.com

Maldoc URLS
hxxp://byperholl.com
hxxp://hvcrmls.com
hxxp://hvcrmls.info
hxxp://hvcrmls.net
hxxp://hvcrmls.org
hxxp://indownfplex.com
hxxp://mlsulster.net
hxxp://mlsulster.org
hxxp://ucrealtor.org
hxxp://ucrealtors.com
hxxp://ucrealtors.net
hxxp://ucrealtors.org

HANCITOR MALDOC FROM URLS
MD5 00955c1db30ddc172086a061ab158f00
SHA1 01c832997c9cfda7f476b553a1da6555c4190ea2
SHA256 6250c7aa331d54c25a313bc658de5d428d070fb131de1d7687e0aa2012f2d234

.pif HANCITOR dropped
MD5 992f079a832820c61388f753dab1114d
SHA1 bae66d6fda6492399826b3ee6853b35209b5dd42
SHA256 4eab57b420449d3f959b061268f6011dc39494af848eed22b9acdd1e742ab4a3

HANCITOR C2
hxxp://gorindosi.com/4/forum.php
hxxp://herjusronver.ru/4/forum.php
hxxp://notoncibet.ru/4/forum.php

PONY/EVILPONY/PANDA BANKER PAYLOAD URLS from @SaurabhSha15
hxxp://warningshortfilm.com/wp-content/plugins/regenerate-thumbnails/1
hxxp://specializednaturalhealthcarevt.com/wp-content/plugins/constant-contact-widget/1
hxxp://storypower.com/wp-content/plugins/really-simple-captcha/1
hxxp://thefashionforwardmommy.com/wp-content/plugins/contact-form-7/1
hxxp://thctiedye.com/wp-content/plugins/woothemes-updater/1
hxxp://warningshortfilm.com/wp-content/plugins/regenerate-thumbnails/2
hxxp://specializednaturalhealthcarevt.com/wp-content/plugins/constant-contact-widget/2
hxxp://storypower.com/wp-content/plugins/really-simple-captcha/2
hxxp://thefashionforwardmommy.com/wp-content/plugins/contact-form-7/2
hxxp://thctiedye.com/wp-content/plugins/woothemes-updater/2
hxxp://warningshortfilm.com/wp-content/plugins/regenerate-thumbnails/3
hxxp://specializednaturalhealthcarevt.com/wp-content/plugins/constant-contact-widget/3
hxxp://storypower.com/wp-content/plugins/really-simple-captcha/3
hxxp://thefashionforwardmommy.com/wp-content/plugins/contact-form-7/3
hxxp://thctiedye.com/wp-content/plugins/woothemes-updater/3