Hancitor May 14

https://www.hybrid-analysis.com/sample/a9f862a4446d8f26311c7810828d3aac254ccf70aa4352f42551e99efbfdc40b

hancitor c2:
http://robtanrebta.com/4/forum.php
http://ritcahedther.ru/4/forum.php
http://fortadaun.ru/4/forum.php

additional dl:
http://codegreen.cs.wayne.edu/wp-content/plugins/formidable/1
http://codegreen.cs.wayne.edu/wp-content/plugins/formidable/2
http://codegreen.cs.wayne.edu/wp-content/plugins/formidable/3
http://cwhrealestate.com/wp-content/plugins/tweetbutton-for-wordpress/1
http://cwhrealestate.com/wp-content/plugins/tweetbutton-for-wordpress/2
http://cwhrealestate.com/wp-content/plugins/tweetbutton-for-wordpress/3
http://eco-developments.ca/wp-content/plugins/embed-form/1
http://eco-developments.ca/wp-content/plugins/embed-form/2
http://eco-developments.ca/wp-content/plugins/embed-form/3
http://ellenthorp.com/wp-content/plugins/rotator/1
http://ellenthorp.com/wp-content/plugins/rotator/2
http://ellenthorp.com/wp-content/plugins/rotator/3
http://joomquery.com/wp-content/plugins/preferred-languages/inc/1
http://joomquery.com/wp-content/plugins/preferred-languages/inc/2
http://joomquery.com/wp-content/plugins/preferred-languages/inc/3

pony c2:
http://robtanrebta.com/mlu/forum.php
http://ritcahedther.ru/mlu/forum.php
http://fortadaun.ru/mlu/forum.php

evil pony c2:
http://robtanrebta.com/d2/about.php
http://ritcahedther.ru/d2/about.php
http://fortadaun.ru/d2/about.php

pandabanker links:
https://robwassotdint.ru/1kewoimzatybewoliowof.dat
https://robwassotdint.ru/1kewoimzatybewoliowof.exe
https://robwassotdint.ru/68webinject32.bin
https://robwassotdint.ru/68vnc64.bin
https://robwassotdint.ru/68backsocks.bin
https://robwassotdint.ru/68vnc32.bin
https://robwassotdint.ru/68webinjects.dat
https://robwassotdint.ru/68keylogger.bin
https://robwassotdint.ru/68grabber.bin
https://robwassotdint.ru/68webinject64.bin