Hancitor Jan 10

https://www.hybrid-analysis.com/sample/85d2ba3f12877bf7e531ec1970909f2ea20f55ba17d27f4a5b65e8e8dc493909?environmentId=100

doc dl
http://toxinfreeclub.com
http://frankisaacjewelers.com
http://frankisaac.net
http://grapeleafcafe.com

payload links
http://cantelco.net/wp-content/plugins/simple-map/11
http://cantelco.net/wp-content/plugins/simple-map/22
http://cantelco.net/wp-content/plugins/simple-map/3
http://dpadistribuidora.com.br/wp-content/plugins/favicon-xt-manager/11
http://dpadistribuidora.com.br/wp-content/plugins/favicon-xt-manager/22
http://dpadistribuidora.com.br/wp-content/plugins/favicon-xt-manager/3
http://expatrions-nous.com/wp-content/plugins/ultimate-wp-cache/11
http://expatrions-nous.com/wp-content/plugins/ultimate-wp-cache/22
http://expatrions-nous.com/wp-content/plugins/ultimate-wp-cache/3
http://ricecitysonghong.com/wp-content/plugins/google-sitemap-plugin/includes/11
http://ricecitysonghong.com/wp-content/plugins/google-sitemap-plugin/includes/22
http://ricecitysonghong.com/wp-content/plugins/google-sitemap-plugin/includes/3
http://tierspende.org/wp-content/themes/twentyfourteen/11
http://tierspende.org/wp-content/themes/twentyfourteen/22
http://tierspende.org/wp-content/themes/twentyfourteen/3

hancitor c2
unhesrowrab.com/ls5/forum.php
henrenbilac.ru/ls5/forum.php

pony c2
unhesrowrab.com/mlu/about.php

evilpony c2
unhesrowrab.com/d2/about.php

pandabanker host
https://disithedtse.com/1debyfesuyrciyqvaquby.dat
https://disithedtse.com/ydWj/NVBc5JNgLzmhx5OeL/Jvg0w
https://disithedtse.com/1debyfesuyrciyqvaquby.exe
https://disithedtse.com/61webinjects.dat
https://disithedtse.com/61webinject32.bin
https://disithedtse.com/61webinject64.bin
https://disithedtse.com/61grabber.bin
https://disithedtse.com/61vnc32.bin
https://disithedtse.com/61vnc64.bin
https://disithedtse.com/61backsocks.bin
https://disithedtse.com/61keylogger.bin