Hancitor Nov 15

https://www.hybrid-analysis.com/sample/42da997df77d59d9375273e0cb8f5c4d4d39cc4845ec9f6cabc5180fcf3fdf72?environmentId=100

hancitor doc dl
http://precisionroofwashing.info?J8Qe6N4ju2=

below thanks to @pollo290987
futbubblegranada,com
 /wp-content/plugins/backupbuddy/lib/1
 /wp-content/plugins/backupbuddy/lib/2
 /wp-content/plugins/backupbuddy/lib/3

undsadaso,com
 /ls5/forum,php
 /d2/about,php
 /mlu/forum,php

precisionroofwash,[info|net|org|info]
precisionroofwashing,[info|net|org]

below thanks to @cheapbyte
C2
http://undsadaso.com/ls5/forum.php
http://geoftlyhers.ru/ls5/forum.php
http://vefomadint.ru/ls5/forum.php

Malware DL Links
http://futbubblegranada.com/wp-content/plugins/backupbuddy/lib/3
http://hospital-int.com/modules/3
http://mail.abdb.com/wp-content/plugins/google-sitemap-generator/3
http://eseksutu.xyz/3
http://sinovantage.hk/config/3

additional hancitor c2
http://geoftlyhers.ru/ls5/forum.php
http://vefomadint.ru/ls5/forum.php

zloader c2
http://davenyhes.com/bdl/gate.php
http://tofheptorskin.com/bdl/gate.php