Hancitor Nov 16

https://www.hybrid-analysis.com/sample/6fe85a61e30079df0899027fcd8dde318984044a2f0e3904e87d33c8e6fd9247?environmentId=100
https://app.any.run/tasks/17a546a7-0e9a-4c16-bb3e-69125e82dba8
https://www.threatcrowd.org/ip.php?ip=185.111.219.77
https://www.threatcrowd.org/ip.php?ip=104.197.100.63

pandabanker ha run
https://www.hybrid-analysis.com/sample/73381dddc426b49baa445378853c761f411a5fe65b7da736b91979645e5c703f?environmentId=100

doc dl
http://galleryone.org?NeGDUYCjzY2YE=
http://toyotacabinairfilters.com?1W4sYLE5OFDogYjaki=
http://galleryone.net?E1812LU2o841JE4Ru=
below thanks to @rin0x0
hxxp://appalachianpavingconcrete.com

hancitor c2
http://calsandhefe.com/ls5/forum.php
http://hihissparjus.ru/ls5/forum.php
http://gahowunjus.ru/ls5/forum.php

payload dl
thunder-and-storm.de/1
thunder-and-storm.de/2
thunder-and-storm.de/3
additional payload dl thanks to @cheapbyte
http://www.chiafrescas.com/wp-content/plugins/favicon-xt-manager/3
http://hakiasta.com/wp-content/plugins/mt-shortcodes/3
http://hystertransmissionparts.com/cp/3
http://beautifulgrace.org/wp-content/plugins/nextgen-gallery/3

pony c2
calsandhefe.com/mlu/forum.php
hihissparjus.ru/mlu/forum.php
gahowunjus.ru/mlu/forum.php

evil-pony c2
calsandhefe.com/d2/forum.php
hihissparjus.ru/d2/forum.php
gahowunjus.ru/d2/forum.php

pandabanker dl
https://rowrorofrat.com/3rafesimuuvutubazromu.dat
https://rowrorofrat.com/webinjects.dat
https://rowrorofrat.com/3rafesimuuvutubazromu.exe
https://rowrorofrat.com/webinject32.bin
https://rowrorofrat.com/grabber.bin
https://rowrorofrat.com/vnc32.bin
https://rowrorofrat.com/backsocks.bin
https://rowrorofrat.com/keylogger.bin