Hancitor Oct 30

https://www.hybrid-analysis.com/sample/d2ddcfd70f9fb7eba158c1ce17438bd9328ddfaa6507428be4f802402b15ab9e?environmentId=100
https://www.threatcrowd.org/ip.php?ip=35.198.166.240

doc links:
http://arizonaic.info/s.php?yqj213=
http://tenstepstoyes.org/s.php?yyu105=
http://arizonaic.us/s.php?pai238=

additional IOC's thanks to @Cheapbyte:
https://pastebin.com/qMQ5ssES

hancitor c2:
http://colighaningr.com/ls5/forum.php
http://hisrescoot.ru/ls5/forum.php
http://heptonslacet.ru/ls5/forum.php

payload dl links:
http://kursngi.ru/wp-content/plugins/WPCoreSys/1
http://kursngi.ru/wp-content/plugins/WPCoreSys/2
http://kursngi.ru/wp-content/plugins/WPCoreSys/3
http://icarusplays.org/Aspire_files/afxtoz/1
http://icarusplays.org/Aspire_files/afxtoz/2
http://icarusplays.org/Aspire_files/afxtoz/3

pony c2
http://colighaningr.com/mlu/forum.php

panda banker dls:
https://tontrumuchtors.com/1olysakrigoziuhaspery.dat
https://tontrumuchtors.com/webinjects.dat
https://tontrumuchtors.com/1olysakrigoziuhaspery.exe
https://tontrumuchtors.com/grabber.bin
https://tontrumuchtors.com/webinject32.bin
https://tontrumuchtors.com/vnc32.bin
https://tontrumuchtors.com/backsocks.bin
https://tontrumuchtors.com/keylogger.bin