Hancitor Nov 13

https://www.hybrid-analysis.com/sample/106fcd233b12b9e79dc6b87b62f28005f45baba2a4c460d6fc1a82fbdf8f3b45?environmentId=100
https://www.threatcrowd.org/ip.php?ip=78.155.207.67

doc dl
http://mykidsplate.com?b7SOwKKE750a3X3Eir=
http://statewidelending.net?xY5l34SOhAC88=
http://polyprovision.com?q24ja1ik5HKY=

hancitor c2
http://roprewonewit.com/ls5/forum.php
http://thesidarat.ru/ls5/forum.php
http://geetredcal.ru/ls5/forum.php

additional payload dl
enchantedprose.com/wp-content/plugins/simple-link-list-widget/1
enchantedprose.com/wp-content/plugins/simple-link-list-widget/2
enchantedprose.com/wp-content/plugins/simple-link-list-widget/3
below thanks to @cheapbyte!
http://tbbmonline.com/wp-content/plugins/advanced-custom-fields/2
http://floristerialasdalias.com/wp-content/plugins/justsecure/2
http://bamrungrak.ac.th/wp-content/plugins/autoptimize/2
http://kwanasia.com/2

pony c2
roprewonewit.com/mlu/forum.php

evil-pony c2
roprewonewit.com/d2/about.php

pandabanker dl
https://rowrorofrat.com/3rafesimuuvutubazromu.dat
https://rowrorofrat.com/webinjects.dat
https://rowrorofrat.com/3rafesimuuvutubazromu.exe
https://rowrorofrat.com/webinject32.bin
https://rowrorofrat.com/grabber.bin
https://rowrorofrat.com/vnc32.bin
https://rowrorofrat.com/backsocks.bin
https://rowrorofrat.com/keylogger.bin