Hancitor Jan 29

"RE <domain> scam"
https://www.hybrid-analysis.com/sample/67551c7547012bc5a094f7793d8f0bffd0df64bda06132a965d0a4e8b88545b2?environmentId=100
https://www.threatcrowd.org/ip.php?ip=92.53.77.146

hancitor doc dl links
http://genuscraft.com
http://gigogp.com
http://christs-ministries.com
below thanks to @social_amit
http://paperplanesfly.com

hancitor c2's thanks to @noottrak
http://gosandhegly.com/ls5/forum.php
http://justbegatan.ru/ls5/forum.php
http://spardausefe.ru/ls5/forum.php

additional payload dl
http://aysam.de/wp-content/plugins/qtranslate/1
http://aysam.de/wp-content/plugins/qtranslate/2
http://bhutanwisdomwalks.com/1
http://bhutanwisdomwalks.com/2
http://eusaltoalto.com/3
http://granbrazgranitos.com/3
http://mail.voicesinprintpublishing.com/wp-content/plugins/sticky-posts-in-category/1
http://mail.voicesinprintpublishing.com/wp-content/plugins/sticky-posts-in-category/2
http://mairie-echalas.fr/wp-content/plugins/contact-form-7/1
http://mairie-echalas.fr/wp-content/plugins/contact-form-7/2
http://seguridadefectiva.com/modules/3
http://semprongsakti.com/wp-content/plugins/nextend-google-connect/1
http://semprongsakti.com/wp-content/plugins/nextend-google-connect/2
http://www.interfacetelecom.com.br/3
http://www.neubacher.at/wp-content/plugins/js_composer_theme/include/params/3

pony c2
http://gosandhegly.com/mlu/forum.php

pandabanker dl links
https://waslohidi.ru/1fusiyvubutoqgodypoih.dat
https://waslohidi.ru/62webinjects.dat
https://waslohidi.ru/1fusiyvubutoqgodypoih.exe
https://waslohidi.ru/62webinject32.bin
https://waslohidi.ru/62grabber.bin
https://waslohidi.ru/62webinjects.dat
https://waslohidi.ru/62vnc32.bin
https://waslohidi.ru/62backsocks.bin
https://waslohidi.ru/62keylogger.bin