Hancitor Nov 4/5

https://www.hybrid-analysis.com/sample/aae61193b3b9569f0f50eef9f1165753769974312442f5bb77eb87b91905557c?environmentId=100

doc dl
https://proplustechnologies.com/docs/?id=213892103
https://prospectus.ie/docs/?id=230301

hancitor c2
http://undditotal.com/ls5/forum.php
http://binotytan.ru/ls5/forum.php
http://singutotsof.ru/ls5/forum.php

additional payload
plannerstash.com/wp-content/plugins/affiliates-manager/1
plannerstash.com/wp-content/plugins/affiliates-manager/2
plannerstash.com/wp-content/plugins/affiliates-manager/3
www.bestguysoncam.com/wp-content/plugins/rss_to_draft/1
www.bestguysoncam.com/wp-content/plugins/rss_to_draft/2
www.bestguysoncam.com/wp-content/plugins/rss_to_draft/3
viaregia-tarnow.pl/wp-content/plugins/photo-gallery/1
viaregia-tarnow.pl/wp-content/plugins/photo-gallery/2
viaregia-tarnow.pl/wp-content/plugins/photo-gallery/3
www.mutznutz.ie/wp-content/plugins/bootstrap-shortcodes/1
www.mutznutz.ie/wp-content/plugins/bootstrap-shortcodes/2
www.mutznutz.ie/wp-content/plugins/bootstrap-shortcodes/3

pony c2
undditotal.com/mlu/forum.php
binotytan.ru/mlu/forum.php
singutotsof.ru/mlu/forum.php

evilpony c2
undditotal.com/d2/about.php
binotytan.ru/d2/about.php
singutotsof.ru/d2/about.php

pandabanker dl
https://sedhahenthet.com/1amfeuzwiixzayvlenouc.dat
https://sedhahenthet.com/1amfeuzwiixzayvlenouc.exe
https://sedhahenthet.com/webinjects.dat
https://sedhahenthet.com/webinject32.bin
https://sedhahenthet.com/webinject64.bin
https://sedhahenthet.com/grabber.bin
https://sedhahenthet.com/vnc32.bin
https://sedhahenthet.com/vnc64.bin
https://sedhahenthet.com/backsocks.bin
https://sedhahenthet.com/keylogger.bin
https://sedhahenthet.com/webinjects_1new.dat