Hancitor Nov 1

https://www.hybrid-analysis.com/sample/667752cadad91de5900ec1da18b81a4ba623468d33ce7847330fbd99dba2a263?environmentId=100
https://packettotal.com/cgi-bin/view-analysis.cgi?id=559e4cb0252cc6b5f44677ec44c865ad
https://www.threatcrowd.org/ip.php?ip=45.63.117.36

doc dl links:
http://nikohsec.com/fax.php?smx223=
http://wildwoodreunion.com/fax.php?kkj141=
http://acehh.com/fax.php?qic160=

payload dl links:
puyeshgar.com/1
puyeshgar.com/2
puyeshgar.com/3

hancitor c2:
http://unduseherttan.com/ls5/forum.php
http://usecehahi.ru/ls5/forum.php
http://ratnatalter.ru/ls5/forum.php

pony c2:
unduseherttan.com/mlu/forum.php

eveil-pony c2:
unduseherttan.com/d2/about.php

pandabanker dls:
https://linghogolac.ru/4wouryszobiokixfekaqo.dat
https://tontrumuchtors.com/1olysakrigoziuhaspery.dat
https://henfobuthis.com/2erecogihadocugabylmu.dat
https://rowrorofrat.com/3ifyfovokalgidaivokap.dat
https://linghogolac.ru/webinjects.dat
https://linghogolac.ru/webinject32.bin
https://linghogolac.ru/4wouryszobiokixfekaqo.exe
https://linghogolac.ru/grabber.bin
https://linghogolac.ru/vnc32.bin
https://linghogolac.ru/backsocks.bin
https://linghogolac.ru/keylogger.bin