Hancitor Apr 19

hellofax

panda ha:
https://www.hybrid-analysis.com/sample/47340ab357291de9bcb8cac8232b1c94ba4fdf1ddddeea5b43fab814ebff9881?environmentId=100

hancitor c2
caharthenret.com/4/forum.php
naotuseor.ru/4/forum.php
pertacikin.ru/4/forum.php

additional downloads
http://flushstance.com/1
http://flushstance.com/2
http://flushstance.com/3
http://ofczianka.hu/wp-content/themes/twentyfifteen/inc/1
http://ofczianka.hu/wp-content/themes/twentyfifteen/inc/2
http://ofczianka.hu/wp-content/themes/twentyfifteen/inc/3
http://saedpartnership.org/wp-content/plugins/envato-market/inc/1
http://saedpartnership.org/wp-content/plugins/envato-market/inc/2
http://saedpartnership.org/wp-content/plugins/envato-market/inc/3
http://weddinggames.com.au/wp-content/themes/twentyten/1
http://weddinggames.com.au/wp-content/themes/twentyten/2
http://weddinggames.com.au/wp-content/themes/twentyten/3
http://www.cdiqra.com/components/com_content/helpers/1
http://www.cdiqra.com/components/com_content/helpers/2
http://www.cdiqra.com/components/com_content/helpers/3

pony c2
caharthenret.com/mlu/forum.php
naotuseor.ru/mlu/forum.php
pertacikin.ru/mlu/forum.php

evilpony c2
caharthenret.com/d2/forum.php
naotuseor.ru/d2/forum.php
pertacikin.ru/d2/forum.php

pandabanker domain
taldiparep.ru