Hancitor Oct 4

https://www.virustotal.com/file/025fda9d7cafd219263eed912ee1559331aa93bfdbc375e5c2a8d5843a9376ba/analysis/1507130420/
https://packettotal.com/cgi-bin/view-analysis.cgi?id=7949b611fe601732c9d4bfbe67c5b1e6

see @cheapbyte paste here for additional details:  https://pastebin.com/Pw1rFc8N

doc dl links:
http://renegadeportal.com
http://prime2cure.com
http://gkiconline.com

hancitor c2s:
http://etledkeor.com/ls5/forum.php
http://verorwabu.ru/ls5/forum.php
http://rikinpartoft.ru/ls5/forum.php

malware dl links:
http://designingcustomerexperience.com/wp-content/plugins/cookie-law-info/1
http://designingcustomerexperience.com/wp-content/plugins/cookie-law-info/2
http://designingcustomerexperience.com/wp-content/plugins/cookie-law-info/3

pony c2
http://etledkeor.com/mlu/forum.php
http://verorwabu.ru/mlu/forum.php
http://rikinpartoft.ru/mlu/forum.php

evil-pony c2
http://etledkeor.com/d2/about.php
http://verorwabu.ru/d2/about.php
http://rikinpartoft.ru/d2/about.php

zloader c2
http://sirantedut.com/bdl/gate.php
http://dintretonid.com/bdl/gate.php

zloader rc4 key:
TyweJ848wWb7o0JfQMfY6pyd6YEp0pI2