Hancitor Nov 14

https://www.hybrid-analysis.com/sample/8cc391596b990ed945280be44b1372b399b58287d31ab751aac0bf27d9c139b6?environmentId=100
https://www.threatcrowd.org/ip.php?ip=108.61.199.175

doc dl links
http://lunaconference.net?O8GA7i3O3nA71wu2=
http://leemitchell.com?e0RUr016OO8el=
http://leemitchell.net?N2K58y302Pvga8ICu6=
below thanks to @pollo290987
lunawomen,net?7DYa80=
below thanks to @DynamicAnalysis
lunawomen[.]com/?AQOxR1gQaXY=

hancitor c2
http://hegheconekin.com/ls5/forum.php
http://eventontifort.ru/ls5/forum.php
http://thenenrigheveng.ru/ls5/forum.php

additional dl links
ragnes.cz/1
ragnes.cz/2
ragnes.cz/3
below thanks to @cheapbyte
http://camaradelamadera.com.ar/2
http://namvam.by/2
http://us-shippinginternational.com/wp-content/plugins/logisticpro/2
http://www.duraesenterprise.com/wp-content/uploads/2013/05/2

evil-pony c2
hegheconekin.com/d2/about.php

pony c2
hegheconekin.com/mlu/forum.php
eventontifort.ru/mlu/forum.php

pandabanker dl
https://rowrorofrat.com/3rafesimuuvutubazromu.dat
https://rowrorofrat.com/webinjects.dat
https://rowrorofrat.com/3rafesimuuvutubazromu.exe
https://rowrorofrat.com/webinject32.bin
https://rowrorofrat.com/grabber.bin
https://rowrorofrat.com/vnc32.bin
https://rowrorofrat.com/backsocks.bin
https://rowrorofrat.com/keylogger.bin