Hancitor Dec 21

RE: FW: december billing invoice
https://www.hybrid-analysis.com/sample/9906d7cbd7675f3334ef91e3a63792180e149b07a5899b1e2f9be5dcc6e8a086?environmentId=100

hancitor doc dl domains
utahrates.com
eciggystore.com
coffeedoesgood.com

hancitor c2
http://andrejoter.com/ls5/forum.php
http://dokemyhed.ru/ls5/forum.php
http://vehopehers.ru/ls5/forum.php

additional dl links
http://boobsandbabes.com/1
http://boobsandbabes.com/2
http://boobsandbabes.com/3
http://rutstudio.pl/1
http://rutstudio.pl/2
http://rutstudio.pl/3
http://wingchun-giessen.de/wp-content/uploads/2014/06/1
http://wingchun-giessen.de/wp-content/uploads/2014/06/2
http://wingchun-giessen.de/wp-content/uploads/2014/06/3
http://www.americanfreethought.com/wordpress/1
http://www.americanfreethought.com/wordpress/2
http://www.americanfreethought.com/wordpress/3
http://www.emilianobursese.com.ar/wp-content/plugins/bulletproof-security/1
http://www.emilianobursese.com.ar/wp-content/plugins/bulletproof-security/2
http://www.emilianobursese.com.ar/wp-content/plugins/bulletproof-security/3

pony c2
http://andrejoter.com/mlu/forum.php

evilpony c2
http://andrejoter.com/d2/forum.php

pandabanker links
https://kedfortmoleft.ru/4raqaynqyaraculodtyma.dat
https://kedfortmoleft.ru/61webinjects.dat
https://kedfortmoleft.ru/61webinject32.bin
https://kedfortmoleft.ru/61grabber.bin
https://kedfortmoleft.ru/61vnc32.bin
https://kedfortmoleft.ru/61backsocks.bin
https://kedfortmoleft.ru/61keylogger.bin