Hancitor Jan 30

"Delivery complete" and "Delivery complete for parcel # <digits>"
https://www.hybrid-analysis.com/sample/ccb66b31d66f8a9864b5ca68793561ef2c5d251a3a3043966fae9c56d53153f9?environmentId=100
https://www.threatcrowd.org/ip.php?ip=92.53.77.114

hancitor doc domains
http://officebusinessproducts.com
http://wemakeadifferenceinyourbedroom.com
http://xerosolar.net
below domains that's to @social_amit
texasoriginalpits[.]biz
texasoriginalpits[.]net
texasoriginalpits[.]info
sixfortyland[.]com
thereceiversinc[.]net
casgal[.]com
firstcallcommunications[.]net

hancitor c2
http://tithaphersand.com/ls5/forum.php
http://lacsitgohed.ru/ls5/forum.php
http://midatotid.ru/ls5/forum.php

additional dl links
http://chernivtsi.dynamo.ua/wp-content/uploads/2017/06/1
http://chernivtsi.dynamo.ua/wp-content/uploads/2017/06/2
http://chernivtsi.dynamo.ua/wp-content/uploads/2017/06/3
http://earthquakesafety.us/1
http://earthquakesafety.us/2
http://earthquakesafety.us/3
http://hilomoped.com/wp-content/plugins/Login-wall-LWD/1
http://hilomoped.com/wp-content/plugins/Login-wall-LWD/2
http://hilomoped.com/wp-content/plugins/Login-wall-LWD/3
http://lewebeur.com/wp-content/plugins/hyper-cache/1
http://lewebeur.com/wp-content/plugins/hyper-cache/2
http://lewebeur.com/wp-content/plugins/hyper-cache/3
http://powerministry.com/wordpress/wp-content/themes/twentyten/1
http://powerministry.com/wordpress/wp-content/themes/twentyten/2
http://powerministry.com/wordpress/wp-content/themes/twentyten/3

pony c2
tithaphersand.com/mlu/forum.php

evilpony c2
tithaphersand.com/d2/about.php

pandabanker links
https://waslohidi.ru/1fusiyvubutoqgodypoih.dat
https://waslohidi.ru/1fusiyvubutoqgodypoih.exe
https://waslohidi.ru/62webinjects.dat
https://waslohidi.ru/62webinject32.bin
https://waslohidi.ru/62grabber.bin
https://waslohidi.ru/62vnc32.bin
https://waslohidi.ru/62backsocks.bin
https://waslohidi.ru/62keylogger.bin