Hancitor Jan 23

"New incoming eFax document from 1-888-<digits>"
https://www.hybrid-analysis.com/sample/6dcbf652b96a7aea16d0c2e72186173d9345f722c9592e62820bcfe477b2b297?environmentId=100

dl domains
http://tabrs.com
http://boxerproperties.org
http://boxerproperties.biz
http://classiccaladiums.org

thanks to @social_amit for additional domain
http://boxerproperties.us

hancitor exe download
http://ofthi.com/1

hancitor c2
http://littarhapone.com/ls5/forum.php

payload links
http://goodgroupllc.com/modules/media_entity/1
http://goodgroupllc.com/modules/media_entity/2
http://goodgroupllc.com/modules/media_entity/3
http://helloyou.se/wp-content/plugins/pixcodes/1
http://helloyou.se/wp-content/plugins/pixcodes/2
http://helloyou.se/wp-content/plugins/pixcodes/3
http://impressocoffee.com.au/wp-content/plugins/dynamic-featured-image/1
http://impressocoffee.com.au/wp-content/plugins/dynamic-featured-image/2
http://impressocoffee.com.au/wp-content/plugins/dynamic-featured-image/3
http://outandaboutpublications.com.au/1
http://outandaboutpublications.com.au/2
http://outandaboutpublications.com.au/3
http://www.boltboxmarketing.com/wp-content/plugins/js_composer/config/1
http://www.boltboxmarketing.com/wp-content/plugins/js_composer/config/2
http://www.boltboxmarketing.com/wp-content/plugins/js_composer/config/3

pony c2
http://littarhapone.com/mlu/forum.php

evilpony c2
http://littarhapone.com/d2/about.php

per @malware_traffic pandabanker c2/dl domain
suptalefthed.ru

and pandabanker links
https://suptalefthed.ru/1paylseaffiuwosylygcy.dat
https://suptalefthed.ru/61webinjects.dat
https://suptalefthed.ru/1paylseaffiuwosylygcy.exe
https://suptalefthed.ru/61webinject32.bin
https://suptalefthed.ru/61grabber.bin
https://suptalefthed.ru/61vnc32.bin
https://suptalefthed.ru/61backsocks.bin
https://suptalefthed.ru/61keylogger.bin