Hancitor Jan 31

"Your document Receipt <digits> for <username> is ready for signature!"
https://www.hybrid-analysis.com/sample/a363fb24edce3162326238d0152b99845d0dd0be53191183aad2ceba2d168a2a?environmentId=100
https://www.threatcrowd.org/ip.php?ip=92.53.77.216

hancitor doc dl domains
http://3sprouts.mx
http://3sprouts.com.br
http://gracetrombley.com
below domains thanks to @social_amit
larrygarcia[.]us
maxtrombley[.]com
gracetrombley[.]com

hancitor c2
http://kinforhepron.com/ls5/forum.php
http://tontherssuptot.ru/ls5/forum.php
http://leftdoherthis.ru/ls5/forum.php

additional dl
http://explosionsinthesky.fr/1
http://explosionsinthesky.fr/2
http://explosionsinthesky.fr/3
http://mail.lovewithdetails.com/wp-content/plugins/xcalendar/1
http://mail.lovewithdetails.com/wp-content/plugins/xcalendar/2
http://mail.lovewithdetails.com/wp-content/plugins/xcalendar/3
http://seraglio.com.br/1
http://seraglio.com.br/2
http://seraglio.com.br/3
http://www.salbom.ru/1
http://www.salbom.ru/2
http://www.salbom.ru/3
http://xavierpaim.com.br/1
http://xavierpaim.com.br/2
http://xavierpaim.com.br/3

pony c2
kinforhepron.com/mlu/about.php

evilpony c2
kinforhepron.com/d2/about.php

pandabanker domains
waslohidi.ru
bulighhesin.ru
geperetrew.com
repsetyres.com