Hancitor Jan 24

"Shipment status changed for parcel #<digits>!"
https://app.any.run/tasks/37c649ce-8cea-485f-bbeb-faf62de8ec85
https://www.hybrid-analysis.com/sample/92c07ff5e7e08360ed324a574d6b3db9a2d6934bff6eb4cd1deee80e72f7ed33?environmentId=100 < panda banker exe

hancitor doc dl
http://777rent.com
http://jbaportfolio.com
http://el-paso-office-space.com

thanks to @domingueza for the below domains:
http://buildyourofficespace.com
http://denver-office-space.net
http://boxerproperty.info
http://cheap-office-space.net
http://boxerworkstyle.net
http://houston-executive-suites.net

additional payload dl
http://g4p.2web4you.com/wp-admin/1
http://g4p.2web4you.com/wp-admin/2
http://g4p.2web4you.com/wp-admin/3
http://idewan.com/wp-content/plugins/dhvc-form/templates/1
http://idewan.com/wp-content/plugins/dhvc-form/templates/2
http://idewan.com/wp-content/plugins/dhvc-form/templates/3
http://www.aanchalpk.com/include/1
http://www.aanchalpk.com/include/2
http://www.aanchalpk.com/include/3
http://www.dressedfortime.com/wp-content/plugins/title-and-nofollow-for-links/inc/1
http://www.dressedfortime.com/wp-content/plugins/title-and-nofollow-for-links/inc/2
http://www.dressedfortime.com/wp-content/plugins/title-and-nofollow-for-links/inc/3
http://www.madc.org/wp-content/plugins/html-on-pages/1
http://www.madc.org/wp-content/plugins/html-on-pages/2
http://www.madc.org/wp-content/plugins/html-on-pages/3

hancitor c2
naveundpa.com/ls5/forum.php

pony c2
naveundpa.com/mlu/forum.php

evilpony c2
naveundpa.com/d2/about.php

pandabanker links
https://suptalefthed.ru/1paylseaffiuwosylygcy.dat
https://suptalefthed.ru/1paylseaffiuwosylygcy.exe
https://suptalefthed.ru/61webinjects.dat
https://suptalefthed.ru/61webinject32.bin
https://suptalefthed.ru/61grabber.bin
https://suptalefthed.ru/61vnc32.bin
https://suptalefthed.ru/61backsocks.bin
https://suptalefthed.ru/61keylogger.bin