Hancitor IOC

Malspam URLs:
http://slimscrubber[.]com/?74C2=TDBGYOTU3QRJBOYYCQ3TY
http://mayisaysomething[.]com/?1345YK=CBUVQAQR3QRJBOYYCQ3TY
http://scrubbermop[.]com/?7N=TSVGTU3QRJBOYYCQ3TY
http://downetwpnj[.]com/?6e5=GJQDGZYJUD1AZTFSIGQBmDGJQJ3LUw
http://cougarcatering[.]com/?60KI=IGCQlSQRLTEGHGUBKQHQBOUDQXCQi
http://flexscrubber[.]com/?42ik7=FAQzNYGHTDAKYN3LUw
http://aussieabs[.]com/?3XTET5=QMdOG0SIZUNZmBARQYCQi

Dropping URLs:
http://chonreneedanceacademy.com/3
http://chonreneedanceacademy.com/2
http://chonreneedanceacademy.com/1
http://greatadventuregear[.]com/m.exe

C2:
http://kedwronnading.ru/4/forum.php
http://toldbutheda.ru/4/forum.php
http://cetotrumo.com/4/forum.php

Follow up Ursnif/Gozi:
foo.avaregio.at
api.hamanana.at
ax.ikobut.at
beetfeetlife.bit
cdn.avaregio.at
supp.zapkopw.at
api.ikobut.at
api.siperskon.at
supp.zapkopw.at
a1.mafinlop.at