Hancitor Dec 20

"New eFax document from <digits>"
https://www.virustotal.com/#/file/62bf62f4e9ea631b0dd295c1b71f3db684e97d247f405b778b23e5e8d3adbb16/detection

dl domains
http://freeportanimalshelter.org?
http://acamonitoringltd.ca?
http://touchstoneleads.net?
http://touchstonerecoveryservices.com/?

hancitor c2
http://gedidnundno.com/ls5/forum.php
http://fihenwasso.ru/ls5/forum.php
http://uldhisforru.ru/ls5/forum.php

additional payload links
http://addityainfrastructure.com/wp-content/plugins/google-maps/1
http://addityainfrastructure.com/wp-content/plugins/google-maps/2
http://addityainfrastructure.com/wp-content/plugins/google-maps/3
http://mail.circlemakers.us/wp-content/plugins/mashshare-shorturl/includes/1
http://mail.circlemakers.us/wp-content/plugins/mashshare-shorturl/includes/2
http://mail.circlemakers.us/wp-content/plugins/mashshare-shorturl/includes/3
http://maisquelider.com/1
http://maisquelider.com/2
http://maisquelider.com/3
http://www.canalizadores24horas.com/1
http://www.canalizadores24horas.com/2
http://www.canalizadores24horas.com/3
http://www.mommydskitchen.com/1
http://www.mommydskitchen.com/2
http://www.mommydskitchen.com/3

pony c2
arrepsinrab.com/mlu/forum.php

evilpony c2
arrepsinrab.com/d2/forum.php

pandabanker links
https://kedfortmoleft.ru/4raqaynqyaraculodtyma.dat
https://kedfortmoleft.ru/61webinjects.dat
https://kedfortmoleft.ru/4raqaynqyaraculodtyma.exe
https://kedfortmoleft.ru/61webinject32.bin
https://kedfortmoleft.ru/61webinjects.dat
https://kedfortmoleft.ru/61webinject64.bin
https://kedfortmoleft.ru/61vnc32.bin
https://kedfortmoleft.ru/61backsocks.bin
https://kedfortmoleft.ru/61keylogger.bin
https://kedfortmoleft.ru/61vnc64.bin