Hancitor Dec 19

"Your tracking information for package <digits> is available!"
https://www.hybrid-analysis.com/sample/36060d315c142c7711d26552d30b327c51cdf12fc8d7047ea24cda8b47b2cf40?environmentId=100

doc dl links
http://michaellehrhaupt.com?
http://theltcguru.com?
http://cryptowealthcreators.com?

hancitor c2
http://arrepsinrab.com/ls5/forum.php
http://lingtoftlaver.ru/ls5/forum.php
http://uggaverlo.ru/ls5/forum.php

additional dl links
http://eumeca.com/wp-content/plugins/force-regenerate-thumbnails/1
http://eumeca.com/wp-content/plugins/force-regenerate-thumbnails/2
http://eumeca.com/wp-content/plugins/force-regenerate-thumbnails/3
http://pizzahip.com/Uploader/1
http://pizzahip.com/Uploader/2
http://pizzahip.com/Uploader/3
http://redmass.com/wp-content/plugins/footer-text/includes/1
http://redmass.com/wp-content/plugins/footer-text/includes/2
http://redmass.com/wp-content/plugins/footer-text/includes/3
http://www.accomacevents.com/wp-content/plugins/broken-link-checker/1
http://www.accomacevents.com/wp-content/plugins/broken-link-checker/2
http://www.accomacevents.com/wp-content/plugins/broken-link-checker/3
http://www.urbaniza.us/wp-includes/certificates/1
http://www.urbaniza.us/wp-includes/certificates/2
http://www.urbaniza.us/wp-includes/certificates/3

pony c2
arrepsinrab.com/mlu/forum.php

evilpony c2
arrepsinrab.com/d2/forum.php

pandabanker c2
https://kedfortmoleft.ru/4raqaynqyaraculodtyma.dat
https://kedfortmoleft.ru/61webinjects.dat
https://kedfortmoleft.ru/4raqaynqyaraculodtyma.exe
https://kedfortmoleft.ru/61webinject32.bin
https://kedfortmoleft.ru/61grabber.bin
https://kedfortmoleft.ru/61vnc32.bin
https://kedfortmoleft.ru/61vnc64.bin
https://kedfortmoleft.ru/61backsocks.bin
https://kedfortmoleft.ru/61keylogger.bin