Overview

overview

10

Static

static

han.exe

windows7_x64

10

han.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    han.exe
  • Size 500KB
  • Sample201014-bzt48wbbj6
  • SHA256 f4427ef6b665bf0563f23fde314caf9f905ab1e049fc5c0b33384d526ec3cbf1
  • MD5 SHA1 SHA512
Score
10/10
hancitordownloaderpersistence

Malware Config

Targets

    • Target
      han.exe
    • Size 500KB
    • SHA256 f4427ef6b665bf0563f23fde314caf9f905ab1e049fc5c0b33384d526ec3cbf1
    • MD5 SHA1 SHA512
    Score
    10/10
    hancitordownloaderpersistence

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks