Static

static

xl.png.exe

windows7_x64

10

xl.png.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    xl.png.exe
  • Size 675KB
  • Sample201022-74sedtblss
  • SHA256 773f5e4bc9f8c4aac82f8cab8f416efe83f5a39735358301c6ca0559d61c8bf0
  • MD5 SHA1 SHA512
Score
10/10
hancitordownloaderpersistence

Malware Config

Targets

    • Target
      xl.png.exe
    • Size 675KB
    • SHA256 773f5e4bc9f8c4aac82f8cab8f416efe83f5a39735358301c6ca0559d61c8bf0
    • MD5 SHA1 SHA512
    Score
    10/10
    hancitordownloaderpersistence

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks