Static

static

W0rd.dll

windows7_x64

10

W0rd.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    W0rd.dll

  • Size

    459KB

  • Sample

    210113-85g6qzbks2

  • MD5

    075ef6a3a24b3c4cfef8e89b8e0836f9

  • SHA1

    f689fa2dc167400badf68c8348814fc502d3bd30

  • SHA256

    ce2449b7f600b0317614419159e9364e1a76613ac0cb112c88be171638573049

  • SHA512

    03f62f12b1bd4740e1d35da2e2087a47eb62477d65bd9a5794b504e5a7badbce7b3de6246e9fd38e5e1f6c9a7484841f5b0914bee39f126d42c9ea71f554319f

Score
10/10
hancitordownloaderspyware

Malware Config

Targets

    • Target

      W0rd.dll

    • Size

      459KB

    • MD5

      075ef6a3a24b3c4cfef8e89b8e0836f9

    • SHA1

      f689fa2dc167400badf68c8348814fc502d3bd30

    • SHA256

      ce2449b7f600b0317614419159e9364e1a76613ac0cb112c88be171638573049

    • SHA512

      03f62f12b1bd4740e1d35da2e2087a47eb62477d65bd9a5794b504e5a7badbce7b3de6246e9fd38e5e1f6c9a7484841f5b0914bee39f126d42c9ea71f554319f

    Score
    10/10
    hancitordownloaderspyware

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Blocklisted process makes network request

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks