General

  • Target

    msals.pumpl.dll

  • Size

    194KB

  • Sample

    210329-b84zvz1twa

  • MD5

    b76a1d2b926e053e47caf8d132c286d0

  • SHA1

    ff77e7ffe46bebd812e231e80b9226d7accc5370

  • SHA256

    b1df5e4a7d6191c7646fb76ba1e0ff95678472182d31ad4b6d916e731622135a

  • SHA512

    0f5316e89d84b626dd6c29a4536961a81438b57702e456a47a85461781a5f12801c707b85ab87b31812393e7acaaa72fea954854d42796acc06ba9cd20ccaf63

Malware Config

Extracted

Family

hancitor

Botnet

2903_21387h

C2

http://probassita.com/8/forum.php

http://frobenalini.ru/8/forum.php

http://proubleblecilm.ru/8/forum.php

Targets

    • Target

      msals.pumpl.dll

    • Size

      194KB

    • MD5

      b76a1d2b926e053e47caf8d132c286d0

    • SHA1

      ff77e7ffe46bebd812e231e80b9226d7accc5370

    • SHA256

      b1df5e4a7d6191c7646fb76ba1e0ff95678472182d31ad4b6d916e731622135a

    • SHA512

      0f5316e89d84b626dd6c29a4536961a81438b57702e456a47a85461781a5f12801c707b85ab87b31812393e7acaaa72fea954854d42796acc06ba9cd20ccaf63

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

MITRE ATT&CK Matrix

Tasks