Overview

overview

10

Static

static

yefff.bin.dll

windows7_x64

1

yefff.bin.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    yefff.bin.zip

  • Size

    276KB

  • Sample

    210817-gp8s7tp366

  • MD5

    60c0c642ac9a5a1f2c1dbffd3dadf70f

  • SHA1

    49f9fb6fe911ec8d938f77d650dc95d10018ea6d

  • SHA256

    5b9f622cee7bf7e6bdf11ec6b01ef056563b85aef24675f6e955acdd8b7a0517

  • SHA512

    8f131311fac89384430c3bd546bc25fc51f5fae86729e144926b8d5dde4ff67a4acd9fb12acebd813fbd3f83737f97e9a8e47533179c2ddbe36dc58e28a427f2

Score
10/10
hancitor1608_febddownloader

Malware Config

Extracted

Family

hancitor

Botnet

1608_febd

C2

http://patiennerrhe.com/8/forum.php

http://thougolograrly.ru/8/forum.php

http://chopprousite.ru/8/forum.php

Targets

    • Target

      yefff.bin

    • Size

      470KB

    • MD5

      dee18056e6b4c47bd6dd796d993de94a

    • SHA1

      a813777d59ddf9ea58803a70b8b1142df1d62f89

    • SHA256

      221743da70a514a7edcbebd741f7f325d7f10f6cc576be93ba17ea0d4299b5a2

    • SHA512

      d1f2c9404ee775a1dd9d0c1692d6d3e9c89d1a4fa01da8dc5c5d0ad74e8aff5f1a628b22a89b1dc61bb23c8edbc0144ae230e354c88c414bdac13c267ed44582

    Score
    10/10
    hancitor1608_febddownloader

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Blocklisted process makes network request

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks