Overview

overview

10

Static

static

hhh.mp3.dll

windows7_x64

10

hhh.mp3.dll

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    hhh.mp3.dll
  • Size 726KB
  • Sample210914-sd558sahcq
  • SHA256 5e7c3ce3fefe950f3a9a77cda46b63e68267783662b6434abf937200bba06fdb
  • MD5 SHA1 SHA512
Score
10/10
hancitor1409_rebcxdownloader

Malware Config

Extracted

Family

  • hancitor

Botnet

  • 1409_rebcx

C2

  • http://woureves.ru/8/forum.php

  • http://scorlduce.ru/8/forum.php

  • http://belloweek.ru/8/forum.php

Targets

    • Target
      hhh.mp3.dll
    • Size 726KB
    • SHA256 5e7c3ce3fefe950f3a9a77cda46b63e68267783662b6434abf937200bba06fdb
    • MD5 SHA1 SHA512
    Score
    10/10
    hancitor1409_rebcxdownloader

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Blocklisted process makes network request

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks