Overview

overview

10

Static

static

10

a187866153...0d.dll

windows7_x64

10

a187866153...0d.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a1878661536e39d3c25ca99aab137165511d63e4b7423730f90dcdaa4aaaf60d

  • Size

    25KB

  • Sample

    211101-r6p42saba5

  • MD5

    45ba30794671d942a61a4063106c9c92

  • SHA1

    2c85fe7325fbd9442f7f74ae30d6449af54ea891

  • SHA256

    a1878661536e39d3c25ca99aab137165511d63e4b7423730f90dcdaa4aaaf60d

  • SHA512

    9a2610f1965842871823ebe16042c03eb62fa8f11965f2b06fe9b30977ce60e6829f5371ab878f13e6c646d434176b439588fa4a1e839be3861fb05bbdffed07

Score
10/10
hancitor1512_378poidownloader

Malware Config

Extracted

Family

hancitor

Botnet

1512_378poi

C2

http://purclughtz.com/8/forum.php

http://novearecoms.ru/8/forum.php

http://firodingdet.ru/8/forum.php

Targets

    • Target

      a1878661536e39d3c25ca99aab137165511d63e4b7423730f90dcdaa4aaaf60d

    • Size

      25KB

    • MD5

      45ba30794671d942a61a4063106c9c92

    • SHA1

      2c85fe7325fbd9442f7f74ae30d6449af54ea891

    • SHA256

      a1878661536e39d3c25ca99aab137165511d63e4b7423730f90dcdaa4aaaf60d

    • SHA512

      9a2610f1965842871823ebe16042c03eb62fa8f11965f2b06fe9b30977ce60e6829f5371ab878f13e6c646d434176b439588fa4a1e839be3861fb05bbdffed07

    Score
    10/10
    hancitordownloader

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks