Extracted

• • Target

    ff1a958a59a14af230ea15e62c472cd9

  • Size

    576KB

  • MD5

    ff1a958a59a14af230ea15e62c472cd9

  • SHA1

    ffd3513447cd33af6df142bbc249bc2b2be2b38a

  • SHA256

    17c5c2c8d429dcea665e3d283b874228e01139453709e47e2c283a77fc49d537

  • SHA512

    f8486e72f2dd78881891d642b09ee25d4e3a7af57ed936e61a2ed88390b29edfb2a4105c092272645f52801725696d6684ddb1617730dd42baf1fe052078f4c6

  Score

  10^/10

  hancitor0211_ponxwedownloadersuricata

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE Tordal/Hancitor/Chanitor Checkin

    suricata: ET MALWARE Tordal/Hancitor/Chanitor Checkin

    suricata

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2