General

  • Target

    if.bin

  • Size

    1.5MB

  • Sample

    220126-vvaf1afffk

  • MD5

    16b53cb2f51441477fea6ab45648adc5

  • SHA1

    d7376a1c8eb7e690ead484b9d5177894315f238d

  • SHA256

    74dda39e6eca2da641aa05c4490d1024ba8505853a465b0d8a6293065ca8b071

  • SHA512

    af8f344131ba8706d0b77d6d93d00d3809277fc1691566d23101ce8269813d3945d1a65dd50795e74b4382e6b1f9be18d41d98515e2ead282a7a27c66911bb17

Malware Config

Extracted

Family

hancitor

Botnet

2401_hjksd

C2

http://fountandevin.com/9/forum.php

http://nummasdocarm.ru/9/forum.php

http://beetwedwornew.ru/9/forum.php

Targets

    • Target

      if.bin

    • Size

      1.5MB

    • MD5

      16b53cb2f51441477fea6ab45648adc5

    • SHA1

      d7376a1c8eb7e690ead484b9d5177894315f238d

    • SHA256

      74dda39e6eca2da641aa05c4490d1024ba8505853a465b0d8a6293065ca8b071

    • SHA512

      af8f344131ba8706d0b77d6d93d00d3809277fc1691566d23101ce8269813d3945d1a65dd50795e74b4382e6b1f9be18d41d98515e2ead282a7a27c66911bb17

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

    • Blocklisted process makes network request

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix

Tasks