Extracted

• • Target

    1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed

  • Size

    446KB

  • MD5

    5d9d7915ae733016e1bc3fed44ac951a

  • SHA1

    2e47a92c311665629e2a7de03a0094548a56511a

  • SHA256

    1f3f57156a64811fe649126af713fe0550d2b7089a1a16a239211289286418ed

  • SHA512

    015aea19d679782f4e957fff36352fb5c4570ca744c3f560e224445c48062dbb8f358ab058b989d68963407ed47220cd1552a7084020a04799f3e8adcd18f692

  Score

  10^/10

  hancitor1310_wingdownloaderpersistence

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2