Extracted

• • Target

    81b23d07b580c16b60d35fcd4dc399313042394ad795f2241754ede59745b218

  • Size

    521KB

  • MD5

    6daad96aa8bb3a1dd6de3e17e37e4d04

  • SHA1

    5974bbf965584a1a36c346710210bc4340f2e914

  • SHA256

    81b23d07b580c16b60d35fcd4dc399313042394ad795f2241754ede59745b218

  • SHA512

    5f4a042cb09bd0de477b69f19d832b58470de7328c79489ee953712c071acbac72fd0fc79f014f22f95d3173f2baea73e2086ab87c33898d6d709a3539b81324

  Score

  10^/10

  hancitor1410_7_qwdownloaderpersistence

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2