hancitor | 137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46

General

Target
137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46
Size 108KB
Sample220603-gr96kaefgr
SHA256 137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46
MD5 0a8fdbfbffe62f5e31cb908230eed094
SHA1 a1cba447dc1e40cf7745ac7fc3c52d0cebfb3165
SHA512 d7a41966119e48a281efa191b83c71561f6f4d4437d0e46088265b219a062d0ef1ded09c4bb5f63ab69b4ba1c7978c33b1e0040f1f38bd9835c6df019adfb165
SSDEEP 1536:u5lYFkueCTMjAnuPOp0wcJy8czZItFBvN:u5lY9TMZzRy8i2t/1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

20poi02 hancitor

Malware Config

Extracted

Family

hancitor

Botnet

20poi02

C2

http://cetotrumo.com/4/forum.php
http://kedwronnading.ru/4/forum.php
http://toldbutheda.ru/4/forum.php

Signatures

Hancitor family
hancitor

File Explorer

137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46

.exe 108KB

137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46

IMPHASH 415c715b12d8448be852c88e3398f7d6
SHA256 137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46
MD5 0a8fdbfbffe62f5e31cb908230eed094
SHA1 a1cba447dc1e40cf7745ac7fc3c52d0cebfb3165
SHA512 d7a41966119e48a281efa191b83c71561f6f4d4437d0e46088265b219a062d0ef1ded09c4bb5f63ab69b4ba1c7978c33b1e0040f1f38bd9835c6df019adfb165
SSDEEP 1536:u5lYFkueCTMjAnuPOp0wcJy8czZItFBvN:u5lY9TMZzRy8i2t/1
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

37319

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleFileNameA GetWindowsDirectoryA VirtualProtect GetComputerNameExW GetLongPathNameA CreateProcessW GetLocalTime GetCurrentDirectoryW

gdi32

CreatePen GetStockObject GetDeviceCaps CreateDIBSection TextOutW LineTo MoveToEx Polyline GetTextExtentPointW GetTextExtentPoint32W GetTextMetricsW SelectObject DeleteObject CreateFontIndirectW PatBlt SetBkColor SetTextColor PtVisible CreateSolidBrush

user32

GetFocus GetForegroundWindow

ole32

CoCreateInstance CoTaskMemFree CoInitializeEx

shell32

DragAcceptFiles

comctl32

InitCommonControlsEx ImageList_LoadImageW ImageList_Add ImageList_Create CreateStatusWindowW PropertySheetW

mpr

WNetDisconnectDialog

msvcrt

malloc realloc memcpy memset puts _vsnprintf _beginthreadex memmove sprintf _XcptFilter __p__commode _amsg_exit __getmainargs __set_app_type _exit _cexit __p__fmode __setusermatherr _initterm free ?terminate@@YAXXZ _controlfp getenv atoi exit _snprintf fputs printf fprintf fgets fflush feof strstr strncpy _strlwr strchr _memicmp isalnum strncat __iob_func

Sharing