Extracted

• • Target

    Tracking#6902522331741.vbs

  • Size

    592KB

  • MD5

    393258a792991fdab17305e275e5fd31

  • SHA1

    231f60bdb55fc4597a2e4d53d4a43d66429207d2

  • SHA256

    8bde2931a468cc81994985ec803bda715ea70ef2337defc252f404efc8650a51

  • SHA512

    5d67586c90180f0637379bc7537b180a9083e5a125a9927a7320151a6a8e23a0dffefddccc5712679d1c25c3baddf6e5ac34fa41ff1230484d51c9a7424ae644

  Score

  10^/10

  hancitor1912_372823downloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2