Overview

overview

10

Static

static

fa38731f10...8b.dll

windows7_x64

10

fa38731f10...8b.dll

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa38731f10eaba307caa207990a8f85494c7bc3dbea27d804342ca567964018b

  • Size

    153KB

  • Sample

    220625-ftg25ahfb7

  • MD5

    bc6f26692a740920714e5ecd07858154

  • SHA1

    53a64fd1e7b98666eb32983d48e3bb7efee189e7

  • SHA256

    fa38731f10eaba307caa207990a8f85494c7bc3dbea27d804342ca567964018b

  • SHA512

    60e798e00a3a30032967caa89254218d9a25d495596bbd5a6f4ef6165a8ebc81f1c76499e90591626c922e739df11d348a20db1ac79ec1e6bd75d194b59e84bf

Score
10/10
hancitor2201_8912354downloader

Malware Config

Extracted

Family

hancitor

Botnet

2201_8912354

C2

http://hourtschem.com/4/forum.php

http://thicatlies.ru/4/forum.php

http://cousidrebn.ru/4/forum.php

Targets

    • Target

      fa38731f10eaba307caa207990a8f85494c7bc3dbea27d804342ca567964018b

    • Size

      153KB

    • MD5

      bc6f26692a740920714e5ecd07858154

    • SHA1

      53a64fd1e7b98666eb32983d48e3bb7efee189e7

    • SHA256

      fa38731f10eaba307caa207990a8f85494c7bc3dbea27d804342ca567964018b

    • SHA512

      60e798e00a3a30032967caa89254218d9a25d495596bbd5a6f4ef6165a8ebc81f1c76499e90591626c922e739df11d348a20db1ac79ec1e6bd75d194b59e84bf

    Score
    10/10
    hancitor2201_8912354downloader

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks