Overview

overview

10

Static

static

ee6d6adc3d...d9.dll

windows7_x64

10

ee6d6adc3d...d9.dll

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ee6d6adc3dadd202c36f7f7226395fcd511bc0c39487f8f26cd65159b1aee1d9

  • Size

    163KB

  • Sample

    220701-f6x9waeaal

  • MD5

    041e92f2142071cd6c2926bf0a869f37

  • SHA1

    66dfc6f472435be2542e2092538e1d517f11c5b0

  • SHA256

    ee6d6adc3dadd202c36f7f7226395fcd511bc0c39487f8f26cd65159b1aee1d9

  • SHA512

    a548d183074c2e6e3456657996d61ffdfbfdae793b8fbaac822ce1ecc14fb937fea083f33216ef0abd7b4c1cf20193f7b4a0d6a96d33374f06b2beaa6db02e31

Score
10/10
hancitor2801_674543434downloader

Malware Config

Extracted

Family

hancitor

Botnet

2801_674543434

C2

http://buctintson.com/4/forum.php

http://andentrog.ru/4/forum.php

http://ensisedg.ru/4/forum.php

Targets

    • Target

      ee6d6adc3dadd202c36f7f7226395fcd511bc0c39487f8f26cd65159b1aee1d9

    • Size

      163KB

    • MD5

      041e92f2142071cd6c2926bf0a869f37

    • SHA1

      66dfc6f472435be2542e2092538e1d517f11c5b0

    • SHA256

      ee6d6adc3dadd202c36f7f7226395fcd511bc0c39487f8f26cd65159b1aee1d9

    • SHA512

      a548d183074c2e6e3456657996d61ffdfbfdae793b8fbaac822ce1ecc14fb937fea083f33216ef0abd7b4c1cf20193f7b4a0d6a96d33374f06b2beaa6db02e31

    Score
    10/10
    hancitor2801_674543434downloader

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks