Extracted

• • Target
    WIS_868087283709651.vbs
  • Size 726KB
  • SHA256 ec12eb1046c20c246ac6add559a64b52485d251e300c1d2dd4503de8a08c73d5
  • MD5 a21cda7e8d89d17b1bbc3c27035b132c
  • SHA1 357ab07a728aa6e1cadae86f47ac0ebefda296bf
  • SHA512 bf02164fc72977f509771b92c41706e3fb1c357c3245b7cc2aeb15ad2492320a5f834f8fc1bb8531e799fa078c8cf973373916d89478a8c8d0ba4af8abce5d72
  • MD5 SHA1 SHA512

  Score

  10^/10

  hancitor0212_4377843downloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2