Overview

overview

10

Static

static

_2866571907494.vbs

windows7_x64

10

_2866571907494.vbs

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    47827631f799254cd0e98c16cdf7af77cd303b4a574f761ed3f9a51bfda30a91

  • Size

    112KB

  • Sample

    220714-g7mefadae4

  • MD5

    581af4bdd8f17dda8341adc58053aa5d

  • SHA1

    f0b42d33ecd45c8b187afce0e52483e61a89a5b1

  • SHA256

    47827631f799254cd0e98c16cdf7af77cd303b4a574f761ed3f9a51bfda30a91

  • SHA512

    fe1046c9514d6c87538de033574ed203a3e52d96702b9f96c368fe56b3d359c8300eed63cb211db2a9da16d2dd66fd7a9967dc4f54b80b0984288bef9ff0be76

Score
10/10
hancitor1212_78342432downloader

Malware Config

Extracted

Family

hancitor

Botnet

1212_78342432

C2

http://vistiver.com/4/forum.php

http://thimemple.ru/4/forum.php

http://capandotd.ru/4/forum.php

Targets

    • Target

      _2866571907494.vbs

    • Size

      579KB

    • MD5

      d4bfbd62db6574ae4a90a0c2a9fd8427

    • SHA1

      cc7c9ca8679b2efe00d18048b8a0beadc2d53cc9

    • SHA256

      13aa175c12cd675b2a32d5bd252d35352811a036046e042ac5d1454957972bee

    • SHA512

      f8cfc582aad8e09685538e1059d1e4ce154043e12ae477b809391ebaac777bc38eda82b6e4e1c282808702ef80f128d17714d4c43510653fd0929529ed1ce009

    Score
    10/10
    hancitor1212_78342432downloader

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks