Overview

overview

10

Static

static

f71d14084f...ac.dll

windows7-x64

10

f71d14084f...ac.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f71d14084f5b22dc41223db248a96c27ca54f9ae0582ac9d6dc0a7d2b13728ac

  • Size

    174KB

  • Sample

    220731-k5etcshdg3

  • MD5

    227ddb5f8b75f0c253e466e0752f1d97

  • SHA1

    e5361dbf2218d41e577bfff6355125bdda0c08db

  • SHA256

    f71d14084f5b22dc41223db248a96c27ca54f9ae0582ac9d6dc0a7d2b13728ac

  • SHA512

    108a06fcc33ae5b2a024a84f861f873efbd0cadffa8eddd575e1f3392f2ae2914aef253d3a7b2bfa445c61b83f9ceaf6224880d39c43d3bdfd0b3c5fa9b01d02

Score
10/10
hancitor2111_7654345downloader

Malware Config

Extracted

Family

hancitor

Botnet

2111_7654345

C2

http://hismosedkaj.com/4/forum.php

http://consenhary.ru/4/forum.php

http://prolighmev.ru/4/forum.php

Targets

    • Target

      f71d14084f5b22dc41223db248a96c27ca54f9ae0582ac9d6dc0a7d2b13728ac

    • Size

      174KB

    • MD5

      227ddb5f8b75f0c253e466e0752f1d97

    • SHA1

      e5361dbf2218d41e577bfff6355125bdda0c08db

    • SHA256

      f71d14084f5b22dc41223db248a96c27ca54f9ae0582ac9d6dc0a7d2b13728ac

    • SHA512

      108a06fcc33ae5b2a024a84f861f873efbd0cadffa8eddd575e1f3392f2ae2914aef253d3a7b2bfa445c61b83f9ceaf6224880d39c43d3bdfd0b3c5fa9b01d02

    Score
    10/10
    hancitor2111_7654345downloader

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks