Extracted

• • Target

    8ff43b6ddf6243bd5ee073f9987920fa223809f589d151d7e438fd8cc08ce292.dll

  • Size

    525KB

  • MD5

    4198ac1dc34de77ab8ceac3c9a25480e

  • SHA1

    f8fb1264a292aecb6c2bf5c5d4f3e199e3a822ad

  • SHA256

    8ff43b6ddf6243bd5ee073f9987920fa223809f589d151d7e438fd8cc08ce292

  • SHA512

    37dd3c50283daa7be1fb831820d273b7663dddce4d98c87c8d08864fac2dc00daf243ca6e50e028d4f04262160f5dea9a98000cffb67d70c07875d3fc2e4c47c

  • SSDEEP

    12288:4sskVmMfu4CN1NYPkDbkuN90VOR47wn2vTPHXL2n2UT1p0:v0NYPkEuz0VOR47w2rvXyD0

  Score

  10^/10

  hancitor1910_nswdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Blocklisted process makes network request

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2