Extracted

• • Target

    f60296be31ddf2c2fdff731298075391

  • Size

    1.3MB

  • MD5

    f60296be31ddf2c2fdff731298075391

  • SHA1

    062ede458b20f28e6f4f41e3ae8b2bb491daedc1

  • SHA256

    9199fb34a5a9d5ddeac8989c031c6f2435d7cdd7c3d3311228c9bd3f1edaf722

  • SHA512

    f9505518ebf69340b0fcb15fadb7448c24a6739ae9614280d41b2645b846ca9516586d4957a94168c3a5c55cd4453fa7e6fb632d27c56a63b52795fc9d853d1e

  • SSDEEP

    24576:ZEIZ4wA74D4SQKxZcy8gthDWa/chYusVNVQK0U/q8h:Z+wJD4QZh/q4KMn70uq8

  Score

  10^/10

  hancitor2306_vensipdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2