Extracted

• • Target

    1a705ec559ce6bda3357577647c74495

  • Size

    1.3MB

  • MD5

    1a705ec559ce6bda3357577647c74495

  • SHA1

    46731a45b677ae55a188a4abaa337a5b15554957

  • SHA256

    5543b6d6f2d583538a8a8dadb8dfa52020a21f3229bade1241b1c89b512333e7

  • SHA512

    28c63064ad3dde45936d06b4d8cb2450557a8b2db4b34724da281af3e0cfad6386a71efc7602b7c4b5732c608f0ba8413776826554ac21b58e373449eeeeceb2

  • SSDEEP

    24576:/EIZ4wA74D4SQKxZcy8gthDWr/chYusVNVQK0U/X8zW:/+wJD4QZh/qDKMn70uX8q

  Score

  10^/10

  hancitor2306_vensipdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2