Extracted

• • Target

    629a54dc90a2e5081588cba36bd4f489

  • Size

    1.3MB

  • MD5

    629a54dc90a2e5081588cba36bd4f489

  • SHA1

    b5f08efa70f3122777af75361b1cc409cb0b77d3

  • SHA256

    fa4df9e1b3ed7129e0705cc3c4ccab55523c0b4f94604160728128d1cc76922e

  • SHA512

    1378edd8d844d6775ee6aaabbb8e095aaf5c2d44fc3b78ed7537a415e7ce56035fd78d43b3098bac4d220d19c746bc5108823f31b4f6a4e677bc3009166b54c6

  • SSDEEP

    24576:lEIZ4wA74D4SQKxZcy8gthDW8/chYusVNVQK0U/x8A:l+wJD4QZh/qaKMn70ux8

  Score

  10^/10

  hancitor2306_vensipdownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2