Overview

overview

10

Static

static

ca28945917...e8.dll

windows7-x64

10

ca28945917...e8.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca28945917b92e552b7c7bacb6421bce34285f4bab5290ce14637d84ca5621e8

  • Size

    208KB

  • Sample

    221130-t15nnafg98

  • MD5

    ba5d13d64133ff19ab43207d23f467c3

  • SHA1

    449e77998a825d543995e138e10aa665381d97d3

  • SHA256

    ca28945917b92e552b7c7bacb6421bce34285f4bab5290ce14637d84ca5621e8

  • SHA512

    fb33e5ae73a642346d889271fc0fe3f90b5292a6792a4afd00dee7d5a11401bc0af20ce55b3552cac72bb4304929997de627aabdbdcc23b16826da31a052db9f

  • SSDEEP

    6144:rWiT6BtfdcAXdK7Mp4Ik29CesuqVfDcT56BfL:rv6BxdcD7MpBJC/uqVuQp

Score
10/10
hancitor1702_pro23downloader

Malware Config

Extracted

Family

hancitor

Botnet

1702_pro23

C2

http://hatuderefer.com/8/forum.php

http://thavelede.ru/8/forum.php

http://zinsubtal.ru/8/forum.php

Targets

    • Target

      ca28945917b92e552b7c7bacb6421bce34285f4bab5290ce14637d84ca5621e8

    • Size

      208KB

    • MD5

      ba5d13d64133ff19ab43207d23f467c3

    • SHA1

      449e77998a825d543995e138e10aa665381d97d3

    • SHA256

      ca28945917b92e552b7c7bacb6421bce34285f4bab5290ce14637d84ca5621e8

    • SHA512

      fb33e5ae73a642346d889271fc0fe3f90b5292a6792a4afd00dee7d5a11401bc0af20ce55b3552cac72bb4304929997de627aabdbdcc23b16826da31a052db9f

    • SSDEEP

      6144:rWiT6BtfdcAXdK7Mp4Ik29CesuqVfDcT56BfL:rv6BxdcD7MpBJC/uqVuQp

    Score
    10/10
    hancitor1702_pro23downloader

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Blocklisted process makes network request

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks