Overview

overview

10

Static

static

7901439736...59.dll

windows7-x64

10

7901439736...59.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    790143973633f4d4495230b2d855f5a146123a690e65efc7f3a791295346bc59

  • Size

    164KB

  • Sample

    221130-whnzasfa4w

  • MD5

    deb1e328feb39c49c0a39cd37d4f7792

  • SHA1

    8e05cfa7ad3e238fd5350129793af88db3bcb775

  • SHA256

    790143973633f4d4495230b2d855f5a146123a690e65efc7f3a791295346bc59

  • SHA512

    684ec6fe1629bcdb49b46d42d284f3b03973b9eba6a87d7a5b3ed4a90ed837e7c6ad42ee08095e8f07c66f32c9f09fe46b18b243a91f0f8eac808a680bc0d756

  • SSDEEP

    3072:2SjhqkvgAe7swGXFmXvU7Y98MSGRw1md5ohPQ1DHzQkQqQFwBXHNG+:FHgjaE9fSGR968U

Score
10/10
hancitor0902_ntcwe4downloader

Malware Config

Extracted

Family

hancitor

Botnet

0902_ntcwe4

C2

http://sibetaver.com/8/forum.php

http://ceirsitsin.ru/8/forum.php

http://formawas.ru/8/forum.php

Targets

    • Target

      790143973633f4d4495230b2d855f5a146123a690e65efc7f3a791295346bc59

    • Size

      164KB

    • MD5

      deb1e328feb39c49c0a39cd37d4f7792

    • SHA1

      8e05cfa7ad3e238fd5350129793af88db3bcb775

    • SHA256

      790143973633f4d4495230b2d855f5a146123a690e65efc7f3a791295346bc59

    • SHA512

      684ec6fe1629bcdb49b46d42d284f3b03973b9eba6a87d7a5b3ed4a90ed837e7c6ad42ee08095e8f07c66f32c9f09fe46b18b243a91f0f8eac808a680bc0d756

    • SSDEEP

      3072:2SjhqkvgAe7swGXFmXvU7Y98MSGRw1md5ohPQ1DHzQkQqQFwBXHNG+:FHgjaE9fSGR968U

    Score
    10/10
    hancitor0902_ntcwe4downloader

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Blocklisted process makes network request

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks