Extracted

• • Target

    WHO_4776889046841393.vbs

  • Size

    909KB

  • MD5

    67d3819f1f32d9a140b3201ae5d310d8

  • SHA1

    545ddac4103a70825c6fef264c08bd34787809bb

  • SHA256

    c03838ce46b55ee5253eb78a82c4f91f9273c833387bc430309bb84cd3a0bc33

  • SHA512

    85d1f5d646c05b47a5425520a9e6628744d8ec17bec6aa8b051449f9f304b07fefe2f4fe9d14bd00aeb04cc6141ea1452c888f9cb94e4ab7b1152c46da64bf8b

  • SSDEEP

    3072:DLG8LSTq0uHLlixTm/p9SKN0YpHp6R+UEpIDr5NAuCLC9kz3xHyLS8Kl0sGfjhgH:jRo5Qc970K/Dqld/2libfKTnYrKJmvJ

  Score

  10^/10

  hancitor2111_7654345downloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2