Overview

overview

10

Static

static

3

593f4c3d29...18.dll

windows7-x64

10

593f4c3d29...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    593f4c3d291e75903b8e30c63a696848_JaffaCakes118

  • Size

    648KB

  • Sample

    240718-1xerdsydkr

  • MD5

    593f4c3d291e75903b8e30c63a696848

  • SHA1

    b10e99e3600701312295052df27febc44a587ef4

  • SHA256

    0bce56f1587478cdb44adc1a4b7fa9b58c027ac414fda97bc9c8b5d60098d825

  • SHA512

    31ba7f21c3df68c0f89f440e792ec3153529545c1065b069655d9e1c1ef97b74c7d2cca7c9c077915b8088a75e80d495d1eaf42ce2300b056d0c9852b756985b

  • SSDEEP

    12288:ZXca4e6QwokAzbPzxPI6mFoaR5SAXhnsGs7GyoXery0AbKvuA:Zslem2z7zCXr+jo5Kvu

Score
10/10
hancitor1602_78210hdownloader

Malware Config

Extracted

Family

hancitor

Botnet

1602_78210h

C2

http://eviddinlahal.com/8/forum.php

http://saisepsdrablis.ru/8/forum.php

http://obvionsweyband.ru/8/forum.php

Targets

    • Target

      593f4c3d291e75903b8e30c63a696848_JaffaCakes118

    • Size

      648KB

    • MD5

      593f4c3d291e75903b8e30c63a696848

    • SHA1

      b10e99e3600701312295052df27febc44a587ef4

    • SHA256

      0bce56f1587478cdb44adc1a4b7fa9b58c027ac414fda97bc9c8b5d60098d825

    • SHA512

      31ba7f21c3df68c0f89f440e792ec3153529545c1065b069655d9e1c1ef97b74c7d2cca7c9c077915b8088a75e80d495d1eaf42ce2300b056d0c9852b756985b

    • SSDEEP

      12288:ZXca4e6QwokAzbPzxPI6mFoaR5SAXhnsGs7GyoXery0AbKvuA:Zslem2z7zCXr+jo5Kvu

    Score
    10/10
    hancitor1602_78210hdownloader

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Blocklisted process makes network request

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks