Overview

overview

10

Static

static

3

93d7b8618b...18.dll

windows7-x64

10

93d7b8618b...18.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    93d7b8618b69d64f00b175fa3b83c8a7_JaffaCakes118
  • Size 208KB
  • Sample240813-tvq83steqf
  • SHA256 d46b06c4e54b291c1c069192522d253520f16ea2c0665662257f88c632b1bb34
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
hancitor1702_pro23discoverydownloader

Malware Config

Extracted

Family

  • hancitor

Botnet

  • 1702_pro23

C2

  • http://hatuderefer.com/8/forum.php

  • http://thavelede.ru/8/forum.php

  • http://zinsubtal.ru/8/forum.php

Targets

    • Target
      93d7b8618b69d64f00b175fa3b83c8a7_JaffaCakes118
    • Size 208KB
    • SHA256 d46b06c4e54b291c1c069192522d253520f16ea2c0665662257f88c632b1bb34
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    hancitor1702_pro23discoverydownloader

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Blocklisted process makes network request

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks