Overview

overview

10

Static

static

3

ba5d13d641...18.dll

windows7-x64

10

ba5d13d641...18.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ba5d13d64133ff19ab43207d23f467c3_JaffaCakes118
  • Size 208KB
  • Sample240823-e35zwaxfpr
  • SHA256 ca28945917b92e552b7c7bacb6421bce34285f4bab5290ce14637d84ca5621e8
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
hancitor1702_pro23discoverydownloader

Malware Config

Extracted

Family

  • hancitor

Botnet

  • 1702_pro23

C2

  • http://hatuderefer.com/8/forum.php

  • http://thavelede.ru/8/forum.php

  • http://zinsubtal.ru/8/forum.php

Targets

    • Target
      ba5d13d64133ff19ab43207d23f467c3_JaffaCakes118
    • Size 208KB
    • SHA256 ca28945917b92e552b7c7bacb6421bce34285f4bab5290ce14637d84ca5621e8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    hancitordiscoverydownloader1702_pro23

    • Hancitor

      Hancitor is downloader used to deliver other malware families.

      downloaderhancitor

    • Blocklisted process makes network request

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks