Extracted

• • Target

    WIS_868087283709651.vbs

  • Size

    726KB

  • MD5

    a21cda7e8d89d17b1bbc3c27035b132c

  • SHA1

    357ab07a728aa6e1cadae86f47ac0ebefda296bf

  • SHA256

    ec12eb1046c20c246ac6add559a64b52485d251e300c1d2dd4503de8a08c73d5

  • SHA512

    bf02164fc72977f509771b92c41706e3fb1c357c3245b7cc2aeb15ad2492320a5f834f8fc1bb8531e799fa078c8cf973373916d89478a8c8d0ba4af8abce5d72

  • SSDEEP

    12288:GMrUPl85od7HaQBUKqzoSv0DyZ1IfNKOngDi/4ogf3bQkrkT8W1B7jcCBLwnoppi:GaUPlTlUKqzoSvUo0gO2LbkTxpHLfHKH

  Score

  10^/10

  hancitor0212_4377843discoverydownloader

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

    downloaderhancitor

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2