Hancitor Malware Analysis

File Properties

SHA256: fcba3daba91a4c061d7ea5ac9a2076668f9c029826e4b2b9d2894f90673f65ab

MD5: d860b8a46bdf5f113c36ecc32760daf8

File Type: exe

Size: 685,400 byte

First Seen: 2020-10-29

AV Signature: Hancitor

Imphash: 4a8984c63e4398ee7c2fafcb435d43c3

Reported By: ffforward

Tags: AASNBUVAGDADGUWMOQ, exe, Hancitor, PNG

Static analysis: metadata-based (sample not downloaded)

Hancitor — Malware Profile

Hancitor (Chanitor) email dropper. PuTTY SSH disguise. Cobalt Strike/Ficker dropper.

Malware Type
Loader
Programming Language
C
C2 Protocol
HTTP
Target Systems
Windows

Technical Details

Loader ailesi: HTTP/HTTPS C2, payload sifre cozme ve bellek icerisinde yükleme, anti-sandbox/VM kontrolleri, process injection, persistence mekanizmasi, yükü indirme ve calistirma zinciri

Capabilities & Behavior

Payload İndirme
Süreç Enjeksiyonu
Modüler Mimari
Kimlik Bilgisi Hırsızlığı
Yanal Hareket
Kalıcılık
Anti-VM/Sandbox
İkincil Payload Dağıtımı

IOC List (1 indicators)

IOC — Hancitor
# FILEPATH fcba3daba91a4c061d7ea5ac9a2076668f9c029826e4b2b9d2894f90673f65ab
TypeValueNote
filepath fcba3daba91a4c061d7ea5ac9a2076668f9c029826e4b2b9d2894f90673f65ab PDB

C2 Servers (1 recorded servers for this family)

Address Type Port Protocol Status Country
5.61.46.161 ip 80 HTTP sinkholed UA

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.

Tags
AASNBUVAGDADGUWMOQexeHancitorPNG