MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74dda39e6eca2da641aa05c4490d1024ba8505853a465b0d8a6293065ca8b071. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Hancitor


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74dda39e6eca2da641aa05c4490d1024ba8505853a465b0d8a6293065ca8b071
SHA3-384 hash: 964d6d4b794fdbf3bd73b82cee0511e759f6399365ac72dbc04a106802f64e6b72a61d679d138565096c97e5a9cf6189
SHA1 hash: d7376a1c8eb7e690ead484b9d5177894315f238d
MD5 hash: 16b53cb2f51441477fea6ab45648adc5
humanhash: robin-harry-muppet-fix
File name:if.bin
Download: download sample
Signature Hancitor
Create hunting rule
File size:1'547'776 bytes
First seen:2022-01-26 17:21:37 UTC
Last seen:2022-01-26 19:12:44 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 8285bd1d71d95ff16c5d24cf9b4358b5 (1 x Hancitor)
ssdeep 24576:4fB32J+LFwooyjPP0D3o+lJ83Nmj6nIuJQG9YrsReWjquQT1d:yBGciiP+ZJkIU7cW+pT
Threatray 22 similar samples on MalwareBazaar
TLSH T111656D22BE8F9437D4BA063C8C1BA66994397D113E28946B77F41E4CCF3A7407D1929B
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (573 x Quakbot, 309 x GCleaner, 137 x ArkeiStealer)
Reporter malwarelabnet
Tags:dll Hancitor

Intelligence

File Origin
# of uploads :
2
# of downloads :
633
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Hancitor
Create hunting rule
Link:
https://www.capesandbox.com/analysis/223564/
Detection(s):
SecuriteInfo.com.generic.ml.12779.22984.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Creating a file in the Program Files subdirectories
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe keylogger replace.exe update.exe
Link:
https://www.filescan.io/uploads/61f1834a59d130b02a5440de/reports/e9bde254-ec9c-48b8-948b-39bceb3acd2c/overview
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/bf6df06e-bb73-487b-90fc-93f4964d63b7
Result
Threat name:
Hancitor
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/928362
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/74dda39e6eca2da641aa05c4490d1024ba8505853a465b0d8a6293065ca8b071/
Threat name:
Win32.Trojan.Hancitor
Create hunting rule
Status:
Malicious
First seen:
2022-01-26 16:08:30 UTC
File Type:
PE (Dll)
Extracted files:
140
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oto2hhtoziw2mqnkaxcesdiqes5ikbmfhjdfwdmkmkjqmxfiwbyq._file
Verdict:
malicious
Label(s):
hancitor
Create hunting rule
Similar samples:
125c2b558cc9cedeee5cd0a0b78c1d7e9056ead0087422f01b52753439fac84f
Hancitor
245dd0bff1c08559e5e68ea25aadbf5bc6ebef5831ec19c34d8d2021747157fe
Hancitor
2c19a75d22fd1a7d9b088407217f9b4534ba9c28253ac69b25f4408086285538
Hancitor
571cba0431acea4739c5248de1b1d33e76e995b3c7454f4d88d2785ade6fdf74
Hancitor
6f67beb15edea5f47a2ca655bca9a534e5944e3704a916a2b3d00ed7790e25f0
Hancitor
89885adcbb030fd0251b08cc401392e90d4ad948f6cfc68dda34472c455a8951
Hancitor
c1134b990e09241e2894e23e2b853e64f5c49ee1555d3a2da8f9c5d99edbb233
Hancitor
+ 12 additional samples on MalwareBazaar
Result
Malware family:
hancitor
Create hunting rule
Score:
  10/10
Tags:
family:hancitor botnet:2401_hjksd downloader
Link:
https://tria.ge/reports/220126-vxkprafgcq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Looks up external IP address via web service
Blocklisted process makes network request
Hancitor
Malware Config
C2 Extraction:
http://fountandevin.com/9/forum.php
http://nummasdocarm.ru/9/forum.php
http://beetwedwornew.ru/9/forum.php
Unpacked files
SH256 hash:
a2d724f43fec5deddaa8cd40f55e006f13fd83c1ccc736b57efe68dea68dc7c5
MD5 hash:
99085ae71fc0f0d7ebfe8d4ab51f0e35
SHA1 hash:
3f7e4c894799f537fbee4e56f3e462f8ae59e923
Detections:
win_hancitor_auto
Create hunting rule
Link:
https://www.unpac.me/results/6473b587-f314-4e20-b0e1-4ba934be0a41/
SH256 hash:
74dda39e6eca2da641aa05c4490d1024ba8505853a465b0d8a6293065ca8b071
MD5 hash:
16b53cb2f51441477fea6ab45648adc5
SHA1 hash:
d7376a1c8eb7e690ead484b9d5177894315f238d
Link:
https://www.unpac.me/results/6473b587-f314-4e20-b0e1-4ba934be0a41/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Hancitor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/74dda39e6eca2da641aa05c4490d1024ba8505853a465b0d8a6293065ca8b071

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Hancitor
Create hunting rule
Author:threathive
Description:Hancitor Payload
Rule name:win_hancitor_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.hancitor.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/223564/

Comments