MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbd4d497f7eb0a43abc98382f843872f75173d8fdb8f06799198b0e1164c0e95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Hancitor


Vendor detections: 10


Maldoc score: 11


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fbd4d497f7eb0a43abc98382f843872f75173d8fdb8f06799198b0e1164c0e95
SHA3-384 hash: ac897c29e577d1a769bc8cda8c9483586b7cd2d8d4abf1ee8b0adcffede283a50ecdb6a686e630868b959f6f533882aa
SHA1 hash: 487a92e09f7d4d1562f9b3b6512ae3771eaaa881
MD5 hash: 62639fb01242279c8f8526a6512e545e
humanhash: echo-kentucky-xray-network
File name:0204_47091115550132.doc
Download: download sample
Signature Hancitor
Create hunting rule
File size:515'072 bytes
First seen:2021-02-04 18:42:28 UTC
Last seen:Never
File type:Word file doc
MIME type:application/msword
ssdeep 12288:13oR8kBW/9Ro8zP82axXuKmsZqJVKfFapUK3L:9A8NxaRuRsMfKfFa6K3
TLSH 9FB4CF02B984C9A3C01A87343EA1C9A9B73ABD146F6495DB77CC7F6F5F305D04A39A06
Reporter malware_traffic
Tags:Chanitor doc Hancitor macros

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 11
Application name is Microsoft Office Word
Office document is in OLE format
Office document contains VBA Macros
OLE dump

MalwareBazaar was able to identify 19 sections in this file using oledump:

Section IDSection sizeSection name
1114 bytesCompObj
2280 bytesDocumentSummaryInformation
3428 bytesSummaryInformation
49122 bytes1Table
5130282 bytesData
6596 bytesMacros/PROJECT
7161 bytesMacros/PROJECTwm
84087 bytesMacros/VBA/Module1
91651 bytesMacros/VBA/Module2
102472 bytesMacros/VBA/Module3
111168 bytesMacros/VBA/Module4
123185 bytesMacros/VBA/Module5
134093 bytesMacros/VBA/ThisDocument
144389 bytesMacros/VBA/_VBA_PROJECT
15723 bytesMacros/VBA/dir
1676 bytesObjectPool/_1673918584/CompObj
17337747 bytesObjectPool/_1673918584/Ole10Native
186 bytesObjectPool/_1673918584/ObjInfo
194096 bytesWordDocument
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecDocument_OpenRuns when the Word or Publisher document is opened
IOCrd.dllExecutable file name
SuspiciousShellMay run an executable file or a system command
SuspiciousShellExecuteMay run an executable file or a system command
SuspiciousShell32May run an executable file or a system command
SuspiciousCreateObjectMay create an OLE object
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
1
# of downloads :
646
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
File type:
application/msword
Has a screenshot:
False
Contains macros:
True
Detection(s):
TwinWave.EvilDoc.ShellDreamWarriors.20210126.UNOFFICIAL
Create hunting rule

Sanesecurity.Badmacro.Doc.Em32.UNOFFICIAL
Create hunting rule

MiscreantPunch.EXEInsideOfDoc.2.UNOFFICIAL
Create hunting rule

Twinwave.EvilDoc.HancitorWelcomeToTheMachine.20210126.UNOFFICIAL
Create hunting rule

MiscreantPunch.EXEInsideOfDoc.1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
DNS request
Sending an HTTP GET request
Sending an HTTP POST request
Launching a process
Creating a file
Sending a custom TCP request
Reading critical registry keys
Launching a service
Stealing user critical data
Enabling autorun by creating a file
Launching a process by exploiting the app vulnerability
Unauthorized injection to a system process
Result
Verdict:
Suspicious
File Type:
Legacy Word File with Macro
Link:
https://app.docguard.net/fbd4d497f7eb0a43abc98382f843872f75173d8fdb8f06799198b0e1164c0e95/results/dashboard
Document image
Image:
Download PNG
Document image
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Document With Few Pages
Document contains between one and three pages of content. Most malicious documents are sparse in page count.
Macro Execution Coercion
Detected a document that appears to social engineer the user into activating embedded logic.
Macro Contains Suspicious String
Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...
Result
Threat name:
Hancitor
Create hunting rule
Detection:
malicious
Classification:
expl.phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/599751
Signature
Allocates memory in foreign processes
Contains functionality to inject threads in other processes
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA macro with suspicious strings
Document contains OLE streams with PE executables
Document exploit detected (drops PE files)
Document exploit detected (process start blacklist hit)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Office process drops PE file
Sigma detected: Microsoft Office Product Spawning Windows Shell
Sigma detected: Suspicious Svchost Process
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Writes to foreign memory regions
Yara detected Hancitor
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 348900 Sample: 0204_47091115550132.doc Startdate: 04/02/2021 Architecture: WINDOWS Score: 100 37 Multi AV Scanner detection for domain / URL 2->37 39 Malicious sample detected (through community Yara rule) 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 11 other signatures 2->43 7 WINWORD.EXE 28 39 2->7         started        process3 file4 21 C:\Users\user\AppData\Local\...\Wh102yYa.tmp, PE32 7->21 dropped 23 C:\Users\user\...\0204_47091115550132.doc.LNK, MS 7->23 dropped 53 Document exploit detected (process start blacklist hit) 7->53 11 rundll32.exe 12 7->11         started        15 splwow64.exe 7->15         started        signatures5 process6 dnsIp7 31 sungardspo.com 8.209.78.68, 49730, 80 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC Singapore 11->31 33 feirecropl.com 46.29.166.103, 49729, 49731, 49733 ASBAXETRU Russian Federation 11->33 35 3 other IPs or domains 11->35 55 System process connects to network (likely due to code injection or exploit) 11->55 57 Contains functionality to inject threads in other processes 11->57 59 Writes to foreign memory regions 11->59 61 2 other signatures 11->61 17 svchost.exe 16 11->17         started        signatures8 process9 dnsIp10 25 sweyblidian.com 185.100.65.29, 49740, 49771, 80 HOSTER-KZHosterKZ-hostinganddomainservicesinKazakhs Kazakhstan 17->25 27 nagano-19599.herokussl.com 17->27 29 2 other IPs or domains 17->29 45 System process connects to network (likely due to code injection or exploit) 17->45 47 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->47 49 Tries to steal Instant Messenger accounts or passwords 17->49 51 2 other signatures 17->51 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fbd4d497f7eb0a43abc98382f843872f75173d8fdb8f06799198b0e1164c0e95/
Threat name:
Script-Macro.Dropper.Hancitor
Create hunting rule
Status:
Malicious
First seen:
2021-02-04 18:43:06 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7pknjf7x5mfehk6jqobpqq4hf52ropmp3ohqm6mrtcyocfsmb2kq._file
Result
Malware family:
hancitor
Create hunting rule
Score:
  10/10
Tags:
family:hancitor botnet:0402_pogi downloader macro macro_on_action spyware
Link:
https://tria.ge/reports/210204-gsk15156sn/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
NTFS ADS
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Office loads VBA resources, possible macro or embedded object present
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
Loads dropped DLL
Blocklisted process makes network request
Hancitor
Process spawned unexpected child process
Malware Config
C2 Extraction:
http://feirecropl.com/8/forum.php
http://oresteseu.ru/8/forum.php
http://respoishis.ru/8/forum.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fbd4d497f7eb0a43abc98382f843872f75173d8fdb8f06799198b0e1164c0e95

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Hancitor
Create hunting rule
Author:threathive
Description:Hancitor Payload
Rule name:INDICATOR_OLE_ObjectPool_Embedded_Files
Create hunting rule
Author:ditekSHen
Description:Detects OLE documents with ObjectPool OLE storage and embed suspicous excutable files
Rule name:win_hancitor_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments