2018-07-09 - HANCITOR MALSPAM INFECTION TRAFFIC WITH ZEUS PANDA BANKER

ASSOCIATED FILES:

  • 2018-07-09-Hancitor-malspam-1506-UTC.eml   (6.048 bytes)
  • 2018-07-09-Hancitor-malspam-infection-traffic.pcap   (2,963,326 bytes)/li>
  • 2018-07-09-Hancitor-binary-6C.pif.exe   (56,320 bytes)
  • 2018-07-09-Zeus-Panda-Banker-caused-by-Hancitor-infection.exe   (172,544 bytes)
  • 2018-07-09-downloaded-Word-doc-with-macro-for-Hancitor.doc   (181,760 bytes)

 

NOTES:


Shown above:  Flow chart for today's Hancitor malspam infection.

 

WEB TRAFFIC BLOCK LIST

Indicators are not a block list.  If you feel the need to block web traffic, I suggest the following domain and URLs:

 

EMAILS


Shown above:  Example of the malspam.

 

EMAIL HEADERS FROM TODAY'S HANCITOR MALSPAM EXAMPLE:

Received: from abramscpa.com ([173.51.132.44]) by [removed] for [removed];
        Mon, 09 Jul 2018 15:06:40 +0000 (UTC)
Message-ID: <1C2ED6EA.ACEFB0C6@abramscpa.com>
Date: Mon, 09 Jul 2018 08:06:43 -0700
Reply-To: "HelloFax" <hellofax@abramscpa.com>
From: "HelloFax Inc." <hellofax@abramscpa.com>
X-Mailer: Apple Mail (2.1990.1)
MIME-Version: 1.0
TO: [removed]
Subject: HelloFax, Here is Your Fax
Content-Type: text/html;
        charset="utf-8"
Content-Transfer-Encoding: 7bit

 


Shown above:  Word doc downloaded from link in the malspam.

 

INFECTION TRAFFIC


Shown above:  Traffic from an infection filtered in Wireshark.

 

LINKS IN THE EMAILS TO DOWNLOAD THE MALICIOUS WORD DOCUMENT:

NETWORK TRAFFIC FROM AN INFECTED LAB HOST:

 

MALWARE

MALWARE RETRIEVED FROM MY INFECTED LAB HOST:

 

FINAL NOTES

Once again, here are the associated files:

Zip archives are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.