2020-03-16 - MORE HANCITOR MALSPAM USING COVID-19/CORONAVIRUS THEME

ASSOCIATED FILES:

• 2020-03-16-Hancitor-IOCs.txt.zip   1.5 kB (1,498 bytes)
• 2020-03-16-Hancitor-malspam-example.eml.zip   2.6 kB (2,616 bytes)
• 2020-03-16-Hancitor-infection-traffic-2-pcaps.zip   1.8 MB (1,819,120 bytes)
• 2020-03-16-Hancitor-malware-and-artifacts.zip   4.9 MB (4,902,866 bytes)

NOTES:

• This is a continuation of Hancitor activity reported last week on Wednesday 2020-03-11 (link)
• Zip archives are password-protected with the standard password.  If you don't know it, see the "about" page of this website.

 

IMAGES

Shown above:  Screenshot of today's Hancitor malspam.

 

Shown above:  Downloading a zip archive from link in the malspam.

 

Shown above:  VBS file inside of the downloaded zip archive.

 

Shown above:  Traffic from an infection filtered in Wireshark.

 

Click here to return to the main page.