2020-10-20 - HANCITOR WITH SOMETHING AND COBALT STRIKE
ASSOCIATED FILES:
- 2020-10-20-Hancitor-IOCs.txt.zip 2.6 kB (2,574 bytes)
- 2020-10-20-Hancitor-malspam-9-examples.zip 19 kB (19,006 bytes)
- 2020-10-20-Hancitor-infection-traffic.pcap.zip 4.4 MB (4,444,385 bytes)
- 2020-10-20-Hancitor-and-follow-up-malware.zip 760 kB (759,603 bytes)
NOTES:
- All zip archives on this site are password-protected with the standard password. If you don't know it, see the "about" page of this website.
IMAGES
Shown above: Screen shot from an example of malspam pushing Hancitor.
Shown above: Screenshot from one of the Google Docs pages leading to the spreadsheet.
Shown above: Screenshot from one of the Excel files downloaded through the Google Docs pages.
Shown above: Traffic from an infection filtered in Wireshark.
Shown above: The initial Hancitor EXE.
Shown above: Registry update to make the Hancitor EXE persistent.
Shown above: Malware binaries in the infected user's AppData\Local\Temp directory.
Shown above: This appeared after the Cobalt Strike activity started.
Click here to return to the main page.