HancitorMalware
- chanitor
Hancitor(aka Chanitor) emerged in 2013 which spread via social engineering techniques mainly through phishing mails embedded with malicious link and weaponized Microsoft office document contains malicious macro in it.From MISP Galaxy
Last reported 4 years ago, by Group-IB3 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“Besides Cobalt Strike’s capabilities to run the Beacon stagers on remote hosts, the attackers used Remote Desktop Protocol to move laterally.”
- T1505.003Web Shell
“The list is uploaded through importing links to web shells.”
- T1684Social Engineering
“…r of the service claimed that Prometheus TDS is an ANTIBOT redirect system designed to send out emails, work with traffic, and for social engineering.”
What the reports say
3 reports, newest first · the exact sentence from each-
Switching side jobs“…kit was used during the activity of Prometheus TDS, when an unknown adversary used phishing pages as a final redirect when distributing Hancitor malware.”
-
Prometheus TDS“In the spring of 2021, Group-IB’s Threat Intelligence analysts discovered traces of a malware campaign distributing Hancitor.”
-
Connecting the Bots“The Hancitor downloader has been around for quite some time already.”
Indicators in its reports
named in the reports above- hxxps://designestylelab[.]com/css/in 1 report
- designestylelab[.]comin 1 report
- hxxps://gvenlayer[.]com/track/in 1 report
- gvenlayer[.]comin 1 report
- hxxps://xn--keyvigatrs-key-7oc4531jsva[.]com/ktt/cmd/logonin 1 report
- xn--keyvigatrs-key-7oc4531jsva[.]comin 1 report
- xn--kys-nvigatorky-zp8g5mna[.]comin 1 report
- xn--kynavigatos-ky-pwc6541jna[.]comin 1 report
- navlgator-kcy[.]comin 1 report
- xn--kyavigator-ky-jjc7914ima[.]comin 1 report
- xn--ky-vigatorkey-kjc9383i4ka[.]comin 1 report
- xn--key-vigatrs-key-wuc9688j1wa[.]comin 1 report
- vigatorkey[.]comin 1 report
- rskey[.]comin 1 report
- xn--key-vigatrskey-8oc4531jsva[.]comin 1 report
- hxxp://www.swingsidebilbao[.]com/wp-content/plugins/contact-form-7/includes/block-editor/carl.phpin 1 report
- www.swingsidebilbao[.]comin 1 report
- be3effcb9069ac6d…e33e55980403in 1 report
- hxxps://xn--keynvigatorkey-yp8g[.]com/ktt/cmd/logon0210_4367220121562.docin 1 report
- xn--keynvigatorkey-yp8g[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.