Loading malware…
Hancitor, also known as Chanitor, is a Windows malware loader and downloader used to deliver and execute additional malicious payloads, including information stealers, banking trojans, remote access trojans, and ransomware. It has distributed Pony and Vawtrak and has been used by Cuba ransomware actors to deploy ransomware on compromised systems.
Hancitor is distributed through phishing emails containing malicious attachments or links. Campaigns have used invoice, billing, receipt, contract, and HelloFax-themed lures to persuade recipients to open malicious Microsoft Word documents and enable macros. Document-based infection chains have used VBA to decode embedded shellcode, allocate executable memory, and execute the shellcode within the Word process through Windows API callbacks. The shellcode can locate and decrypt a payload embedded in the document and write the recovered executable to disk.
Hancitor has used PowerShell for command execution and Registry-based autostart mechanisms for persistence. Other documented behaviors include extracting executables from ZIP archives, decoding Base64-encoded links used to personalize document names, and deleting files through VBA. Its principal role is payload delivery; credential theft and ransomware operations may be performed by the malware it deploys.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Used a tool to exploit CVE-2020-1472 (also known as “ZeroLogon”) to gain Domain Administrative privileges. This tool and its intrusion attempts have been reportedly related to Hancitor and Qbot.
campaigns on January 24, 2018 and January 25, 2018 used a different document format, Rich Text Format (RTF), that leveraged an exploit (CVE-2017-11882) to launch shellcode which executed a PowerShell command used to download the standard binary | Over the past two years, the Hancitor malware family has been a fairly regular nuisance... In this post, I’ll be diving into the technical inner-workings of their latest malware packer.
7 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The actors distributed Cuba ransomware on compromised systems through Hancitor—a loader known for dropping or executing stealers, such as Remote Access Trojans (RATs) and other types of ransomware.
"1873433027": "TA511/Hancitor - Stats uniques -> ips/hostnames: 36 publickeys: 29"
"1873433027": "TA511/Hancitor - Stats uniques -> ips/hostnames: 36 publickeys: 29"
"1873433027": "TA511/Hancitor - Stats uniques -> ips/hostnames: 36 publickeys: 29"
Also known as Chanitor, Hancitor is malware used by a threat actor designated as MAN1, Moskalvzapoe or TA511. Hancitor establishes initial access on a vulnerable Windows host and sends additional malware.
Also known as Chanitor, Hancitor is malware used by a threat actor designated as MAN1, Moskalvzapoe or TA511. Hancitor establishes initial access on a vulnerable Windows host and sends additional malware.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
275 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
89 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned in an unverified list of malware families purportedly used to evaluate ABLE's ability to bypass anti-analysis checks.
Referenced as a comparison point for similar bulletproof-hosting-backed delivery campaigns.
A downloader trojan delivered via phishing emails disguised as important documents and using .scr executables. It copies itself into the roaming profile, establishes persistence via the registry, communicates with TOR-backed C2 infrastructure through tor2web over SSL, beacons to /gate.php, retrieves host IP information, and downloads additional payloads for execution.
Loader used earlier in the intrusion chain prior to the group’s pivot to RomCom; used to deliver subsequent payloads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.