Loading malware…
Hancitor, also known as Chanitor and Tordal, is a malware downloader/loader first observed in 2015. It is commonly delivered through phishing and malspam campaigns using malicious Microsoft Word or Excel documents with macros, malicious attachments, and malicious links in email; some campaigns used DocuSign- or eFax-themed lures, redirected victims to ZIP archives containing VBS files, or abused file storage services. If users enable macros, Hancitor can execute embedded payloads and has used PowerShell to run commands. It also includes an anti-analysis check in which a macro verifies the presence of an ActiveDocument shape object and exits without downloading additional payloads if the object is missing.
Hancitor is primarily used to download and deliver additional malware. Follow-on payloads directly mentioned in the content include Pony/Evil Pony, Vawtrak, DanaBot, Ursnif, Ficker Stealer, NetSupport RAT, Mars Stealer, and Cobalt Strike; Hancitor activity has also been associated with subsequent ransomware deployment, including Cuba ransomware/COLDDRAW operations after Cobalt Strike in some cases. One described campaign used macro-enabled documents to execute Hancitor, which then downloaded two Pony variants and DanaBot. Another described Hancitor injecting the final Ficker Stealer payload using process hollowing. In 2021, Hancitor was observed delivering Cobalt Strike when it identified an Active Directory environment.
Technical analysis in the content states that Hancitor commonly appears packed with a custom crypter and stores its configuration in the PE .data section rather than exposing C2 indicators in plaintext. The configuration is described as a 0x200-byte blob encrypted with RC4 via the Windows CryptoAPI. An 8-byte initial key is SHA1-hashed, and the first 5 bytes of that SHA1 digest are used to derive the effective RC4 session key. Dynamic extraction via CryptDecrypt breakpoints and static extraction/automation methods were specifically described.
The malware targets Windows environments and has been observed in broad criminal delivery operations. The content also notes use by the Russian-speaking group Nebulous Mantis / UNC2596 / STORM-0978 / Tropical Scorpius / Cuba since 2019, targeting critical infrastructure, governments, and NATO-linked entities, before that group pivoted in mid-2022 toward RomCom. Additional artifacts mentioned include storage of the Hancitor DLL with a .txt extension in the user Temp directory during one infection chain.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"Initially relying on the Hancitor loader, the group pivoted in mid-2022 to RomCom..."
19 distinct techniques documented for this family, organized by ATT&CK tactic.
例えばHancitorのようにファイルストレージサービスを経由して感染するマルウェアも存在するため、不審なURLの内容を確認する目的においてWebサイトスキャンサービスの利用は有用といえます。
The content repeatedly describes threat actors and malware being delivered through phishing or spearphishing emails containing malicious attachments such as Microsoft Office documents, PDFs, RAR/ZIP archives, CHM, ISO, IMG, HTA, LNK, and executable files disguised as documents.
The content repeatedly describes threat actors and malware using PowerShell scripts/commands for execution, download, staging, reconnaissance, persistence, credential access, lateral movement, and defense evasion; e.g., "Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses."
The emails used an eFax lure and contained a URL linking to the download of a document containing malicious macros. The macros, if enabled by the user, executed the embedded Hancitor malware.
The last approach is to extract the config using python script, the biggest advantage of this method is that once we have our script, it can basically work on any other Hancitor sample.
The content repeatedly mentions malicious macros in Word/Excel documents, such as "enable macros," "embedded macros," and "macro-enabled documents."
The macros, if enabled by the user, executed the embedded Hancitor malware.
Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them... APT29 has used various forms of spearphishing attempting to get a user to open attachments... DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.
Another approach is obfuscating or encrypting the IOCs in a chunk of data that is embedded within the executable to later decrypts it during runtime. Hancitor approach is the latter, the config is stored in the executable and the IOCs are not visible during regular static analysis.
"injects the final payload using a technique called process hollowing"
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
Once we enter FUN_10002cd0 we see that its core functionality is to use the CryptoAPI to decrypt content using the CryptDecrypt function.
CHOPSTICK includes runtime checks to identify an analysis environment and prevent execution on it. Hancitor has used a macro to check that an ActiveDocument shape object in the lure message is present. If this object is not found, the macro will exit without downloading additional payloads. Operation Spalax threat actors used droppers that would run anti-analysis checks before executing malware on a compromised host.
CHOPSTICK includes runtime checks to identify an analysis environment and prevent execution on it. Hancitor has used a macro to check that an ActiveDocument shape object in the lure message is present. If this object is not found, the macro will exit without downloading additional payloads. Operation Spalax threat actors used droppers that would run anti-analysis checks before executing malware on a compromised host.
Examples in the content include malware extracting or unpacking ZIP, RAR, CAB, tar.gz, and other archived content, such as 'Emotet has used a self-extracting RAR file to deliver modules to victims' and 'Rocke has extracted tar.gz files after downloading them from a C2 server.'
In 2017, nearly every 7th SBL listing that Spamhaus issued was for a botnet controller. The number of such botnet "C&C" listings increased by a massive 32% in 2017.
The Hancitor malware, first observed in 2015, is a downloader known to deliver several other malware. In its first years, Hancitor was observed delivering information stealers such as Pony or Vawtrak, and in recent years, Ficker stealer and NetSupport RAT. In 2021, Hancitor was observed delivering the Cobalt-Strike attack framework...
45 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader used earlier in the intrusion chain prior to the group’s pivot to RomCom; used to deliver subsequent payloads.
Malware family used by the group since 2019 as part of their intrusion activity; the content does not provide additional functional detail beyond its use in targeting campaigns.
Malware loader used in earlier iterations of the campaign to deliver subsequent payloads.
Malware referenced as being distributed via file storage services; the article notes some scanned URLs were suspected Hancitor malware distribution pages.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.