Loading malware…
Hancitor, also known as Chanitor, is a Windows malware loader and downloader that has been widely used as an initial access payload in financially motivated intrusion activity. It is commonly distributed through phishing and malspam campaigns using social-engineering lures such as invoices, billing notices, contracts, receipts, and similar business-themed messages. Delivery has frequently relied on malicious Microsoft Word documents that prompt victims to enable macros, and some campaigns have also used archive-contained executables or alternate attachment formats. Hancitor has been associated with TA511 activity and has served as an entry point for follow-on malware and broader intrusion operations, including ransomware-related compromises.
Hancitor’s infection chains have used VBA macros, embedded objects, shellcode execution, and PowerShell-based execution. Document-based droppers have decoded embedded payload material, allocated executable memory through native Windows APIs, and transferred execution to shellcode running inside Office processes. Other observed chains used multi-stage Word documents that dropped and executed DLL payloads through rundll32. Hancitor has also been observed decoding Base64-encoded content and extracting executables from ZIP archives as part of staging and delivery.
Once executed, Hancitor functions primarily as a downloader or loader for additional malware. Reported follow-on payloads have included Pony, Vawtrak, Cobalt Strike beacons, FickerStealer, and malware associated with Cuba and Zeppelin ransomware operations. In broader intrusion reporting, Hancitor has been identified alongside other initial access malware families that frequently precede hands-on-keyboard post-exploitation and ransomware deployment.
On infected Windows systems, Hancitor has used PowerShell to execute commands and has established persistence through Registry Run keys. Its droppers have also demonstrated defense-evasion and anti-forensics behavior, including deletion of files used during execution. Technical analyses have documented use of native APIs such as CallWindowProc and EnumResourceTypesA to interpret and execute shellcode, reflecting a design focused on in-memory staging and flexible payload delivery.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
campaigns on January 24, 2018 and January 25, 2018 used a different document format, Rich Text Format (RTF), that leveraged an exploit (CVE-2017-11882) to launch shellcode which executed a PowerShell command used to download the standard binary | Over the past two years, the Hancitor malware family has been a fairly regular nuisance... In this post, I’ll be diving into the technical inner-workings of their latest malware packer.
The unique commands associated with the hacktool provide high confidence Zero.exe is ZeroLogon hacktool. The ZeroLogon hacktool is used to abuse CVE-2020-1472 to gain Domain Administrator (DA) privileges by requesting an NTLM hash from the domain controller.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"1873433027": "TA511/Hancitor - Stats uniques -> ips/hostnames: 36 publickeys: 29"
"1873433027": "TA511/Hancitor - Stats uniques -> ips/hostnames: 36 publickeys: 29"
"1873433027": "TA511/Hancitor - Stats uniques -> ips/hostnames: 36 publickeys: 29"
Also known as Chanitor, Hancitor is malware used by a threat actor designated as MAN1, Moskalvzapoe or TA511. Hancitor establishes initial access on a vulnerable Windows host and sends additional malware.
Also known as Chanitor, Hancitor is malware used by a threat actor designated as MAN1, Moskalvzapoe or TA511. Hancitor establishes initial access on a vulnerable Windows host and sends additional malware.
"Initially relying on the Hancitor loader, the group pivoted in mid-2022 to RomCom..."
22 distinct techniques documented for this family, organized by ATT&CK tactic.
The eSentire Threat Intelligence team is tracking a recently identified campaign delivering Hancitor malware through malicious “HelloFax” emails.
After execution of the initial access malware, many threat actors deploy persistence mechanisms, such as the creation of scheduled tasks... Scheduled tasks were the most common persistence method observed in our intrusions.
Visual Basic can directly execute Microsoft Windows API calls, which allows it perform a number of interesting functions -- exactly what this VB code is doing.
APT19 used PowerShell commands to execute payloads... APT28 downloads and executes PowerShell scripts... APT29 has used encoded PowerShell scripts... | used PowerShell commands to execute payloads
When the document macro is executed, it will inject malicious code into a svchost.exe process.
The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.
The payload in question is base64-encoded and embedded within a form in the VBProject as a value of the ‘Text’ field on the ‘choline’ TextBox.
After execution of the initial access malware, many threat actors deploy persistence mechanisms, such as the creation of scheduled tasks... Scheduled tasks were the most common persistence method observed in our intrusions.
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
After execution of the initial access malware, many threat actors deploy persistence mechanisms, such as the creation of scheduled tasks... Scheduled tasks were the most common persistence method observed in our intrusions.
When the document macro is executed, it will inject malicious code into a svchost.exe process.
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
This black box represents a VBA object embedded in the document, and once interacted by the victim or the VBA macros, the object is automatically dropped to the file system.
This function executes the VBA Name statement to rename the zoro.kl file in the Temp folder to zoro.doc and move it to the user template folder.
When the document macro is executed, it will inject malicious code into a svchost.exe process.
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
Examples in the content include 'DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules,' 'Molerats decompresses ZIP files once on the victim machine,' and 'Rocke has extracted tar.gz files after downloading them from a C2 server.'
275 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
84 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a comparison point for similar bulletproof-hosting-backed delivery campaigns.
A downloader trojan delivered via phishing emails disguised as important documents and using .scr executables. It copies itself into the roaming profile, establishes persistence via the registry, communicates with TOR-backed C2 infrastructure through tor2web over SSL, beacons to /gate.php, retrieves host IP information, and downloads additional payloads for execution.
Loader used earlier in the intrusion chain prior to the group’s pivot to RomCom; used to deliver subsequent payloads.
Malware family used by the group since 2019 as part of their intrusion activity; the content does not provide additional functional detail beyond its use in targeting campaigns.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.