Rewterz Threat Alert – Hancitor InfoStealer – Active IOCs

December 16, 2021

Severity

High

Analysis Summary

Hancitor was created in 2014 to drop other malware on infected machines. Also known as Tordal and Chanitor. Hancitor provides their loader as a service to other criminals, helping to install various malware on the target PCs. There is a sudden surge in Hancitor attacks and usually these attacks takes place on business days and falls off on the weekends.

This malware can’t be considered dangerous since even Microsoft’s built-in antivirus Windows Defender can detect it. Alot of it is being distributed in malspam campaigns, in a lot of cases emails don’t even reach their targets, being intercepted by spam filters. In essence, For users that are still using Windows seven or earlier and who either don’t have or disabled their antivirus software can still be targeted with more effectiveness. Despite such a limited “target audience”, Hancitor creators continue to update this malware and it is still very active to this day.

Impact

Information Theft
Data Exfiltration

Indicators of Compromise

MD5

e319be556721e65ae1b39b357606c86c
e826972d1fefac908f57b5694cef9a3b

SHA-256

7b3efb6ee6540810a9ce890b2c31368acc7bdfb913b6327a9adb2cac854a7c29
53ca4b06b2b83d4585848d6c62b542012b8915e0747cddb398108ab68f47408e
c1134b990e09241e2894e23e2b853e64f5c49ee1555d3a2da8f9c5d99edbb233

SHA-1

2a18193495bb18700f3e71bcc911ac8b05cc724b
4e7bc3d9d93dd54296cfe0083d882abe718304d2

URL

http[:]//0bamandos[.]ru/help[.]doc
http[:]//ybotedin[.]com/9/forum[.]php
http[:]//joirmeraw[.]ru/9/forum[.]php
http[:]//sibiquan[.]ru/9/forum[.]php

Remediation

Block the threat indicators at their respective controls.
Search for IOCs in your environment.
Always be suspicious about emails sent by unknown senders.