Discover and read the best of Twitter Threads about #hancitor
Most recents (4)
Incoming #hancitor run, DocuSign subjects, @google feedproxy links, elektrykasklep.com sender:
http://feedproxy[.]google[.]com/~r/uaulgisrpg/~3/8ZokTiE9_c8/gratifying.php
http://feedproxy[.]google[.]com/~r/uaulgisrpg/~3/8ZokTiE9_c8/gratifying.php
@Google cc @wavellan @noottrak @jw_sec @malware_traffic @executemalware @wwp96 @felixw3000 @HerbieZimmerman @ffforward @node5 @JAMESWT_MHT
doc hash:
3b1c678b5cc556715d8395639b7a140fd874642cad0f13816e03002c2bd550ef
3b1c678b5cc556715d8395639b7a140fd874642cad0f13816e03002c2bd550ef
2020-07-16 - #Hancitor URL from (I assume) malspam:
hxxp://dunafacility[.]partners/wp-includes/tannerbaum.php
XLS: app.any.run/tasks/ab9808d6…
DLL: app.any.run/tasks/4e4a8162…
Follow-up malware: app.any.run/tasks/d94c1428…
hxxp://dunafacility[.]partners/wp-includes/tannerbaum.php
XLS: app.any.run/tasks/ab9808d6…
DLL: app.any.run/tasks/4e4a8162…
Follow-up malware: app.any.run/tasks/d94c1428…
2020-07-16 - #Hancitor info:
Paste: pastebin.com/s5iRrWRj
Pastebin raw: pastebin.com/raw/s5iRrWRj
Blog with #pcap and other data: malware-traffic-analysis.net/2020/07/16/ind…
If anyone knows what the follow-up malware is, let us all know. I don't recognize it.
Paste: pastebin.com/s5iRrWRj
Pastebin raw: pastebin.com/raw/s5iRrWRj
Blog with #pcap and other data: malware-traffic-analysis.net/2020/07/16/ind…
If anyone knows what the follow-up malware is, let us all know. I don't recognize it.
A couple of fresh malware campaigns in the past few days were halted by Windows Defender AV, whose cloud-based machine learning technologies detected and blocked #Hancitor and #Emotet malware runs at the onset.
When #malware says hi? #hancitor malware always has a sentinel in the malware document. This time it's our analyst @abhie's twitter handle.🤔
Sample hash: 800bf028a23440134fc834efc5c1e02cc70f05b2e800bbc285d7c92a4b126b1c
And ...
