Skip to main content
Hancitor Trojan

Hancitor is a popular downloader that delivers a wide variety of other malware since first being seen in 2014.

Report a cyber attack: call 0300 303 5222 or email carecert@nhsdigital.nhs.uk

Summary

Hancitor is a popular downloader that delivers a wide variety of other malware since first being seen in 2014.


Affected platforms

The following platforms are known to be affected:

Threat details

Introduction

First observed in 2014, Hancitor (also known as Chanitor and Tordal) is a downloader trojan that has been used to deliver multiple different malware such as Pony, Vawtrak, and DELoader.

Hancitor operates as Malware-as-a-Service, allowing attackers to create bespoke campaigns. Over the last seven years, dozens of versions of this downloader have been used in spam campaigns with different payloads.


Delivery

Traditionally, Hancitor was delivered via macro-laden Microsoft Office attachments in spam or phishing campaigns. If the user enabled macros within these attachments, the macros will unpack an embedded Hancitor payload before installing it on the system.

Hancitor began using disguised URL links in place of attachments in early 2017. In some cases, these links directly downloaded Hancitor to a system, whilst in others they lead to a Google Doc file containing it. In 2021, Hancitor has used both malicious attachments and disguised URL links as delivery vectors.


Activities

After Hancitor is unpacked and executed, it gathers user and system information. A query string is constructed with the gathered information. After decrypting a hardcoded list of command and control (C2) servers, Hancitor will attempt to send the query string to all of the C2 servers until one of them responds.

The responding C2 server replies with a URL, which Hancitor uses to download a payload.  Hancitor uses one of several options – create process, create thread, process hollowing, or thread execution hijacking – to execute the payload.


Threat updates

Date Update
12 May 2021 Hancitor being used in Cuba ransomware campaigns

Hancitor has been used in recent Cuba ransomware campaigns. It is delivered via spam emails containing a link purporting to sign a document from a popular document signing service. When a user interacts with the link, a macro-laden Word document containing a Hancitor payload is downloaded and opened. This document will extract and execute Hancitor if the user enables the macros, dropping it as a Dynamic Link Library to C:\Users\%username%\AppData\Roaming\Microsoft\Word and running it via rundll32.exe.

Hancitor then downloads tools to facilitate lateral movement and data extraction prior to the deployment of Cuba ransomware. These tools commonly include Flicker stealer and, if an Active Directory (AD) environment is detected, Cobalt Strike. A network ping tool to enumerate the AD environment has also been downloaded in these campaigns.


Remediation advice

To prevent and detect an infection, NHS Digital advises that:

  • Secure configurations are applied to all devices.
  • Security updates are applied at the earliest opportunity.
  • Tamper protection settings in security products are enabled where available.
  • Obsolete platforms are segregated from the rest of the network.
  • IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
  • Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
  • Administrative accounts are only used for necessary purposes.
  • Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
  • Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that the NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.


Indicators of compromise

Network indicators

URLs

  • http://areentthrices[.]ru/8/forum.php
  • http://cloolyepervir[.]com/8/forum.php
  • http://conlymorect[.]ru/8/forum.php
  • http://forticheire[.]ru/8/forum.php
  • http://fruciand[.]com/8/forum.php
  • http://nentrivend[.]ru/8/forum.php
  • http://requirend[.]com/8/forum.php
  • http://spabyasiande[.]ru/8/forum.php
  • http://syleclisizame[.]ru/8/forum.php

Host indicators

SHA-256 hashes

  • 00b2312dd63960434d09962ad3e3e7203374421b687658bd3c02f194b172bfe3
  • 080bade36015dd79925bab0975ac0f30f18424bdd1e7836d63c2dee350bdbd69
  • 0941090d3eb785dbf88fbfafffad34c4ab42877b279129616a455347883e5738
  • 111a2dc96e082b86a79dd90ec307c977a21c7aee0ddb141d688a17bd65f3661d
  • 1c55c9e30e3e2a4837afd80e6fc75518494af379835f4b2a7f0eaf815d697951
  • 22043734ed3f774db7a88297286f6ecd56336d755cc19f1bd54f2a2ac58982cd
  • 288fdf9c64da0251107df7f1c3283f328279ad581710a9cf71f67e53b0b1684d
  • 2ac3b573d70c40c5c0fafe4e5914c723f2322a1c9cd76d232447654604ff8b76
  • 372da9447db4ca966a6a9fd45f12519637a562953a88b6d92fb26d3699c14799
  • 385425e94ed8ac21d7888550743b7a2b89afbeb51341713adb6da89cd63b5aff
  • 3ffe9ef810d01e9f242558ba59e8c7483adb72e087132cb0fd1e55171c45690f
  • 40c3eb22a02601cf70a4ae08eeaa5805144386bc13882e5f110c133b1d0ede8e
  • 419fda1fec9e44d7988ceeb9c5742a09198e6fa7f213c23b7c064e56cbd50b40
  • 43690eaf47245d69f4bda877c562852e4a9715955c2160345cb6cc84b18ca907
  • 51dd023b55be138ac7cfe7379a55c0a2a46c01cd3b3f96a151b0a27ed9e12485
  • 56f1795abf78f798a51b9224a5deb17aedd924629136832b526c93339f525e56
  • 678da85cecff2cdda8559281dfc8a89f87c44c6371cbda4de4bc9ea5cd2f5cf9
  • 6caccc64a9db7cfce75076ad273d85d108f5b764fcbbb865fd27c91f86cccfad
  • 6cd76e8f33a945b51d20b909495bbc613f78151dbea6c3a7a3a235bfd2167cdf
  • 772c897ffdfb824b31d70ea360224714ab9bb83659bd431897cc74dd2defc2f3
  • 7b013a271432cc9dea449ea9fcf727ed3caf7ce4cc6a9ba014b3dd880b5668dd
  • 82c9bc479ea92c1900422666792877e00256996ce2f931984115598ed2c26f23
  • 878319795a84ebfe5122d6fc21d27b4b94b3c28ad66679f841dec28ccc05e801
  • 8bcf45c2de07f322b8efb959e3cef38fb9983fdb8b932c527321fd3db5e444c8
  • 99b98b8c7033456ba7840ad99c65347a8026aee62bccbbac6d22ca4b0f5dfa1e
  • a1ec1a483f549af7e6f26ffe8b2c2ef6ac8c8f0d99349350c1df5eaa327f1ed3
  • b1502cdbb5aeee57d0a5d38945c64855ba35c25d43a71bd72c3cf31665e5aa62
  • c3e06473c4c3d801c962e6c90ccbcab3d532fb5a6649077ea09cd989edf45eaf
  • c5385df4db1e69b06cf36f4481365d1101679a5764d721e369ea1d5d4c4b6b2c
  • cab2a47456a2c51504a79ff24116a4db3800b099ec50d0ebea20c2c77739276d
  • cdcd5ee8b80d3a3863e0c55d4af5384522144011b071d00c9c71ae009305f130
  • ce2449b7f600b0317614419159e9364e1a76613ac0cb112c88be171638573049
  • d6755718c70e20345c85d18c5411b67c99da5b2f8740d63221038c1d35ccc0b8
  • ed3fa9e193f75e97c02c48f5c7377ff7a76b827082fdbfb9d6803e1f7bd633ca
  • edabef17fce2aaca61dbd17a57baf780cd82a2b0189b0cf3c5a7a3ca07e94a44

Last edited: 12 May 2021 3:27 pm