Loading malware…
Hancitor, also known as Chanitor, is a Windows malware loader/downloader that has been widely used in financially motivated email-borne intrusion campaigns. It is commonly delivered through phishing or malspam messages carrying malicious Microsoft Word documents or links to such documents, often using invoice, billing, contract, receipt, or DocuSign-themed social-engineering lures. Infection typically depends on user execution, especially enabling Office macros, though some campaigns also briefly delivered alternate attachment formats such as XLL files.
Hancitor’s document-based infection chains have used Visual Basic macros, embedded objects, Base64-decoded payloads, PowerShell execution, and direct Windows API invocation to stage and run shellcode in memory. Reported behaviors include decoding embedded content, extracting executables from ZIP archives, executing shellcode via native APIs, and using rundll32 in multi-stage delivery chains. After execution, Hancitor installs itself on Windows hosts and can establish persistence through Registry Run keys.
The malware’s primary role is to provide initial access and download or deploy additional payloads. Hancitor has historically been associated with delivery of other crimeware, including Pony, Vawtrak, ZLoader, FickerStealer, and Cobalt Strike beacons, and it has also been observed as an entry point in intrusions that later progressed to ransomware activity, including cases involving Cuba and Zeppelin. Reporting has also linked Hancitor activity to TA511 campaigns.
Hancitor is best characterized as a loader used in cybercrime operations to bridge phishing-based initial compromise and follow-on malware deployment. Its tradecraft combines social-engineering delivery, macro-enabled document execution, in-memory shellcode staging, persistence via Windows autoruns, and follow-on payload retrieval on compromised Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
campaigns on January 24, 2018 and January 25, 2018 used a different document format, Rich Text Format (RTF), that leveraged an exploit (CVE-2017-11882) to launch shellcode which executed a PowerShell command used to download the standard binary | Over the past two years, the Hancitor malware family has been a fairly regular nuisance... In this post, I’ll be diving into the technical inner-workings of their latest malware packer.
The unique commands associated with the hacktool provide high confidence Zero.exe is ZeroLogon hacktool. The ZeroLogon hacktool is used to abuse CVE-2020-1472 to gain Domain Administrator (DA) privileges by requesting an NTLM hash from the domain controller.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"1873433027": "TA511/Hancitor - Stats uniques -> ips/hostnames: 36 publickeys: 29"
"1873433027": "TA511/Hancitor - Stats uniques -> ips/hostnames: 36 publickeys: 29"
"1873433027": "TA511/Hancitor - Stats uniques -> ips/hostnames: 36 publickeys: 29"
Also known as Chanitor, Hancitor is malware used by a threat actor designated as MAN1, Moskalvzapoe or TA511. Hancitor establishes initial access on a vulnerable Windows host and sends additional malware.
Also known as Chanitor, Hancitor is malware used by a threat actor designated as MAN1, Moskalvzapoe or TA511. Hancitor establishes initial access on a vulnerable Windows host and sends additional malware.
"Initially relying on the Hancitor loader, the group pivoted in mid-2022 to RomCom..."
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Several entries describe phishing emails containing attachments, for example: "Emotet has been delivered by phishing emails containing attachments" and "The White Company has sent phishing emails with malicious Microsoft Word attachments to victims."
After execution of the initial access malware, many threat actors deploy persistence mechanisms, such as the creation of scheduled tasks... Scheduled tasks were the most common persistence method observed in our intrusions.
Visual Basic can directly execute Microsoft Windows API calls, which allows it perform a number of interesting functions -- exactly what this VB code is doing.
APT19 used PowerShell commands to execute payloads... APT28 downloads and executes PowerShell scripts... APT29 has used encoded PowerShell scripts... | used PowerShell commands to execute payloads
Word doc with macros for Hancitor | The first URL returned an HTML file that was saved as res32.hta . That .hta file retrieved an EXE for Hancitor which was saved as snd32sys.exe .
The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.
The payload in question is base64-encoded and embedded within a form in the VBProject as a value of the ‘Text’ field on the ‘choline’ TextBox.
After execution of the initial access malware, many threat actors deploy persistence mechanisms, such as the creation of scheduled tasks... Scheduled tasks were the most common persistence method observed in our intrusions.
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
After execution of the initial access malware, many threat actors deploy persistence mechanisms, such as the creation of scheduled tasks... Scheduled tasks were the most common persistence method observed in our intrusions.
The call commits specific pages of memory with read, write, and executable (RWX) permissions... the macro continues to setup the next call to RtlMoveMemory... Now that our code has been copied to executable memory, the macro sets up the last API call for CallWindowProcA().
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
This black box represents a VBA object embedded in the document, and once interacted by the victim or the VBA macros, the object is automatically dropped to the file system.
This function executes the VBA Name statement to rename the zoro.kl file in the Temp folder to zoro.doc and move it to the user template folder.
The call commits specific pages of memory with read, write, and executable (RWX) permissions... the macro continues to setup the next call to RtlMoveMemory... Now that our code has been copied to executable memory, the macro sets up the last API call for CallWindowProcA().
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
Examples in the content include 'DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules,' 'Molerats decompresses ZIP files once on the victim machine,' and 'Rocke has extracted tar.gz files after downloading them from a C2 server.'
257 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
83 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a comparison point for similar bulletproof-hosting-backed delivery campaigns.
A downloader trojan delivered via phishing emails disguised as important documents and using .scr executables. It copies itself into the roaming profile, establishes persistence via the registry, communicates with TOR-backed C2 infrastructure through tor2web over SSL, beacons to /gate.php, retrieves host IP information, and downloads additional payloads for execution.
Loader used earlier in the intrusion chain prior to the group’s pivot to RomCom; used to deliver subsequent payloads.
Malware family used by the group since 2019 as part of their intrusion activity; the content does not provide additional functional detail beyond its use in targeting campaigns.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.