Wireshark Tutorial: Examining Traffic from Hancitor Infections
Summary: Unit 42's Wireshark tutorial walks through packet captures of Hancitor infections, where emails carry HTTPS links to docs.google.com that lead to a malicious Word document whose macros drop a DLL. The infected host then generates Hancitor C2 traffic to URLs ending in /8/forum.php, followed by followup malware including Ficker Stealer, Cobalt Strike, NetSupport Manager RAT, a network ping tool and Send-Safe spambot malware.
What you should know: Hancitor's C2 URLs have ended in /8/forum.php since November 2020, and Ficker Stealer's EXE kept the same SHA256 hash from 2021-01-20 through at least 2021-03-04 - stable enough indicators that a missed detection is a choice, not a blind spot.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026