Dissecting Hancitor’s Latest 2018 Packer
Summary: Unit 42 analyzed Hancitor campaigns from January 24 and 25, 2018 that switched from macro-laden Word documents to RTF files exploiting CVE-2017-11882 to launch shellcode and a PowerShell command that saved a base64-encoded PE to disk. The January 25 RTF carried an embedded PE with a new packer that sets all memory to read-write-execute, XOR-decodes 0xC80 bytes at 0x402185 with 0xD1, and uses RC4 key-scheduling and pseudo-random generation to build an offset table for reassembling shellcode. The malware family has gone through more than 80 variations over two years, and the standard Hancitor command-and-control gate URLs stayed the same despite the new dropper.
Key Takeaway: Hancitor's authors abandoned their usual social-engineering-only approach for a known Office exploit, and the C2 gate URLs did not change - so detection tuned to those URLs still works even when the packer underneath is rewritten.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Mentions
- CVE-2017-11882
- Related
- My Little Form Book Cyber Risks ·Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox Cyber Risks ·SWEED: Exposing years of Agent Tesla campaigns Cyber Risks ·