Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

VB Dropper and Shellcode for Hancitor Reveal New Techniques Behind Uptick

Summary: Unit 42 observed a large uptick in Hancitor downloader delivery over the past week, with the malware shifting away from H1N1 to distribute Pony and Vawtrak executables, and more than 380,000 sessions seen in the latest campaign. The attached Word documents use VB macros that base64-decode an embedded payload, allocate RWX memory via VirtualAlloc, copy the shellcode with RtlMoveMemory, and hand off execution through CallWindowProcA, after which the shellcode hunts for the magic bytes 0x504F4C41, decrypts the binary by adding 0x3 and XORing with 0x13, and writes itself to %SYSTEMROOT%/system32/WinHost.exe.

Bottom line: The lures are ordinary invoice and overdue-bill emails, and the dropper's C2 traffic can be caught at the perimeter by the '/(sl|zaopy)/gate.php' pattern across the 23 listed domains - a detection your email and proxy controls either already cover or don't.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related