Hancitor
MITRE ATT&CK: S0499 View on attack.mitre.org
Aliases: Chanitor, Hancitor
- First seen
- 2013-09-01 00:00:00
- Malware type
- downloader
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 240 (215 malicious)
- Last IoC activity
- 2026-10-17 20:32:51
- Profile updated
- 2026-07-07 13:05:03
Targeted industries: financial-services healthcare-and-pharmaceutical technology-and-telecommunications
Targeted regions: country_code:us country_code:ca country_code:gb
Context
Hancitor is a downloader that has been used by Pony and other information stealing malware.
Recent IoC activity
215 malicious indicators in Maltiverse are attributed to Hancitor (S0499). The 20 most recently updated:
Detection coverage
- 2 YARA rules
- 458 Sigma rules
Malware & tools used
- Malicious File (attack-pattern)
- Verclsid (attack-pattern)
- Compression (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- Malicious Link (attack-pattern)
- Native API (attack-pattern)
- Spearphishing Attachment (attack-pattern)
- Registry Run Keys / Startup Folder (attack-pattern)
- PowerShell (attack-pattern)
- Spearphishing Link (attack-pattern)
- Obfuscated Files or Information (attack-pattern)
- File Deletion (attack-pattern)
- Virtualization/Sandbox Evasion (attack-pattern)
- Deobfuscate/Decode Files or Information (attack-pattern)
Used by threat actors
- Moskalvzapoe (threat-actor)
Detection rules
- MALPEDIA_Win_Hancitor_Auto (yara-rule)
- CAPE_Hancitor (yara-rule)
Reports & references
- medium.com — Man1 Moskal Hancitor And A Side Of Ransomware D77B4D991618 (report)
- Palo Alto Unit 42 — Hancitor Infections Cobalt Strike (report)
- blog.group-ib.com — Hancitor Cuba Ransomware (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Hancitor (report)
- muha2xmad.github.io — Hancitor (report)
- Mandiant — Hancitor Aka Chanit (report)
- github.com — Hancitor.Ipynb (report)
- isc.sans.edu — 26980 (report)
- researchcenter.paloaltonetworks.com — Unit42 Vb Dropper And Shellcode For Hancitor Reveal New Techniques Behind Uptick (report)
- researchcenter.paloaltonetworks.com — Unit42 Pythons And Unicorns And Hancitoroh My Decoding Binaries Through Emulation (report)
- elis531989.medium.com — Dissecting And Automating Hancitors Config Extraction 1A6Ed85D99B8 (report)
- blog.minerva-labs.com — New Hancitor Pimp My Downloader (report)
- muha2xmad.github.io — Fullhancitor (report)
- dodgethissecurity.com — Hancitor Evasive New Waves And How Com Objects Can Use Cached Credentials For Proxy Authentication (report)
- 0ffset.net — Reversing Hancitor Again (report)
- researchcenter.paloaltonetworks.com — Unit42 Compromised Servers Fraud Accounts Recent Hancitor Attacks (report)
- inquest.net — Unearthing Hancitor Infrastructure (report)
- 0ffset.net — Hancitor Maldoc Analysis (report)
- proofpoint.com — Hancitor Ruckguv Reappear (report)
- 0ffset.net — Hancitor Analysing The Main Loader (report)
- vkremez.com — Lets Learn In Depth Reversing Of (report)
- vmray.com — Hancitor Multi Step Delivery Process Malware Analysis Spotlight (report)
- fidelissecurity.com — Me And Mr Robot Tracking Actor Behind Man1 Crypter (report)
- uperesia.com — Hancitor Packer Demystified (report)
- zscaler.com — Chanitor Downloader Actively Installing Vawtrak (report)