2019-07-02 - QUICK POST: HANCITOR INFECTION WITH COBALT STRIKE
- 2019-07-02-Hancitor-malspam-example.eml.zip 2.3 kB (2,300 bytes)
- 2019-07-02-Hancitor-infection-traffic.pcap.zip 495 kB (494,788 bytes)
- 2019-07-02-Hancitor-malware-and-artifacts.zip 364 kB (363,922 bytes)
- Since Monday 2019-07-01, Hancitor infections have included Cobalt Strike activity as noted by @James_inthe_box, @VK_Intel, and others (Twitter link).
- Today's Hancitor infection also shows signs of Cobalt Strike activity.
- Zip archives are password-protected with the standard password. If you don't know it, see the "about" page of this website.
Click here to return to the main page.