Hancitor Malware Operation Monitoring

Presented at THOTCON 0x9 (2018), May 5, 2018, 11 a.m. (25 minutes).

Hancitor, a commodity malware downloader, continues to be an active threat to the average user and enterprise network. During the primary 2017 campaigns of the hancitor downloader, a particular focus was placed on attempting to track and monitor the operations behind the actor and malware deployment. This includes tracking the hancitor delivery approach, victim details, and potential leads of attribution with the help of OPSEC negligence. In this talk, we will discuss and share the findings of the research with the community in an effort to facilitate collaboration. Specifically we will review shifts in tooling, an understanding of the attacker approach, infrastructure, in addition to providing recommendations for limiting attacker benefit via public exposure of analyst findings.

Presenters:

• Tom Hegel
  Sr. Threat Researcher at ProtectWise 401TRG. Focused on network traffic analysis and IR with a particular speciality in threat intelligence.

Similar Presentations:

• 44CON 2016 / The Malware CAPE: Automated Extraction of Configuration and Payloads from Sophisticated Malware
• ekoparty 14 (2018) / To Execute or Not to Execute. How to Build a Malware Execution Lab
• DerbyCon 3.0 All in the Family (2013) / The Malware Management Framework, a process you can use to find advanced malware. We found WinNTI with it!