Skip to content

Hancitor

Software · ATTACK:enterprise:S0499

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0499",
  "title": "Hancitor",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0499",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--ef2247bf-8062-404b-894f-d65d00564817",
  "external_id": "S0499",
  "domain": "enterprise",
  "created": "2020-08-12T19:32:56.301Z",
  "modified": "2025-04-25T14:45:01.455Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Chanitor"
    },
    {
      "source_name": "Threatpost Hancitor",
      "url": "https://threatpost.com/spammers-revive-hancitor-downloader-campaigns/123011/"
    },
    {
      "source_name": "FireEye Hancitor",
      "url": "https://www.fireeye.com/blog/threat-research/2016/09/hancitor_aka_chanit.html"
    }
  ]
}

Explicit source assertions (14)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d56986b-e6fd-4624-87b4-5e0dd9f05c2f

FireEye Hancitor

ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1218.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--331c41dc-7452-4328-a370-7556f659e8cb

Red Canary Verclsid.exe

ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34935ccb-b800-4c24-81de-4923ccd7c4ec

FireEye Hancitor

ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d902953-306b-48d4-be7b-f08030ecb62e

Threatpost Hancitor

ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--471304cd-f98a-49f7-a33e-2d69ab6c8a47

Threatpost Hancitor

ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51fb8815-6f59-46ff-8f7a-98025623db76

FireEye Hancitor

ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--554fbee8-58a9-4557-bf49-f1df2c5da442

FireEye Hancitor

ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57c700c6-e301-4433-84bd-722934f9d922

FireEye Hancitor

ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a54aabe-e485-4a01-b284-cb080b11582b

FireEye Hancitor

ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1566.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1b55dea-5e5d-4cff-bfac-5880507389c1

Threatpost Hancitor

ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8fb4459-4352-4ee6-bfaf-a97be333bf64

Threatpost Hancitor

ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f58a02ed-055f-461f-bfdf-067f07310423

FireEye Hancitor

ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1497

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f60f8552-3c43-4b43-ad23-2b00b6172b00

FireEye Hancitor

ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ffecf9e6-6966-4535-934f-4fd4696875b0

Threatpost Hancitor · FireEye Hancitor

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.