^[2]

Hancitor has added Registry Run keys to establish persistence.^[2]

Hancitor has used PowerShell to execute commands.^[2]

Hancitor has decoded Base64 encoded URLs to insert a recipient’s name into the filename of the Word document.Hancitor has also extracted executables from ZIP files.^[1][2]

Hancitor has deleted files using the VBAkill function.^[2]

Hancitor has the ability to download additional files from C2.^[1]

Hancitor has usedCallWindowProc andEnumResourceTypesA to interpret and execute shellcode.^[2]

Hancitor has used Base64 to encode malicious links.^[1]

Hancitor has delivered compressed payloads in ZIP files to victims.^[2]

Hancitor has been delivered via phishing emails with malicious attachments.^[2]

Hancitor has been delivered via phishing emails which contained malicious links.^[1]

Hancitor has used verclsid.exe to download and execute a malicious script.^[3]

Hancitor has relied upon users clicking on a malicious link delivered through phishing.^[1]

Hancitor has used malicious Microsoft Word documents, sent via email, which prompted the victim to enable macros.^[2]

Hancitor has used a macro to check that an ActiveDocument shape object in the lure message is present. If this object is not found, the macro will exit without downloading additional payloads.^[2]