216.73.217.86

Indicator (IOC)

stix Revoked AlienVault · Published 20/12/2025 19:38 · Modified 20/12/2025 23:42

Essential information

Value / Name
48d5dcbc16d7c1712328ad7c397e564e62b4ec0794a21073c64e1d07c5518bbe
Confidence
100/100
Revoked
Yes
Valid from
28/03/2023 18:46
Valid until
30/06/2024 18:46
Pattern type
stix
Published
20/12/2025 19:38
Modified
20/12/2025 23:42
Author / Source
AlienVault

Description

SLF:Trojan:Win32/HancitorMacroAgg.B SHA256 of 06adbb4ba31a52cc5c9258bf6d99812c

Pattern

[file:hashes.'SHA-256' = '48d5dcbc16d7c1712328ad7c397e564e62b4ec0794a21073c64e1d07c5518bbe']

Labels / Tags

Labels: apt-q-38 donot downloader phishing shellcode string encryption trojan vba code

Marking (TLP)

TLP:CLEAR

Related entities

Reports and intrusion sets linked to this IOC.

Intrusion sets (1)

  • DONOT
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 ·