H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Hancitor](https://attack.mitre.org/software/S0499) is a downloader that has been used by [Pony](https://attack.mitre.org/software/S0453) and other information stealing malware.(Citation: Threatpost Hancitor)(Citation: FireEye Hancitor)

Labels

malware

14 recorded

Relationships

uses

to Compression

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

to Native API

Technique

uses

to Obfuscated Files or Information

Technique

uses

to PowerShell

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to Verclsid

Technique

uses

to Virtualization/Sandbox Evasion

Technique

4 external

References

mitre-attack

S0499

open

Chanitor

—

Threatpost Hancitor

https://threatpost.com/spammers-revive-hancitor-downloader-campaigns/123011/

open

FireEye Hancitor

https://www.fireeye.com/blog/threat-research/2016/09/hancitor_aka_chanit.html

open