Extracted

• • Target

    app

  • Size

    542B

  • MD5

    ecb096de4aa7a595b66aad7838cc5115

  • SHA1

    64f67c3b8d9cd794d473726e57497b8e8d0c52f1

  • SHA256

    74fafcc357a95cf19078b2489e9b8e8713cccf2b83398ae4c331a30bb9d87934

  • SHA512

    2f91f1842606c7e70db93c21cdf66ad7f88564a76887f51456dd845d022a88d746136b7074492cbfbde296c900b5358d273af33c5c47b6c5c718afbc9e85efb6

  Score

  10^/10

  hijackloaderrhadamanthysstealcdiscoveryloaderspywarestealertag:discovery AND tag:spyware AND tag:stealer

  • Detects HijackLoader (aka IDAT Loader)

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Executes dropped EXE

  • Loads dropped DLL

  • NSIS Integrity Check function

    Stealc Info Stealer.

    tag:discovery AND tag:spyware AND tag:stealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2