hijackloader | 807675A50EE7545E02DAEAC9822842B7[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
807675A50EE7545E02DAEAC9822842B7.exe
Size 922KB
Sample240501-q36rysac74
SHA256 2895f26ebeb8334731591ac868e9ab554a3568632e3c62e802739e5d0fc38d88
MD5 807675a50ee7545e02daeac9822842b7
SHA1 967094e1ef9155a031687396ba99855e54870612
SHA512 12a928dc23e7fd03996e5d41d8fce1d091b0fa979d379e63e6e89d58440f8a21a809a646e1c6431eda68d71515e1aed06219c4f3d8c0c86e25724b1d6e5af5b4
SSDEEP 24576:e8inPEBCZN5hoVlnJXzJ/SEVSoMAALia4:Dg5BuxF/SRF4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hijackloader

Malware Config

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
sample	family_hijackloader

Hijackloader family
hijackloader

File Explorer

807675A50EE7545E02DAEAC9822842B7.exe

.exe 922KB

807675A50EE7545E02DAEAC9822842B7.exe

IMPHASH 5f7bf97ec922bad10bc4de737ab257ee
SHA256 2895f26ebeb8334731591ac868e9ab554a3568632e3c62e802739e5d0fc38d88
MD5 807675a50ee7545e02daeac9822842b7
SHA1 967094e1ef9155a031687396ba99855e54870612
SHA512 12a928dc23e7fd03996e5d41d8fce1d091b0fa979d379e63e6e89d58440f8a21a809a646e1c6431eda68d71515e1aed06219c4f3d8c0c86e25724b1d6e5af5b4
SSDEEP 24576:e8inPEBCZN5hoVlnJXzJ/SEVSoMAALia4:Dg5BuxF/SRF4
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects HijackLoader (aka IDAT Loader)

PE Signature issue

Digest

db:99:5a:20:85:80:93:01:94:94:5e:bf:a0:df:af:12:c9:d4:38:24:ec:b4:aa:4c:71:e4:15:62:64:bf:23:2f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Open Source Developer\, Jonas Günner,O=Open Source Developer,L=Uelzen,ST=Niedersachsen,C=DE,1.2.840.113549.1.9.1=#0c11696e666f406578706c6f69746f782e6465

Chains

Apr 30, 2024

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Certum Timestamp 2022,O=Asseco Data Systems S.A.,C=PL

Serial Number

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 28, 2022 - Jul 27, 2033

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Open Source Developer\, Jonas Günner,O=Open Source Developer,L=Uelzen,ST=Niedersachsen,C=DE,1.2.840.113549.1.9.1=#0c11696e666f406578706c6f69746f782e6465

Serial Number

66:06:f7:6c:f0:0b:c5:4e:b3:26:0e:6e:1b:c7:00:74

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2022 - Aug 24, 2023

Minor OS version

Major OS version

Entry point

66960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\apphost\standalone\apphost.pdb

kernel32

FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection GetEnvironmentVariableW FindClose MultiByteToWideChar GetLastError GetFileAttributesExW GetFullPathNameW GetProcAddress DeleteCriticalSection WideCharToMultiByte IsWow64Process LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc EnterCriticalSection FindFirstFileExW OutputDebugStringW LoadLibraryA GetModuleHandleW InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlUnwind InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsDebuggerPresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _invalid_parameter_noinfo_noreturn __p___argc __p___wargv _exit exit _initterm_e _errno _initterm _get_initial_wide_environment _c_exit _configure_wide_argv _controlfp_s _set_app_type _register_onexit_function _register_thread_local_exe_atexit_callback _initialize_onexit_table abort _cexit _initialize_wide_environment terminate _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsprintf_s setvbuf __stdio_common_vswprintf __acrt_iob_func fputwc __p__commode fputws __stdio_common_vsnwprintf_s _wfsopen fflush __stdio_common_vfwprintf

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc calloc

api-ms-win-crt-string-l1-1-0

wcsnlen strcpy_s _wcsdup strcspn wcsncmp toupper

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-locale-l1-1-0

__pctype_func _unlock_locales _lock_locales ___lc_locale_name_func ___lc_codepage_func ___mb_cur_max_func _configthreadlocale setlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr frexp

api-ms-win-crt-time-l1-1-0

_gmtime64_s wcsftime _time64

Sharing

General

Malware Config

Signatures

File Explorer

807675A50EE7545E02DAEAC9822842B7.exe

PE Signature issue

kernel32

user32

shell32

advapi32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

generic