Extracted

• • Target

    5aa49622f3dafc184f903b7b78a2fd68.exe

  • Size

    8.4MB

  • MD5

    5aa49622f3dafc184f903b7b78a2fd68

  • SHA1

    28fd3345d82da0cdb565a11c648aff196f03d770

  • SHA256

    285493c54c35e3b571e28fc0816baa4b3833329eeec3649601dd6385a60c8d84

  • SHA512

    fa7c3e619eb64355927fe4fe9ce925abba4c185b85816589a8e3bdf3ca7f0e73bb6c0ca939aa3699b29085f6d694eaf90f2224446156b80839d960a997b64d6d

  • SSDEEP

    98304:YajcsQ5SggQZWfV1bihqdq7mXxUHp/nIaWl49u8cSu+A05TeKY7:cs3amByp/IpS9ASu+K

  Score

  10^/10

  hijackloaderstealcloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2