Extracted

• • Target

    98BC892EA45510099A0B91646A3A0A4E.exe

  • Size

    1.3MB

  • MD5

    98bc892ea45510099a0b91646a3a0a4e

  • SHA1

    75b11dc9b520e53ef6ec9009afdf8e41fdaa0e09

  • SHA256

    d72e2b176358299b9d09c11b3d654e575777d96beac99e9c1ccebe5ab2523c24

  • SHA512

    a43683bfc093803859175115af427babfc8e7a35d3a9da24ff0aca54161b34f43cc4c566d06b3169c304532dbeb67ee6f366d0fa62b01f08f82b67f8cd1c4dec

  • SSDEEP

    24576:xtneZf0GdlLQXjOrBcDQmTNpuTg+uKlGp0B0WbCWyOVyOckiAhUcMkiAhUcXuUP:xtexLQTOmDlNpEhB0crVriKUXKUXUP

  Score

  10^/10

  hijackloaderstealccozy7loaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2