Extracted

• • Target

    2temp356.exe

  • Size

    7.6MB

  • MD5

    4c7fa6d1969c22e6eb4423e61b5362bf

  • SHA1

    cb8c74194e13b0c45378f2d6e306c93bf426295f

  • SHA256

    9c6d82574506dff981e52381327a153a5a989dfaa74c8a080473575f050395b2

  • SHA512

    5c98c3999b7e84a7f0e4fe01ffb116da6dce16fcdce5cec1afeceaaeab67e889858c984af57babc0ececa966c497e05c5b9f4efb2ac6baa337adc8d27d780c45

  • SSDEEP

    196608:oJTLQirzOtf8Inwg3TafmeZjYYRvoBZ1XchFky4QdQoFs4FxFbVI:oJTLFzOtf8Inwg3TafmeZjYYRoBZ9cK9

  Score

  10^/10

  hijackloaderstealcbenjiworld29credential_accessdiscoveryloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2