Extracted

• • Target

    40122c3fc307277bbcb516dce390f74f27e2f798cb351.exe

  • Size

    5.6MB

  • MD5

    07dd73909e1a74b92498058afc918ede

  • SHA1

    2f3f9ab4f17ccd2dfe0c4aada522b00c580c454d

  • SHA256

    40122c3fc307277bbcb516dce390f74f27e2f798cb351a692f820ba7d3ffd735

  • SHA512

    97f66cd575203cfbd0d584475c6696b160071e95466e5dde8b71d66138108f0b4d544af24706720960509fd7fd21bef07e443995457de3805168672844901853

  • SSDEEP

    98304:XUd9wETbKHs4+b4EmeICxgHxC6qz1loJoYFqQ5dn6uqhAoCVtxnz+oEIWoJd:MwgbKM44YCxwxmzLOFfdrq+P/xnCoEIh

  Score

  10^/10

  hijackloaderstealcmeowsterioland29credential_accessdiscoveryloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2