Extracted

• • Target

    0ba52a085647724ae6b56e29bab4af6e.exe

  • Size

    5.6MB

  • MD5

    0ba52a085647724ae6b56e29bab4af6e

  • SHA1

    1ee26f6cb803f456ba019ebae8eb818f0e48a962

  • SHA256

    a834be6d2bec10f39019606451b507742b7e87ac8d19dc0643ae58df183f773c

  • SHA512

    3e134ccc89d9c7ad7921cbcce9ff139e2ce0f9cb10471c5410215a331dd7ad4bda365cb8f4369e5a8200c7662a31126b4a8e9de354e1c5df5093a5740f93d645

  • SSDEEP

    98304:UUd9YlH/tdi0YUxHs4+b4EmeICxgHxC6qz1loJoYFqQ5dn6uqhAoCVtxnz+oEIW2:5Y51E0YUxM44YCxwxmzLOFfdrq+P/xnF

  Score

  10^/10

  hijackloaderstealcsneprivate29credential_accessdiscoveryloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2