hijackloader | 0ba52a085647724ae6b56e29bab4af6e[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
0ba52a085647724ae6b56e29bab4af6e.exe
Size 5.6MB
Sample241003-vctf6azale
SHA256 a834be6d2bec10f39019606451b507742b7e87ac8d19dc0643ae58df183f773c
MD5 0ba52a085647724ae6b56e29bab4af6e
SHA1 1ee26f6cb803f456ba019ebae8eb818f0e48a962
SHA512 3e134ccc89d9c7ad7921cbcce9ff139e2ce0f9cb10471c5410215a331dd7ad4bda365cb8f4369e5a8200c7662a31126b4a8e9de354e1c5df5093a5740f93d645
SSDEEP 98304:UUd9YlH/tdi0YUxHs4+b4EmeICxgHxC6qz1loJoYFqQ5dn6uqhAoCVtxnz+oEIW2:5Y51E0YUxM44YCxwxmzLOFfdrq+P/xnF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hijackloader

Malware Config

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
sample	family_hijackloader

Hijackloader family
hijackloader

File Explorer

0ba52a085647724ae6b56e29bab4af6e.exe

.exe 5.6MB

0ba52a085647724ae6b56e29bab4af6e.exe

IMPHASH c3e91fbd563a72c79722e447bd1614b5
SHA256 a834be6d2bec10f39019606451b507742b7e87ac8d19dc0643ae58df183f773c
MD5 0ba52a085647724ae6b56e29bab4af6e
SHA1 1ee26f6cb803f456ba019ebae8eb818f0e48a962
SHA512 3e134ccc89d9c7ad7921cbcce9ff139e2ce0f9cb10471c5410215a331dd7ad4bda365cb8f4369e5a8200c7662a31126b4a8e9de354e1c5df5093a5740f93d645
SSDEEP 98304:UUd9YlH/tdi0YUxHs4+b4EmeICxgHxC6qz1loJoYFqQ5dn6uqhAoCVtxnz+oEIW2:5Y51E0YUxM44YCxwxmzLOFfdrq+P/xnF
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detects HijackLoader (aka IDAT Loader)

PE Signature issue

Digest

eb:14:49:d3:36:fb:41:52:43:c9:aa:ad:7c:4d:53:c0:37:8c:e2:b3:08:25:76:f4:34:e4:7c:aa:e6:0d:66:10

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=FastCopy Lab\, LLC.,O=FastCopy Lab\, LLC.,ST=Kanagawa,C=JP

Chains

Aug 12, 2024

CN=FastCopy Lab\, LLC.,O=FastCopy Lab\, LLC.,ST=Kanagawa,C=JP

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=FastCopy Lab\, LLC.,O=FastCopy Lab\, LLC.,ST=Kanagawa,C=JP

Serial Number

56:21:cb:0b:b7:52:7f:9b:05:d2:ee:53:99:51:59:80

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 22, 2021 - Sep 27, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

250443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\FastCopy\src\install\Obj\ReleaseInst\setup.pdb

kernel32

ReadFile FindFirstFileW FindNextFileW WriteFile FindClose WaitForSingleObject CreateFileW DeleteFileW CloseHandle GetLocalTime GetFileSize GetSystemTimeAsFileTime CreateDirectoryW GetCommandLineW GetFullPathNameW RemoveDirectoryW GetModuleFileNameW GetFileAttributesW GetCurrentDirectoryW SetCurrentDirectoryW GetProcAddress CreateProcessW FreeLibrary CopyFileW SetDllDirectoryW MoveFileW GetEnvironmentVariableW VirtualProtect EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetTempPathW Sleep GetLastError SetEvent GetVersionExA DeleteCriticalSection GetModuleHandleW GetEnvironmentStringsW GetStdHandle WriteConsoleA OutputDebugStringA GetCurrentThreadId AttachConsole OutputDebugStringW WriteConsoleW GetFileType InterlockedIncrement GetTickCount SetThreadLocale SetLastError GetCurrentProcess GetSystemDirectoryW OpenProcess CreateToolhelp32Snapshot Process32NextW GetUserDefaultLCID Process32FirstW LoadLibraryW GetCurrentProcessId MultiByteToWideChar MoveFileExW WideCharToMultiByte ExitProcess SetFileTime UnmapViewOfFile GetFileAttributesExW CreateFileMappingA MapViewOfFile GetFileTime GetModuleFileNameA SetEndOfFile RaiseException CreateThread SetUnhandledExceptionFilter GetSystemInfo VirtualQuery LoadLibraryExA GetStringTypeW EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwind LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetACP HeapFree HeapAlloc HeapReAlloc IsValidLocale EnumSystemLocalesW FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA FreeEnvironmentStringsW GetProcessHeap SetStdHandle FlushFileBuffers GetConsoleCP GetConsoleMode HeapSize SetFilePointerEx ReadConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

0ba52a085647724ae6b56e29bab4af6e.exe

PE Signature issue

kernel32

generic