hijackloader | 63826a55c4068856273858fd7537d57543df7d713426866d9b8df566ccbe8f35

Sharing

Copy URL Twitter E-mail

General

Target
63826a55c4068856273858fd7537d57543df7d713426866d9b8df566ccbe8f35
Size 5.6MB
Sample241007-ynzn4awdpf
SHA256 63826a55c4068856273858fd7537d57543df7d713426866d9b8df566ccbe8f35
MD5 4d93ef870fb716fc1b3e05548d41d528
SHA1 ae2d44dfb6ad8a7d1e38d7b7f368ffa4763265c9
SHA512 b00184c4fa30d6d9ae8e7365925ecfa2d87c22e21ef609bc2ce135d998668da79671d2839508674ad638859b35af38f14d3752ec767b5cbc4a8c292e011c57fe
SSDEEP 98304:UUd9FTuBYxHs4+b4EmeICxgHxC6qz1loJoYFqQ5dn6uqhAoCVtxnz+oEIWoJd:5FTnM44YCxwxmzLOFfdrq+P/xnCoEIW2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hijackloader

Malware Config

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
sample	family_hijackloader

Hijackloader family
hijackloader

File Explorer

63826a55c4068856273858fd7537d57543df7d713426866d9b8df566ccbe8f35

.exe 5.6MB

63826a55c4068856273858fd7537d57543df7d713426866d9b8df566ccbe8f35

IMPHASH c3e91fbd563a72c79722e447bd1614b5
SHA256 63826a55c4068856273858fd7537d57543df7d713426866d9b8df566ccbe8f35
MD5 4d93ef870fb716fc1b3e05548d41d528
SHA1 ae2d44dfb6ad8a7d1e38d7b7f368ffa4763265c9
SHA512 b00184c4fa30d6d9ae8e7365925ecfa2d87c22e21ef609bc2ce135d998668da79671d2839508674ad638859b35af38f14d3752ec767b5cbc4a8c292e011c57fe
SSDEEP 98304:UUd9FTuBYxHs4+b4EmeICxgHxC6qz1loJoYFqQ5dn6uqhAoCVtxnz+oEIWoJd:5FTnM44YCxwxmzLOFfdrq+P/xnCoEIW2
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detects HijackLoader (aka IDAT Loader)

PE Signature issue

Digest

8d:ac:6b:0f:75:f7:dd:69:70:04:dc:f5:0a:8c:f2:a1:66:10:ef:bc:bf:87:f6:9d:c5:51:27:3d:1d:42:4d:53

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=FastCopy Lab\, LLC.,O=FastCopy Lab\, LLC.,ST=Kanagawa,C=JP

Chains

Aug 12, 2024

CN=FastCopy Lab\, LLC.,O=FastCopy Lab\, LLC.,ST=Kanagawa,C=JP

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=FastCopy Lab\, LLC.,O=FastCopy Lab\, LLC.,ST=Kanagawa,C=JP

Serial Number

56:21:cb:0b:b7:52:7f:9b:05:d2:ee:53:99:51:59:80

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 22, 2021 - Sep 27, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

250443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\FastCopy\src\install\Obj\ReleaseInst\setup.pdb

kernel32

ReadFile FindFirstFileW FindNextFileW WriteFile FindClose WaitForSingleObject CreateFileW DeleteFileW CloseHandle GetLocalTime GetFileSize GetSystemTimeAsFileTime CreateDirectoryW GetCommandLineW GetFullPathNameW RemoveDirectoryW GetModuleFileNameW GetFileAttributesW GetCurrentDirectoryW SetCurrentDirectoryW GetProcAddress CreateProcessW FreeLibrary CopyFileW SetDllDirectoryW MoveFileW GetEnvironmentVariableW VirtualProtect EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetTempPathW Sleep GetLastError SetEvent GetVersionExA DeleteCriticalSection GetModuleHandleW GetEnvironmentStringsW GetStdHandle WriteConsoleA OutputDebugStringA GetCurrentThreadId AttachConsole OutputDebugStringW WriteConsoleW GetFileType InterlockedIncrement GetTickCount SetThreadLocale SetLastError GetCurrentProcess GetSystemDirectoryW OpenProcess CreateToolhelp32Snapshot Process32NextW GetUserDefaultLCID Process32FirstW LoadLibraryW GetCurrentProcessId MultiByteToWideChar MoveFileExW WideCharToMultiByte ExitProcess SetFileTime UnmapViewOfFile GetFileAttributesExW CreateFileMappingA MapViewOfFile GetFileTime GetModuleFileNameA SetEndOfFile RaiseException CreateThread SetUnhandledExceptionFilter GetSystemInfo VirtualQuery LoadLibraryExA GetStringTypeW EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwind LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetACP HeapFree HeapAlloc HeapReAlloc IsValidLocale EnumSystemLocalesW FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA FreeEnvironmentStringsW GetProcessHeap SetStdHandle FlushFileBuffers GetConsoleCP GetConsoleMode HeapSize SetFilePointerEx ReadConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

63826a55c4068856273858fd7537d57543df7d713426866d9b8df566ccbe8f35

PE Signature issue

kernel32

generic