Extracted

• • Target

    ZoomMeetings.exe

  • Size

    170.3MB

  • MD5

    f29bda123b1f5a34269116a30053ba05

  • SHA1

    18883525e62afcdebaa4449b986a631c2086c549

  • SHA256

    dcbb21552ba0d2d59e7d3c7d8fc746287a3d716e03ee43f46496eda931d880d4

  • SHA512

    e675b6f9e6ec6e04e7256114e3c9baa8f370b254d6192f71484170700c7b1311ac2dd5268188e97cb05091b33f92cb377cf720dbc2de98030cd22835d04814df

  • SSDEEP

    786432:UCRzGLMBtpQshlXi9vnrXNAYKCxoQ4MAXGoJ7tpaXc+Ex8C93CfhMtc3jJdDTvuH:UUGwPXy9vucoDMI8Xc223Sp6H

  Score

  10^/10

  hijackloaderrhadamanthysstealcdiscoveryloaderstealer

  • Detects HijackLoader (aka IDAT Loader)

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2