Extracted

• • Target

    Predictor7.117.msi

  • Size

    2.9MB

  • MD5

    5bac811249b2f91a6d769cd4af4154e2

  • SHA1

    911195edb41cd320d5538fa5560f0bd18eb6c11f

  • SHA256

    289266f50512ab914e578d5ce34352d297983fe303edd7b211521e94e4db7ca7

  • SHA512

    e38653ed324d2f764c06685a791ebf28f2ba9864d960fab104c91c86f831a7037f2a627e9048b49b5b9258a31165c3a9147be15b822ae50e0d8d9c8d2dd73cda

  • SSDEEP

    49152:kwfjkMo27Epq0n8Toc4Ug8r6F5mCmR+w+TzMShkkcr4u12X8ecau3aLSQlq8HoBu:lYn8ToBo6bqrnbecauKLO8IG/d

  Score

  10^/10

  discoverypersistenceprivilege_escalationhijackloaderremcosv2loaderrat

  • Detects HijackLoader (aka IDAT Loader)

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Hijackloader family

    hijackloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Use of msiexec (install) with remote resource

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2