Extracted

• • Target

    0f81e4f98ae30a8c891b17872789cd5c0669bec05b6d4f99f9835fbcdb67b0ce.msi

  • Size

    27.3MB

  • MD5

    f57bed58fae51b1eb360d11ffb042859

  • SHA1

    18d49f590fec35f5f07a8a9ed7ede776cdfbf412

  • SHA256

    0f81e4f98ae30a8c891b17872789cd5c0669bec05b6d4f99f9835fbcdb67b0ce

  • SHA512

    e71e09070cd37ba84fee17ba47c74c25b1d38408cf94a136cf6f42ee6df50f96d7bc5b33bd49729d5090fdade6e05678175bf49aa9474b1f93f2ea75d8e83f1d

  • SSDEEP

    786432:h6JCD0rr9pQLq9jRbfQrP6sJ/xxLbxGrSU4+u:ArrHQLMf1O/xRorSU

  Score

  10^/10

  discoverypersistenceprivilege_escalationhijackloaderremcosv2loaderrat

  • Detects HijackLoader (aka IDAT Loader)

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Hijackloader family

    hijackloader

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • Use of msiexec (install) with remote resource

  • Adds Run key to start application

    persistence

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2