Extracted

• • Target
    SETUP$.zip
  • Size 6.0MB
  • SHA256 bf5fc88c84a9883179bd74f5ba708b6f471b5b25b06acb13b24985fc37e0a5f6
  • MD5 17b8ba33e9ecf78ee0c0e656e75e47da
  • SHA1 aca8d3b1ab3e36812b779df2919afb7d0b6f90ec
  • SHA512 ade105592d2a25d9c6432db88121dcf835a401d5c62e9e100504902ea8a95cefcf472a217f4fb301b079a58e85c64e931d4bb99df263df8bc07430bfddcb4f7e
  • SSDEEP 196608:G0hWzO6Jp7QwoRVH0Ix6XI3WG9e7NdO3NC7y+:Gtzuwo3UIx6XI3WrBqWr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  hijackloadershark_stealerdefense_evasiondiscoveryloaderspywarestealertrojan

  • Detects HijackLoader (aka IDAT Loader)

  • Detects SharkStealer payload

  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader

  • Hijackloader family

    hijackloader

  • SharkStealer

    SharkStealer is a stealer written in Golang.

    stealershark_stealer

  • Shark_stealer family

    shark_stealer

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1