General

  • Target
    SETUP.zip
  • Size 20.6MB
  • Sample251025-sdlftsew4c
  • SHA256 4711b42d7f1cbde77eb1f26150bb4f93462f6c0f39027a1acd08c7dc09303269
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Family
  • hijackloader

Attributes
  • directory

    %APPDATA%\proserver

  • inject_dll

    %windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • Hijackloader family
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Codesign digest Mismatch 2 IoCs

    File was altered after it was signed.

  • DLL Hijacking vulnerability 1 IoCs

    Signed PE file loads submitted unsigned PE file, allowing DLL Hijacking/Side Loading.

  • Insecure Codesign Algorithm 2 IoCs

    File was Codesigned using an insecure algorithm.

  • Untrusted Codesign Signers 1 IoCs

    Codesigned binary was signed by an untrusted entity.

File Explorer

  • SETUP.zip
    .zip 20.6MB
  • BugSplat.dll
    .dll 463KB
  • Dondbrartquoot.wrym
    1.6MB
  • Grickvis.ypyo
    31KB
  • LIBEAY32.dll
    .dll 1013KB
  • MSVCP140.dll
    .dll 451KB
  • MSVCR90.dll
    .dll 640KB
  • Setup.exe
    .exe 6.3MB
  • SoftwareLog.dll
    .dll 899KB
  • VCRUNTIME140.dll
    .dll 85KB
  • config.prx
    .exe 364KB
  • libcrypto-1_1.dll
    .dll 2.4MB
  • libcurl.dll
    .dll 1.4MB
  • opengl64.dll
    .exe 17.7MB
  • updater/NvStWiz.prx
    .exe 432KB
  • updater/manager/ks_tyres.ini
    9KB
  • x64/trading_api64.dll
    .dll 282KB
  • x64/tradingnetworkingsockets.dll
    .dll 4.1MB
  • x86/api-ms-win-core-processthreads-l1-1-1.dll
    .dll 17KB
  • x86/api-ms-win-core-profile-l1-1-0.dll
    .dll 16KB
  • x86/api-ms-win-core-rtlsupport-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-core-string-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-core-synch-l1-1-0.dll
    .dll 19KB
  • x86/api-ms-win-core-synch-l1-2-0.dll
    .dll 17KB
  • x86/api-ms-win-core-sysinfo-l1-1-0.dll
    .dll 18KB
  • x86/api-ms-win-core-timezone-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-core-util-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-crt-conio-l1-1-0.dll
    .dll 18KB
  • x86/api-ms-win-crt-convert-l1-1-0.dll
    .dll 21KB
  • x86/api-ms-win-crt-environment-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-crt-filesystem-l1-1-0.dll
    .dll 19KB
  • x86/api-ms-win-crt-heap-l1-1-0.dll
    .dll 18KB
  • x86/api-ms-win-crt-locale-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-crt-math-l1-1-0.dll
    .dll 26KB
  • x86/api-ms-win-crt-multibyte-l1-1-0.dll
    .dll 25KB
  • x86/api-ms-win-crt-private-l1-1-0.dll
    .dll 68KB
  • x86/api-ms-win-crt-process-l1-1-0.dll
    .dll 18KB

SETUP.zip

  • SHA256 4711b42d7f1cbde77eb1f26150bb4f93462f6c0f39027a1acd08c7dc09303269
  • MD5 SHA1 SHA512 SSDEEP