Extracted

• • Target
    AIGenerate.exe
  • Size 7.2MB
  • SHA256 387c0b928b4211897c14214aa84cfcb8203a4724a120db336748f1752c4068a4
  • MD5 9531f262e1a22b7739d3ecea32d7754e
  • SHA1 bdc6e0b7d49765d3ac116d0d70502fa422742c0c
  • SHA512 41a53c8e6300835cc52e7868b74b1ced90d761e18374ff61fac8d8a34f15b05b4a18ff7511881e36cdc4a1cd708dab4fe4d15cf15fca80af16901d38d663044e
  • SSDEEP 196608:PUk3u709vLJzMRm5a8yop6QtBerVVAHP5h:h+Q9t+waG1tBln
  • TLSH
    T11C7633216B830676E3D95675903294B86D1B3DB81BE7E05F2C79FB4C04B6B828837E53
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydeerstealerdonutloaderhijackloaderinstallerloaderspywarestealer

  • DeerStealer

    DeerStealer is a sophisticated information stealer written in C++.

    stealerdeerstealer

  • Deerstealer family

    deerstealer

  • Detects DeerStealer

    stealer

  • Detects DonutLoader

    loader

  • Detects HijackLoader (aka IDAT Loader)

  • DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Donutloader family

    donutloader

  • HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Hijackloader family

    hijackloader

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2