hijackloader | c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a

Resubmissions

15/06/2026, 09:29

260615-lfzb5sas413

10/06/2026, 13:27

260610-qp66kaaz713

21/04/2026, 04:38

260421-e9qhrshx4j10

Sharing

Copy URL Twitter E-mail

General

Target
Crisp.exe
Size 334KB
Sample260421-e9qhrshx4j
SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
MD5 5f9f88c9a16b62dc38504549e93d3667
SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
TLSH
T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\edge_32_dbg
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Targets

- Target
  Crisp.exe
- Size 334KB
- SHA256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8a
- MD5 5f9f88c9a16b62dc38504549e93d3667
- SHA1 587d56031b39e34102bc67b5f7d0338ee41b5328
- SHA512 edbb7a8cd75e056d2c47b8af6fbee63726cb3d5f000d5f8bc000f4b16366619c8532e628585cc943f474d2509c63802179d0d22a1d32dd690fb25e00d262af83
- SSDEEP 6144:7c2XFRJ3DNuzAOS9FuxIRtiiuhKPTqX4Y42:dFvYzU9kutRuhKPTqo32
- TLSH
  T125749E11B9D1C4B2C4B2053009E8EBB5697DFD714F61863B33D8772E1F742C1A662AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery hijackloader loader ransomware
- Detects HijackLoader (aka IDAT Loader)
- Family: HijackLoader, IDAT loader, Ghostulse,
  HijackLoader is a multi-stage loader, first seen in 2023.
  loader hijackloader
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Detects HijackLoader (aka IDAT Loader)

Family: HijackLoader, IDAT loader, Ghostulse,

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2