0cd79ede283ad757cbc2a167d27e68e49a8657997265f94c2efb78ad9f0d7f54

General

Target
2026-04-21_8fe044d72c378113da6b6a482d6f03cf_elex_hijackloader_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn
Size 11.8MB
Sample260421-eqhzkshv5n
SHA256 0cd79ede283ad757cbc2a167d27e68e49a8657997265f94c2efb78ad9f0d7f54
MD5 8fe044d72c378113da6b6a482d6f03cf
SHA1 7c02b1a7a0377addb95a9428a7778a57e2f64834
SHA512 47460d75462fe449148e7afe5d4efc2762bf8a9850a156469d5a26315d2741d4a974d43c38270d43f3bd8e2cdb0c11910ae0b850f8b2deb5c03bf4f36f8a3709
SSDEEP 196608:s/5p+6e05RM1a4+nlWa04WcNMnfZUT1JhH/TbrqafM3wZDUUDMBdD2pewf2RKj0:OxeCRM1a4SXpwQ1fL3q7AZIvdKpb+S0
TLSH
T1B5C63307F870886BE96089F58CB0D97A69057D16C7001B07B7AB7EA939F524739B213F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-04-21_8fe044d72c378113da6b6a482d6f03cf_elex_hijackloader_manuscrypt_redline-stealer_rhadamanthys_stop_swisyn
- Size 11.8MB
- SHA256 0cd79ede283ad757cbc2a167d27e68e49a8657997265f94c2efb78ad9f0d7f54
- MD5 8fe044d72c378113da6b6a482d6f03cf
- SHA1 7c02b1a7a0377addb95a9428a7778a57e2f64834
- SHA512 47460d75462fe449148e7afe5d4efc2762bf8a9850a156469d5a26315d2741d4a974d43c38270d43f3bd8e2cdb0c11910ae0b850f8b2deb5c03bf4f36f8a3709
- SSDEEP 196608:s/5p+6e05RM1a4+nlWa04WcNMnfZUT1JhH/TbrqafM3wZDUUDMBdD2pewf2RKj0:OxeCRM1a4SXpwQ1fL3q7AZIvdKpb+S0
- TLSH
  T1B5C63307F870886BE96089F58CB0D97A69057D16C7001B07B7AB7EA939F524739B213F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery persistence phishing privilege_escalation spyware stealer
- Modifies visibility of hidden/system files in Explorer
  defense_evasion
- Custom signature
  
  Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Custom signature
  
  Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Drops file in Drivers directory
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2