General

  • Target
    brokerfoundation_x86.zip
  • Size 4.4MB
  • Sample260508-e8ae6agt9q
  • SHA256 c3cacea1d8117f1465079b670feb28620a2e5316113296b097f9f9d219e52165
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Family
  • hijackloader

Attributes
  • directory

    %APPDATA%\brokerfoundation_x86

  • inject_dll

    %windir%\SysWOW64\input.dll

xor.hex

Signatures

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • Codesign digest Mismatch 2 IoCs

    File was altered after it was signed.

  • DLL Hijacking vulnerability 2 IoCs

    Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.

File Explorer

  • brokerfoundation_x86.zip
    .zip 4.4MB
  • brokerfoundation_x86/Termin-Distributed32.exe
    .exe 2.2MB
  • brokerfoundation_x86/adapter_patch.map
    27KB
  • brokerfoundation_x86/datastate.dll
    .dll 77KB
  • brokerfoundation_x86/msvcp_win.dll
    .dll 485KB
  • brokerfoundation_x86/particleimpl28.toml
    2.3MB
  • brokerfoundation_x86/sqlite3.dll
    .dll 682KB
  • brokerfoundation_x86/ucrtbase.dll
    .dll 1.1MB

brokerfoundation_x86.zip

  • SHA256 c3cacea1d8117f1465079b670feb28620a2e5316113296b097f9f9d219e52165
  • MD5 SHA1 SHA512 SSDEEP TLSH