hijackloader | 9df42aaa68579729e9398e5f3f5e04b9a14c0911ebeb7491b943969cbd9eabfb

Sharing

Copy URL Twitter E-mail

General

Target
tmpdjewkudi.zip
Size 15.4MB
Sample260524-repzzaex9q
SHA256 9df42aaa68579729e9398e5f3f5e04b9a14c0911ebeb7491b943969cbd9eabfb
MD5 445edd337a3ee6c1147cc7712cc5e3d2
SHA1 f291f037a7e0b0033caaff6a6d2f305e6f9a876e
SHA512 c67c8958ef76260b52eb0e9c5ed0d405ca8cc8e18313b5321657c845ae91e80f1175b98bdb8546a83b042a8a577f8138b0fd680bcf7efb19384ab4faf898c206
SSDEEP 393216:/nu2WnjPn686PTvW9CU1Cr33rjENNw80837yq2Rz:/npTvW4U07nXG2qK
TLSH
T1DDF633F824D36EDA93CC8CBA529B77D542582E7258F0FB7C5E88114DDEFAA910403D86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\Ru
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Targets

- Target
  Library/AsAcpi.dll
- Size 117KB
- SHA256 0a4d601224d00f563c72f0be50508f9327f6ea87fcbb68b5ea689fe56659fa37
- MD5 e3c8c3c8fe87484c3ee7fd26edf72aa1
- SHA1 80e0c4b9305b3ecc22fd40c03a8f1b563eb98187
- SHA512 16216497ab3bfc07facf3a7e2c0bad5390fa6cb42cee0b9455e2f4f3de82685c8d699663526a999ee1aef5552dcd314a1a5a5ab16cff171fc71eb1df214fe934
- SSDEEP 1536:2aLGRhgw68lereZRYJUg03xnncQwYymkTeW36Dz+KA1EcE6u0rgoQCjpfljI/7st:bgh6CXYJ6XwNe86jAa6u0UoQCVpI/W
- TLSH
  T1B1C38D313180C432E49B087F8596C6769A6F78304B9999C7BFD446A98F617E2FF35382
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Library/Microsoft.DotNet.Interactive.Netstandard20.dll
- Size 273KB
- SHA256 f6cb94c3d8c833b7a7c40e29fb358c9c6eb2b01b48bc1b4326760722c5ceb8fd
- MD5 8836240e65b3a4d7841367cdbf7d9fab
- SHA1 13f9dd01858ff9791ebffaef4c3711eee7a517bc
- SHA512 3bd5c08bec8351639b17ff3401e63284fa08c7c2789e0d6ee44db63bf08750a987286813dbf157a62b75c154bd01e4501593c7baab4e1267d991504e6ebb5cd8
- SSDEEP 6144:EuVVWhlieQeGdhFvZOQ4Ct2lTSVLJ2362SJNH:EAcieQe+vZOpCt22l236/
- TLSH
  T106546C5563FC0722E2AFA779F07084414BB6E54BB466FB8E4C4CEDE82987B819900377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Library/Microsoft.Extensions.DependencyInjection.dll
- Size 198KB
- SHA256 aa2628ae0f5a65a9061a66f0d6d0102015eabcc4380e2be795c1296c8b74afca
- MD5 74d0246be2c488dd88c23e6720a80696
- SHA1 9d18c28566bfa86d9a07ae16e6e51141efa2ed5a
- SHA512 3b0e79fd83054e3b666baff9b527da31c07bbeaed665209b858657e0d4ff1adad3523b8a29b359bf4abc52cb4496abc368bd70cb1348465cabfb7ca4943b2468
- SSDEEP 3072:0WmoQMM+pkP/+N0STyd+BPCiefMUA/QdkNL2chW84fdvQclyWG3S9SdjwEgbQyuV:GodM+4/+N0STG+RQealHllGwkbAcV
- TLSH
  T1D1145A2793984343D36F6979C3279501E7B79486330192DF8A79EE401E87BC2BE7325A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Library/Microsoft.ServiceHub.Client.dll
- Size 614KB
- SHA256 4cf80889a27ebb70accba475774938cc19f50b662b3158fe50f4793ca77a3f8a
- MD5 5a24bfe5fcde819a347b6851053979a6
- SHA1 a9ef52c8d6bd33a5cbf5ce00f20e4fa326774fe4
- SHA512 37a0e34bb3290eb7bbd2bd219c28a28faa4148651e1c08226507f74ba363f67a212e2f1da969ad1cd728ce175da3ada050517f58f7bd92b83830db29bee12426
- SSDEEP 6144:FHhsyLuGP5mbk2crULwld0Ou3kvmIz0+EkVobmhJ39BQcq4sob0ek4FSFH6HloHk:lNCL7ORRVobm7YcqLik4qBu
- TLSH
  T1A7D43842A7B8BFFAC15E5275F8B2020756B9D185A315B73EC24CA0AC2DD2F806D913D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Library/Microsoft.TeamFoundation.TestManagement.Controls.resources.dll
- Size 213KB
- SHA256 da0b0f7342336f1075dd4b2ba9d4696382afbb86f380d8c3d66e31d6cbb8ba9d
- MD5 b9aea633716dbf5dac42fa72efa5fa8b
- SHA1 ba01955e9a7e2836093102092c2600d5044f49ed
- SHA512 72db5d1e5006fd4524e1b53aa136f90b0102cfd78b5a80833b21cc93faa772b5c40f983fcdb05e7b16d23a368eb74492c31222bdf0c844e4542ab1859a864837
- SSDEEP 3072:/lntFoJVpf83LBG8hPVsyfbIE/xSqmO9cGGK:/J4W3HhPVZpxSqmI
- TLSH
  T1FF2472E032BD3D98CB665A3D183595C0263EBE662B40F72D2348364FDC72653B723666
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Library/Microsoft.VisualStudio.DesignTools.Diagnostics.resources.dll
- Size 377KB
- SHA256 026b06c24a39e35a047e5381e5cfc77f9c612a3d9fbeb830e752605e12dc444e
- MD5 9a1e6f2dd02d7444b7e5f47a878eec2b
- SHA1 546f51195f3d5b4c547c9ba2d3ed75304cb6ee1c
- SHA512 547423c42f5877c863e785bab4656c1551374599f37bc3480c04b84e7afb762a9f5b491e83fc5d485c6e56e2f7c36f29205e6b3cc9698b1509ba119bc4c364a1
- SSDEEP 3072:WqSO5uA8KKzK7DlbRfZOMEervDxXCPqqGICnpypScZwMC7jRdbEVkhWWolG3LyG/:Dr8AZRp/XEZEbDpGV57
- TLSH
  T1A7842CD7BAD2085CDA670F3B21772080EC7736CB2FA1960C211A111E5D76F9A8B36B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Library/Microsoft.VisualStudio.PerformanceTools.Visualization.dll
- Size 262KB
- SHA256 f98dfd9d88985ae7a5e0c00ea2210729ea2b62dbf8ca7e91643e015cd1cb3bfa
- MD5 f5887e696c266152b66e12a3df52a21a
- SHA1 d1eac38e0aa3a7bc64f501ef8b82b14dd59960c9
- SHA512 889a875a343e4b213703cad7f0fec6f9f90474023af3760fb649ca3b78d45e1f27319fab4c143cc3d56c82a29b56351cbe8c85380582e662c8aa9a67aabfd284
- SSDEEP 6144:/Zd2uaO2f9pZmrTTV9BBXGF6RPrPRz2JPOy72IQqE:/edorTTl0E
- TLSH
  T1A144C51022A87E09E6B70A36EF7155CC9A3E7EA71E14D55F748C314D0FB2742BB13662
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Library/Microsoft.VisualStudio.Ssh.dll
- Size 302KB
- SHA256 06d740d76596fc271ae9a09fc0dbf21db24f7dec7ea1eb9b628c4afcd2e976d2
- MD5 257c2a3761d981a72149c85bf4b898db
- SHA1 43954c0d79889217c5b53749c4a05d9d3bd06da1
- SHA512 04dce1f47a4db5b42a00ce47b2b3e8644cfcd2ce50aaf3d275e5c910d7622a18e8e227a3dbe32dd7cbe6d4521d5f798212a47fc90f967b244c52215eaa4515e6
- SSDEEP 6144:vt0FlaMC+AfrudeC9YfVEJ/roPifVmrFwbS6Aj0JqgqRq/nWIxl0Fia8/KM1kIQ:vOG+AfyeC9SIxx
- TLSH
  T153644A2443F88922F1EFA7B2F9708922CB75A616F936F74D4D8CA4E52A177C5D4007A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Library/Microsoft.VisualStudio.TeamFoundation.VersionControl.resources.dll
- Size 301KB
- SHA256 b00692689159da2c3241dcedec4e26b92fa7fda301b2ac71f6e305f31cfb9ad4
- MD5 1edafaab49cdaffedde6979e4d561a33
- SHA1 61c9d174be7fad8045f579ebb5311054e68e93a3
- SHA512 f027627a3b04a9e3bd39c6523f4e94f0c21720a7849ea5c46a01fc2556cc6a23a7ee3d51e287dc438d67e940362cda8ff4726b2f7d7f7bb465c987b97caed868
- SSDEEP 3072:x9KXYJWc/Smvg0xmkhWb5kwW6wUhWu6ktfbvfIEUU2zkPxD/dB4TFyQuO7JBilu7:yW6wUhWuyOoMRI5Jhl/UP5EVYdS1
- TLSH
  T14B64713036AA6109D9374B311D7596C02B7FBE777F04CA6E6019160CDD32A639B22BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Library/OISGRAPH.DLL
- Size 359KB
- SHA256 b9b790b30b5a378dfee4d089fceac65f87872695f3f2963b13c1587136633968
- MD5 230e734a6b859ed4f57493a1485185c8
- SHA1 3f75f854caa0c2add01c62bac16f625836bb757a
- SHA512 11a7bb4291ceb7a906dafd2aa444d072a8585d44d7c4e6f5ae913da04ad4efe6cb6f3e1018f4fb27004116aff49f9e275e3784364102437279b9a03f369f5937
- SSDEEP 6144:up7Pz/VT+T8nO4Aw67u+rFDqaKuXbilxQP4fnOJYPJFhkeKNYUAl/UOyZx:yBnz76hFDG2Wx7eyKdi/mZx
- TLSH
  T1E6743A6ABBA54CB3E917D13895576EA2E6B2B0452F20E35F4252833F1F7B7819D0E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Library/OneDriveService.dll
- Size 326KB
- SHA256 e7d729030e05e5e58ccb8c594fa4d40414d61dfa5e941c8686b615662e4a3ece
- MD5 bdaf1413a04c1c3f8f9b063802428921
- SHA1 8a570608834b8eb65544d293115d0745ff52312b
- SHA512 2b63cb7490a42a6481c85d1b79d21ff003f1c16d81ac12d3570d598fdaa48e47da63c7155242874fa0462fc2ab95ab855e1a8eb9dd24ca3da4e5af3f3fe875a0
- SSDEEP 3072:9ArMepym2HfM83U/MMmnM8ck3LKggTrwh6aecDytTW6U1rJhorn:9m3pym2H08jMmM6Fh1DiyFlJg
- TLSH
  T14164FC0269644D29D775F3F30F7ADF8323A668482B479F0AF498BF8A0735921590FB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Library/Rebex.Security.dll
- Size 276KB
- SHA256 ad0caefa1b8787cc22b92b66f92a91cf4276fb2a871b662efce675d3237f8e84
- MD5 22dab7f5b11f04f8b8b9e964fdd5d03c
- SHA1 4317ab4e2945bdd056d1a9f47ac6dbde419d7a0c
- SHA512 cf5eebd5db0e1b85c2694f2cbc8a53ad99ce586087dedaa24f80fbd097230492cf9f5eedbe9d98aef34c27e335548140c5018891f8a84d46a4a557c9830708b4
- SSDEEP 6144:4yuripuG8qYhM537rzfL6eufxYMdjHp//Lw5F:mripuG8xuzz6r4z
- TLSH
  T17A5449146BE84B26E6FF53B4E4B275158BB8F953B9BFEB0E4D8161780C06B508D00B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Library/System.IO.Compression.FileSystem.dll
- Size 26KB
- SHA256 736c20893d66721ec88f019e3dc68606778bca5ae6be3f5ee166f48036aebd3b
- MD5 78bb6cdaad70ccaf7969c59a21a78b67
- SHA1 2ea4ecf51bd3550a62870e2dfbeaed9ab5eea4a5
- SHA512 d53687a90d96169d19132db5f8262db7baf3c39d2e54cdcbbc6c1ad691705c21d9be0a899dfd66a81f740be12dd1eb94db8eb9196fc72885a0ca43ef89da6af1
- SSDEEP 384:hnZAy2Qea6LaHw9PFeoobtwJQ+7sPZuHWJoWeLhXgPHRN7fbTN4tgR9zkbG:PAy2da6JmooKOeMzYN4TTNx9zYG
- TLSH
  T18BC25B15A7DC8306C8FF2D7452B4E8425938BBD29D42D71E5D8AF58D2C63384EB30BA9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Library/System.Runtime.WindowsRuntime.dll
- Size 308KB
- SHA256 56dee906810645b958f19d4e0d51752e6eb98cab694d5d31429a8a4746602c7e
- MD5 4c8f3c8a8c533eda80f18a68e34287e2
- SHA1 3de28e325be0160d79fe240ecca296e953582d11
- SHA512 f2c90db9ca4e384ada0fdf6376ab75e6dd842c3195b521042d1074278d9e93f036498bf4f4606dd0d5eaea6c55649518d8e512bd495bc93e9d45be6b5b73d0e3
- SSDEEP 6144:Bf6YoWGxeGMc2fDu2WFLzYmXnaReKlTOZPwnPqP7fPi+ubbrze2vQQZm5tMlB:1W2yATHrzCOB
- TLSH
  T13D646D02A3CE0F2DE2DB1AB5B4755762C2FCFE0213FAE34AC457C8DD58626935921399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  Library/System.Text.Encodings.Web.dll
- Size 77KB
- SHA256 c792bfe3f43c894e20339252d159a96a20ccc6e13322b2d382570ff97939e501
- MD5 c77ae3414d78c1f082c65415fae69661
- SHA1 3b35461d86a774535ac226ca9706fb50332de20a
- SHA512 08941ba8be5031cc4e363a916525437c62b409576c91c10fc72795faa10bc989f0d1797b576802e208dfe4305a4447c0299e2755ba92f97f531de1f56fd5865a
- SSDEEP 1536:4OO7OOOc2yIDmBkKQh3rt7jUGyRG/mz4CRLf8ocVW4t72bfQZHzp:fyMmXQh3rNjUFG/mk8f8owW4s0ZHF
- TLSH
  T1DB736E16A748C71DC71E153256E085619BF0DFAF1323F7822845B82E2B733C9FA1D6A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Library/System.Web.Extensions.Design.dll
- Size 328KB
- SHA256 75333bfea7ac225d90a18f91f0ee9654434b67147ea064f0d308b82596ef1f83
- MD5 c9ab040176a7dbd8c57ed08eeac4057f
- SHA1 3385521ec165bb4d9e4475569e8e7fd72b7513fa
- SHA512 180c37aab5d2d91c0585fbba645b4462aadf02a63b56bbb445cec2c656356ba316b29c360de9518586ed482d0ff7b65c6808d976013292c8ee8e3098236093f1
- SSDEEP 6144:thB7g7SinjoGm4WHVvr8CLotwTvClq8B3:thpHLoqA
- TLSH
  T1DA64F61233F86329F2BF4B70A9B440D44B76BE471EA5D39E489535DE09B3B40AA17327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32