General

  • Target
    tmpdjewkudi.zip
  • Size 15.4MB
  • Sample260524-repzzaex9q
  • SHA256 9df42aaa68579729e9398e5f3f5e04b9a14c0911ebeb7491b943969cbd9eabfb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Family
  • hijackloader

Attributes
  • directory

    %APPDATA%\Ru

  • inject_dll

    %windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

  • Insecure Codesign Algorithm 1 IoCs

    File was codesigned using an insecure algorithm.

  • Unsigned PE 13 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 3 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • tmpdjewkudi.zip
    .zip 15.4MB
  • Crael.lt
    22KB
  • Library/AsAcpi.dll
    .dll 117KB
  • Library/Microsoft.DotNet.Interactive.Netstandard20.dll
    .dll 273KB
  • Library/Microsoft.Extensions.DependencyInjection.dll
    .dll 198KB
  • Library/Microsoft.ServiceHub.Client.dll
    .dll 614KB
  • Library/Microsoft.TeamFoundation.TestManagement.Controls.resources.dll
    .dll 213KB
  • Library/Microsoft.VisualStudio.DesignTools.Diagnostics.resources.dll
    .dll 377KB
  • Library/Microsoft.VisualStudio.PerformanceTools.Visualization.dll
    .dll 262KB
  • Library/Microsoft.VisualStudio.Ssh.dll
    .dll 302KB
  • Library/Microsoft.VisualStudio.TeamFoundation.VersionControl.resources.dll
    .dll 301KB
  • Library/OISGRAPH.DLL
    .dll 359KB
  • Library/OneDriveService.dll
    .dll 326KB
  • Library/Rebex.Security.dll
    .dll 276KB
  • Library/System.IO.Compression.FileSystem.dll
    .dll 26KB
  • Library/System.Runtime.WindowsRuntime.dll
    .dll 308KB
  • Library/System.Text.Encodings.Web.dll
    .dll 77KB
  • Library/System.Web.Extensions.Design.dll
    .dll 328KB
  • Library/ULCDRDrv64.dll
    .dll 428KB
  • Library/VSTOLoader.dll
    .dll 361KB
  • Library/WTSP61MS.DLL
    .dll 216KB
  • Library/cpfecl.Android.x64.dll
    .dll 426KB
  • Library/cpfecl.Win32.dll
    .dll 406KB
  • Library/graphics.dll
    .dll 287KB
  • Library/icuin30.dll
    .dll 569KB
  • Library/lcms.dll
    .dll 246KB
  • Library/libomp140.i386.dll
    .dll 636KB
  • Library/runtime-vccrt-win-msil.dll
    .dll 431KB
  • Library/rzc.dll
    .dll 362KB
  • Library/vcruntime140d.dll
    .dll 109KB
  • Library/wmpnssci.dll
    .dll 490KB
  • Queackfaishail.ntsr
    1016KB
  • Resource/004.phpt
    737B
  • Resource/010-2.phpt
    536B
  • Resource/CREDITS
    39B
  • Resource/DateTimeImmutable_set_state.phpt
    .js 592B
  • Resource/ReflectionExtension_double_construct.phpt
    329B
  • Resource/T76_1.phpt
    1KB
  • Resource/allowed_rounding_error.inc
    435B
  • Resource/array_sum_objects_operation_no_cast.phpt
    716B
  • Resource/array_with_refs_identical.phpt
    176B
  • Resource/bug20169.phpt
    276B
  • Resource/bug28024.phpt
    263B
  • Resource/bug38220.phpt
    1KB
  • Resource/bug38347.phpt
    555B
  • Resource/bug39673.phpt
    575B
  • Resource/bug42326.phpt
    1KB
  • Resource/bug45289.phpt
    989B
  • Resource/bug70417.phpt
    924B
  • Resource/bug71263.phpt
    1KB
  • Resource/bug72463_2.phpt
    435B
  • Resource/bug81642.phpt
    1KB
  • Resource/bug_77849.phpt
    630B
  • Resource/class_order_autoload_error8.phpt
    753B
  • Resource/ctor_promotion_repeated_prop.phpt
    228B
  • Resource/double_array_cast.phpt
    181B
  • Resource/errmsg_021.phpt
    237B
  • Resource/file_put_contents_variation8-win32.phpt
    .js 1KB
  • Resource/final_ctor1.phpt
    334B
  • Resource/fixture.inc
    58B
  • Resource/frontcontroller19.phar.inc
    .js 604B
  • Resource/ftok.c
    1KB
  • Resource/fuzzer-execute-common.h
    5KB
  • Resource/gc_005.phpt
    255B
  • Resource/get_declared_traits_basic_001.phpt
    1KB
  • Resource/gh11682.phpt
    525B
  • Resource/gmstrftime_variation3.phpt
    .ps1 1KB
  • Resource/header_redirection_002.phpt
    248B
  • Resource/in.c
    5KB
  • Resource/inf_nan_error.phpt
    840B
  • Resource/ldap_err2str_basic.phpt
    251B
  • Resource/rename.phpt
    985B
  • Resource/session_encode_variation7.phpt
    553B
  • Resource/ssa_bug_010.phpt
    483B
  • Resource/token_attr.h
    1KB
  • Resource/uconverter_getSourceEncoding.phpt
    268B
  • Resource/visibility_003c.phpt
    530B
  • Resource/xsltprocessor_registerPHPFunctions-null.phpt
    797B
  • UpdateLogs/DisplayLanguageNames.es_US.txt
    33KB
  • UpdateLogs/DisplayLanguageNames.nn_NO.txt
    32KB
  • UpdateLogs/DisplayLanguageNames.sv_FI.txt
    33KB
  • UpdateLogs/Samuel_16.txt
    83B
  • UpdateLogs/cgo_undef.txt
    1KB
  • UpdateLogs/example.com_noroot_v1.0.1.txt
    136B
  • UpdateLogs/fi.txt
    8KB
  • UpdateLogs/help.ca.txt
    9KB
  • UpdateLogs/mod_deprecate_message.txt
    2KB
  • UpdateLogs/mod_doc_path.txt
    537B
  • UpdateLogs/mod_lazy_downgrade.txt
    3KB
  • UpdateLogs/mod_lazy_new_import.txt
    2KB
  • UpdateLogs/mod_list_sums.txt
    1KB
  • UpdateLogs/mod_load_replace_mismatch.txt
    618B
  • UpdateLogs/mod_vcs_missing.txt
    499B
  • UpdateLogs/uganda.txt
    12KB
  • Updates/AppRespAnalyzer.dll
    .dll 591KB
  • Updates/Microsoft.PackageManagement.MsiProvider.dll
    .dll 230KB
  • Updates/Microsoft.VisualStudio.CMake.Project.dll
    .dll 366KB
  • Updates/Microsoft.VisualStudio.Workspace.ExternalBuildFramework.VS.dll
    .dll 283KB
  • Updates/PreUninstallArmourySocketServer.exe
    .exe 212KB
  • Updates/VBoxNetDHCP.dll
    .dll 436KB
  • Updates/bass.dll
    .dll 252KB
  • Updates/bin/git-credential-helper-selector.exe
    .exe 61KB
  • Updates/bin/git-credential-manager-ui.exe
    .exe 96KB
  • Updates/bin/hoshi - Shortcut.lnk
    .lnk 750B
  • Updates/bin/sexp-conv.exe
    .exe 62KB
  • Updates/bin/tclsh86.exe
    .exe 77KB
  • Updates/connect.exe
    .exe 82KB
  • Updates/msys-gcrypt-20.dll
    .dll 798KB
  • dynsimpleipc.dll
    .dll 7.0MB
  • libeay32.dll
    .dll 2.2MB
  • setup.exe
    .exe 8.4MB
  • ssleay32.dll
    .dll 377KB

tmpdjewkudi.zip

  • SHA256 9df42aaa68579729e9398e5f3f5e04b9a14c0911ebeb7491b943969cbd9eabfb
  • MD5 SHA1 SHA512 SSDEEP TLSH