Extracted

• • Target
    tmpa_igs4bf
  • Size 16.7MB
  • SHA256 c36338fbc2b1913fd79443706dedbc9f58adcfaf5af1dab06a592446e8f6dec6
  • MD5 da67abcb5edaabd2eb3c39758ca3eca2
  • SHA1 88e3ce4eaa10b8b5ab36b97083432b7f0e5a07ce
  • SHA512 e55263c47e2bd030f459a5fd381c85da0c457560346a7502b5142cbf9c70439dea460074a5679e0a3830b6ac494c188affae7aa1d3334574a9cc8bb005e17c4b
  • SSDEEP 393216:5wald/I8JD71Q5ndRKfvVrbQRHQcS7yvfvvtS:5LH/PG5DavlQRw7y34
  • TLSH
    T1210712137690803DE5BA02704C5FAE6491A97D734A318157F6E0FF1D2DF1982BA27B2B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryhijackloaderloader

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3