General

  • Target
    tmpu78djo7h
  • Size 6.8MB
  • Sample260601-rm127sft7w
  • SHA256 a94ac18f45e765daaeccfd9547ba597da29a0bbe4d632173c9c24fb1079087cc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Family
  • hijackloader

Attributes
  • directory

    %APPDATA%\Mopac

  • inject_dll

    %windir%\SysWOW64\pla.dll

xor.hex

Signatures

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • Insecure Codesign Algorithm 1 IoCs

    File was codesigned using an insecure algorithm.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • tmpu78djo7h
    .zip 6.8MB
  • Gealfrie.aiet
    1.6MB
  • Haitdraebquud.vw
    23KB
  • LexActivator.dll
    .dll 1.0MB
  • MSVCP140.dll
    .dll 437KB
  • Setup.exe
    .exe 4.4MB
  • VCRUNTIME140.dll
    .dll 89KB
  • x64/trading_api64.dll
    .dll 282KB
  • x86/api-ms-win-core-processthreads-l1-1-1.dll
    .dll 17KB
  • x86/api-ms-win-core-profile-l1-1-0.dll
    .dll 16KB
  • x86/api-ms-win-core-rtlsupport-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-core-string-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-core-synch-l1-1-0.dll
    .dll 19KB
  • x86/api-ms-win-core-synch-l1-2-0.dll
    .dll 17KB
  • x86/api-ms-win-core-sysinfo-l1-1-0.dll
    .dll 18KB
  • x86/api-ms-win-core-timezone-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-core-util-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-crt-conio-l1-1-0.dll
    .dll 18KB
  • x86/api-ms-win-crt-convert-l1-1-0.dll
    .dll 21KB
  • x86/api-ms-win-crt-environment-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-crt-filesystem-l1-1-0.dll
    .dll 19KB
  • x86/api-ms-win-crt-heap-l1-1-0.dll
    .dll 18KB
  • x86/api-ms-win-crt-locale-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-crt-math-l1-1-0.dll
    .dll 26KB
  • x86/api-ms-win-crt-multibyte-l1-1-0.dll
    .dll 25KB
  • x86/api-ms-win-crt-private-l1-1-0.dll
    .dll 68KB
  • x86/api-ms-win-crt-process-l1-1-0.dll
    .dll 18KB

tmpu78djo7h

  • SHA256 a94ac18f45e765daaeccfd9547ba597da29a0bbe4d632173c9c24fb1079087cc
  • MD5 SHA1 SHA512 SSDEEP TLSH