General

  • Target
    tmpbdwfd8cl
  • Size 15.8MB
  • Sample260601-rnk3dafv2s
  • SHA256 3a153b9c49cabd05d1287442a90588e777804a06cd68e666baa4f6a3f19b37c5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Family
  • hijackloader

Attributes
  • directory

    %APPDATA%\tcur

  • inject_dll

    %windir%\SysWOW64\pla.dll

xor.hex

Signatures

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

  • Insecure Codesign Algorithm 3 IoCs

    File was codesigned using an insecure algorithm.

File Explorer

  • tmpbdwfd8cl
    .zip 15.8MB
  • Oul.yhv
    1.6MB
  • Setup.exe
    .exe 13.0MB
  • Viergoubbrund.xgmt
    19KB
  • config.prx
    .exe 364KB
  • opengl64.dll
    .exe 17.7MB
  • sdHookpp.64.dll
    .dll 1.7MB
  • updater/NvStWiz.prx
    .exe 432KB
  • updater/manager/ks_tyres.ini
    9KB
  • x64/trading_api64.dll
    .dll 282KB
  • x64/tradingnetworkingsockets.dll
    .dll 4.1MB
  • x86/api-ms-win-core-processthreads-l1-1-1.dll
    .dll 17KB
  • x86/api-ms-win-core-profile-l1-1-0.dll
    .dll 16KB
  • x86/api-ms-win-core-rtlsupport-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-core-string-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-core-synch-l1-1-0.dll
    .dll 19KB
  • x86/api-ms-win-core-synch-l1-2-0.dll
    .dll 17KB
  • x86/api-ms-win-core-sysinfo-l1-1-0.dll
    .dll 18KB
  • x86/api-ms-win-core-timezone-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-core-util-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-crt-conio-l1-1-0.dll
    .dll 18KB
  • x86/api-ms-win-crt-convert-l1-1-0.dll
    .dll 21KB
  • x86/api-ms-win-crt-environment-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-crt-filesystem-l1-1-0.dll
    .dll 19KB
  • x86/api-ms-win-crt-heap-l1-1-0.dll
    .dll 18KB
  • x86/api-ms-win-crt-locale-l1-1-0.dll
    .dll 17KB
  • x86/api-ms-win-crt-math-l1-1-0.dll
    .dll 26KB
  • x86/api-ms-win-crt-multibyte-l1-1-0.dll
    .dll 25KB
  • x86/api-ms-win-crt-private-l1-1-0.dll
    .dll 68KB
  • x86/api-ms-win-crt-process-l1-1-0.dll
    .dll 18KB

tmpbdwfd8cl

  • SHA256 3a153b9c49cabd05d1287442a90588e777804a06cd68e666baa4f6a3f19b37c5
  • MD5 SHA1 SHA512 SSDEEP TLSH