hijackloader | 1b3e955bff68102c66aeaa9a720104199e6e16d236b80e8836c0cc9b437e2824

General

Target
tmpmpm804rm
Size 4.9MB
Sample260602-vl3fesbs7w
SHA256 1b3e955bff68102c66aeaa9a720104199e6e16d236b80e8836c0cc9b437e2824
MD5 58aaeddecf19b06b95a228e2077e3058
SHA1 fa640c339af00a50218d0292d3e7f962e2c15e51
SHA512 f73efbad73176243bc6b22270a794d974307726d5b9eca7850121338460dbce2b3b68349d3e101443a40f8b3cb336b8799e83f7b5c6f3111ad11ae8e4218cd6b
SSDEEP 98304:C6EHKfGqWMB67HLlXUIeHcVa74D7p6dmo1aUyxHgetoVHFRYLQYLpl4d:C69OqWV7Hi74Dl6dmHLHgzJFWLgd
TLSH
T1C036331373CB0432F0265E71EDB59C447EA3B5B80DF0A4082DF1C58D2ABE5A6A936776
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\utilityhost_v7_arm64_prod%APPDATA%
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Targets

- Target
  tmpmpm804rm
- Size 4.9MB
- SHA256 1b3e955bff68102c66aeaa9a720104199e6e16d236b80e8836c0cc9b437e2824
- MD5 58aaeddecf19b06b95a228e2077e3058
- SHA1 fa640c339af00a50218d0292d3e7f962e2c15e51
- SHA512 f73efbad73176243bc6b22270a794d974307726d5b9eca7850121338460dbce2b3b68349d3e101443a40f8b3cb336b8799e83f7b5c6f3111ad11ae8e4218cd6b
- SSDEEP 98304:C6EHKfGqWMB67HLlXUIeHcVa74D7p6dmo1aUyxHgetoVHFRYLQYLpl4d:C69OqWV7Hi74Dl6dmHLHgzJFWLgd
- TLSH
  T1C036331373CB0432F0265E71EDB59C447EA3B5B80DF0A4082DF1C58D2ABE5A6A936776
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery hijackloader installer loader
- Detects HijackLoader (aka IDAT Loader)
- Family: HijackLoader, IDAT loader, Ghostulse,
  HijackLoader is a multi-stage loader, first seen in 2023.
  loader hijackloader
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects HijackLoader (aka IDAT Loader)

Family: HijackLoader, IDAT loader, Ghostulse,

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3