General

  • Target
    tmps_bks4wc
  • Size 3.6MB
  • Sample260602-vm34cacv4q
  • SHA256 f9a96d165af1901b38818100df69af7045bfe1096e0cdbdd60430463b48839db
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Family
  • hijackloader

Attributes
  • directory

    %APPDATA%\storehost_test

  • inject_dll

    %windir%\SysWOW64\input.dll

xor.hex

Signatures

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

  • Detects HijackLoader (aka IDAT Loader) 2 IoCs
  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

  • DLL Hijacking vulnerability 1 IoCs

    Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.

File Explorer

  • tmps_bks4wc
    .zip 3.6MB
  • analysis_sample.exe
    .zip 7.7MB
  • N9tx1dcqw.exe
    .exe 2.3MB
  • audiopolicy10.lib
    1.4MB
  • libxml2.dll
    .dll 2.4MB
  • loader-drv.yaml
    11KB
  • msvcp_win.dll
    .dll 621KB
  • ucrtbase.dll
    .dll 1021KB

tmps_bks4wc

  • SHA256 f9a96d165af1901b38818100df69af7045bfe1096e0cdbdd60430463b48839db
  • MD5 SHA1 SHA512 SSDEEP TLSH