Extracted

• • Target
    kythy.exe
  • Size 10.0MB
  • SHA256 732f1656a9ff3b152e1455834a8fe55c90dda60377354b7c0df7884ec481a8ab
  • MD5 2034b74bc4616cc7a129b6852e54db52
  • SHA1 83e5e4239abc113c6e05211d99830259357ed08c
  • SHA512 9bf70d17c9869f73fa067a9c11b301ed29c20d6a9e4f53d39bd926cc087942d78f6b99888a07e5a92a76b07013830c9583a0f02edb01ddab55b2c82b8625b246
  • SSDEEP 196608:+ph8WyyNY45RgmCknjESCDZ0do8PLMfgQ503oLi4YbYMdk797FoiXYg0F:+phsWQmCejKZ0Tra0Eu1MoBgq
  • TLSH
    T18DB63310B3457CB9F1A1EA74DE0DFB2B1632E76213800E826181AE17BE5B6D097475EF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryhijackloaderloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2