hijackloader | e44fa00395495234cba66eead12cf1cd5a33a6ee005ba5068ddc063c23b97c40

Sharing

Copy URL Twitter E-mail

General

Target
SketchUp_Pro_2026_v26.2.243_Full_Español_Archive_free_472451.zip
Size 805.0MB
Sample260620-tm7absfy7m
SHA256 e44fa00395495234cba66eead12cf1cd5a33a6ee005ba5068ddc063c23b97c40
MD5 b9cfee52f6ca9d3c10a0627d0420adc2
SHA1 0d68706bcab3b4fcb7adf5448ee2ed3e96ef5084
SHA512 b1cab5ef6a9e53b0669a90ee33ec9310280302ac0643c31c7aeb8f41c96843caac5487bd167e53ab3db1568eb1b245ecafb4386701f8095696e234900cdaff1b
SSDEEP 786432:Y83bo/PYz5S3H0TZVih5X0vf+INsavXu9d9A++1boN9:Y80gNq0TriPkn+2P6d9b+RE
TLSH
T10A993304CE2CE7D6FB9375B9B8B0505BD52F91B0328CE259799832B4ED86F446F2890D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\Osz
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Extracted

Family

remus_stealer

http://hemitx.shop:5743
http://carogra.biz:4219
http://myrtler.biz:9549

Targets

- Target
  SketchUp_Pro_2026_v26.2.243_Full_Español_Archive_free_472451.zip
- Size 805.0MB
- SHA256 e44fa00395495234cba66eead12cf1cd5a33a6ee005ba5068ddc063c23b97c40
- MD5 b9cfee52f6ca9d3c10a0627d0420adc2
- SHA1 0d68706bcab3b4fcb7adf5448ee2ed3e96ef5084
- SHA512 b1cab5ef6a9e53b0669a90ee33ec9310280302ac0643c31c7aeb8f41c96843caac5487bd167e53ab3db1568eb1b245ecafb4386701f8095696e234900cdaff1b
- SSDEEP 786432:Y83bo/PYz5S3H0TZVih5X0vf+INsavXu9d9A++1boN9:Y80gNq0TriPkn+2P6d9b+RE
- TLSH
  T10A993304CE2CE7D6FB9375B9B8B0505BD52F91B0328CE259799832B4ED86F446F2890D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution hijackloader remus_stealer loader stealer
- Detects HijackLoader (aka IDAT Loader)
- Detects Remus stealer
- Family: HijackLoader, IDAT loader, Ghostulse,
  HijackLoader is a multi-stage loader, first seen in 2023.
  loader hijackloader
- Family: Remus
  Remus is a stealer written in C++.
  stealer remus_stealer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  data/.7iF
- Size 324B
- SHA256 3f10255d8ae6416b835f25e1f1837b7b97e994b91dc0f413223e80f80d52a92b
- MD5 510633d395d1267e1cf2eff47f5cb191
- SHA1 f7bcd5b884e6dc2d268493d34398745b042c56d3
- SHA512 0e263ec568fcb44766daaaa6cf8aa53883a66e1768328d245ab3a3f6c8eff69d245ead29f7b1d02f1b653a0ad74b3407c7f3a071bf116868bdb0ff31ac29e5f7
- TLSH
  T10BE0C070C8A84995A30D248050624806914084626601F4958F14C795B943B426E12978
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  data/WP2fEFGOt6Bc.bS
- Size 13.4MB
- SHA256 fed2c1929dffd406f5eb6651bfd9962d76fa3731202c12f785c5d2622437157a
- MD5 e1eba0a764b0367690826fa97f954d99
- SHA1 e6736a93469a824b5b0d710bbc119ec8375b29d6
- SHA512 8ce3d9f9ce990a2341e36e48d506ed16a78d2433afe2b1aa3a2bfe289466c0e46a52522ed94355091f1fe7caa36dc17286c1767338a17039221194cecf3f0415
- SSDEEP 393216:IHu2VLeph+MQSYjfCSu2WFj9JJIz9z5D4cbDay8J6DAvF1l2Ej7SG:T21C+Mp3/
- TLSH
  T11CE6DF36DEDAF524C0D735181BA13078A8BF1E8855A7E847FF4B95931A9F84F4283836
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  data/cache/bytecode-39.rpyb
- Size 366KB
- SHA256 8a7bff882f1746e8b549efa97fb1e4cdc96be8ddaccecd34a657f43c4d1c3378
- MD5 cd1b217e59e91ebfd698f6e216f57a25
- SHA1 0b90677c107096bc3a90a8df9881a3e470953260
- SHA512 6ede74509920afe270bd5d84f4a8b0debcb781933c4de674c207039f886767d4000923ee76dc136bbd5c011a2354ef74dfeac04507c3110f1d76bac7e9f7068d
- SSDEEP 6144:iad71GRb0EejU3yfiFE2DzbuJ014QsEel0Oyl0JewbTAboC/7esQvlpYseioW/FT:ia4peoAyJzbuJ/RE+yUewQboCVQvlpYy
- TLSH
  T1A884230988C710040EBC87A97105FA7CF16C6629A3EB637959E7C6F5FD1E8662D62C0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  data/cache/py3analysis.rpyb
- Size 69KB
- SHA256 084f96618043a762a4dac6c8d36d0527409871d87165b7efed62ec4e991d2524
- MD5 5f2d39204f3b9469e60f608708f33437
- SHA1 924137cf1a55a87f7abda472afc9ebc159135a6c
- SHA512 6597dac189ecb3d2bd3a3f56305e43c5eb4a31452217b42d32c4261732860a5c0480f04493db7de8f882dcb3117b7e02e22a51bc3c8e045ed4f880e8822b9e96
- SSDEEP 1536:Y6KDNSwqoiXumM8GEszg1CR24NjF7Z/hIkFMR22AsMNRSi6xEY3NR5:fK4FJumM68gsjFliwugQikL3NR5
- TLSH
  T13763015A82497B3BB414EEBDBADADC44C534F6C03EC603A39F597D8852D4DA03652BE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  data/cache/screens.rpyb
- Size 125KB
- SHA256 2cc601b7f87e8031b4306e9f21c0ea0b5b6c982c80e5372a0c3d79281ee88695
- MD5 f1f7ee96904b33ec1694d034f795cb57
- SHA1 957cb957b19d1938fb9ca7bc54325e5ae186cdef
- SHA512 e09e3dfd4cb91d46479f6b1441ba2fcd878c75179d75d8c1006e959c8372d6fd805c688c24dc8798a9ab649d2950b743c3a7a7b8e3ebde6e349f7d37a724d31d
- SSDEEP 3072:Z2epl/0KH70Jp0soBzVtiE58qmgbIclyRldkm2wZ6EL/bb/qHaKm:Z77jHIL0vBzbiE54gbyDdkqL///qHal
- TLSH
  T138C31327BA3C584858A87C16CE819FAA06E04C0FD58FBB4B42967C9C9C1F582FF11DD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  data/cache/shaders.txt
- Size 828B
- SHA256 d5023892a8395638ba6f83e0883d4e4ad1f94c801c5cdc917d53aa1462d7df1e
- MD5 5d61faad18526a55cfa90c14f3d450d9
- SHA1 74a8576552d5ed1338e6a48cfce8d49df7419d06
- SHA512 b11c1674999d844a2435dad2a6fd43200d55b6131dff58243597c5277537f4b643f4a81798597a6885ae1068415bfe5bc4d6f19c11069ab4f2659324c8f7c945
- TLSH
  T1B1015252FE582A96C39061D119DD8FAA3C46D80C43C985FB059E5BD6420274619949E6
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral15 behavioral16
- Target
  data/gui/bar/bottom.png
- Size 1KB
- SHA256 e79dcf47bb93d8266659d7ee6a6e2c374b75b2dfaacbfe731727fc254d0e744c
- MD5 981f140ec39ea9efa4c523029a7c2ba8
- SHA1 88fd669c8eb37a59dae35f21322ca81c6aeca5eb
- SHA512 d6c3bbb5b1af43e811880b1c9613e358fe428ff2c051c9be790cf4dfadd04e696a7f4b656057b9862290216c0f58ff12c224506295ff36ca4eb217e5a86c379c
- TLSH
  T19321FCDEE23E2F649341D896A030A5F2CF1E1350F9EC6498548BABB50647523608A771
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  data/gui/bar/left.png
- Size 1KB
- SHA256 83e7d492513a4fda37f2511f45da4a9f23196ec746b7e0f1d2761f9e050d1061
- MD5 eeac0e9e0e0db5c08462acae25f561d2
- SHA1 8d1961bcc7932e1c58d56486495e371dc6199959
- SHA512 1f1bc3be0bc279a017b3b39f31c13e1a0eab5b66c011607c927da022d663222e2e95f8851fca040723ba528f177a3725f5a28891a0c3c94e7848c5938f6c5b35
- TLSH
  T11C213105D6D8A47371497123724646B228226F762C32D97C03E23ABF9452FB52EB1EE1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  data/gui/bar/right.png
- Size 1KB
- SHA256 0df2c1f81a444edbfca839420138d9cf9e694bac809b80c30eb8b21aab41ec12
- MD5 5c53d0d93f328d01c58176de7b6dcc26
- SHA1 0a346fa162500e12553d6d472abd9966ed5c9bb6
- SHA512 0fa9a13a76ea4910131c0aef7c1da68742d1706d5bc0039a22935c9c1f360b657cdefcb39e5522a0146bd0c591434ea1818466b54a6b2046f08e0802ce3ff91c
- TLSH
  T16521FE80E666D173252822A1F3C50EF764591B7A3920E91D05C3392F41C3FBB6C71E92
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  data/gui/bar/top.png
- Size 1KB
- SHA256 cde300da7199bc355700fe47ce5b49d9e6e9ba77b857fb4e341cbb82888e13c8
- MD5 72f4a70c0df6fdd9a6f77d54fc3ebe7f
- SHA1 3980ff6814edc488cd3a7e63eb04b6b2b58b4973
- SHA512 54f272e148a8f33b85b25c81f2b30441fcd77327930f1b07592020e0a2ff6b96ad1ae153f9717a5054f0e2ca80793d1cf05639e4835386d82bf5b01932e74127
- TLSH
  T11131A4AEE73D1F649740DDEA603179E7CE0A1311B9FC755DA48B6B600547633904AB70
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  data/gui/bubble.png
- Size 7KB
- SHA256 d34b65b4538505cea9b613e67fe10d65de37345ccd62e9d1f2e23537e6dac812
- MD5 8c2ffdd4267c878cc17fee67447137f5
- SHA1 6714ed57a10c5d8374995dc35adb70ae1dd255b6
- SHA512 13c29cd9223104b8bd9dc1e00e7298de516e042fef8dc041372b8ee4185ed675fe785f1f0647825ff2b227f758c997e2336f48f03aa973f9de81e35d375ca6ca
- SSDEEP 192:vzR3KblGhHiG+WsElhnJ3mD3SNnt5u4He:7R68hCedDtOSJu4He
- TLSH
  T1F1E19E52998CC666D7F940B148446B57EE710A3C06FE8FE1ACCC0D52CAB0C0B9B998A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  data/gui/button/check_foreground.png
- Size 1KB
- SHA256 47a95594365032262d446f85cc56f46cf7f9ea7b518358e05771b2a7bf76d0b5
- MD5 6901c21ddd4fa174da6a1ff18c0557e5
- SHA1 41205ea72b2d2df24f4d81f5c7785d9dba01c6d6
- SHA512 fbbf7553b15c936c959bc7000a32f902b4670f117a4990910af5872ddb779493e99cc64ae88deae53fe8e236fa878725cde501ec88b38754d7426025450ab2db
- TLSH
  T11611B9875BC3A62550CC212FD592C587A85981D4D1B294CDA20FDDE7970506A92D534F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  data/gui/button/check_selected_foreground.png
- Size 507B
- SHA256 4ca5180d240aa92537640f09a4a0941ef3f2b54e3b36a89451f5d3bd29352778
- MD5 dcafb5355707635b4904d707611188fb
- SHA1 b22127f3576ff8810353aef9b864e3fd86d3952b
- SHA512 17688b9ee329eb16aa4a81d8c93a44ad1c7bca68f53c30f0bd812c29f9801456b642437b10b0ffb7ff1fdd206712371aef608ceef9dc62ca5450a0a1cd24fb04
- TLSH
  T126F00599CD33C80E70583FC387FF6961B789F0700EDC6422181DA0B6F90845A154B397
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  data/gui/button/choice_hover_background.png
- Size 2KB
- SHA256 bec780030624e1e077437513c9a883e5442a3cf25bb4a34a455bd95293754122
- MD5 a49a345a9796a1bea900f7629a1e0f42
- SHA1 d495364cde56f3332f8e3468d2e48371f20f0c18
- SHA512 ac5e5613c46f6829228fb1e18f4eb6cd9a465bdae8867cfd1c9453839dfeeade7d81682534852dcf1dadb9fb83a0a016a1a280177511ccff85a8ce56576a8bc4
- TLSH
  T15C41F882E3600573329A0004B199895381851CBB7968ED5A55CB797F47BBF3A9EF0E47
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Detects HijackLoader (aka IDAT Loader)

Detects Remus stealer

Family: HijackLoader, IDAT loader, Ghostulse,

Family: Remus

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32