Extracted

• • Target
    Setup.exe
  • Size 102KB
  • SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
  • MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
  • SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
  • SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
  • SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
  • TLSH
    T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionhijackloaderloaderpersistence

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    data/.YRk
  • Size 332B
  • SHA256 2aadbb6bf652e5470bd877407f831fb3eaeffb30ef4423d64e952ae443513604
  • MD5 4817e3deeb99ae0555fd030908a9d00d
  • SHA1 539a1f8d5ba9d570d4e53d0ba8fb3c4a14b0c7d0
  • SHA512 3d958be24e8b945181311a0925c5ea18bd50ee230d6c5599c2ab79ecf3153e55f965599136388d3abfca42f78f03839295c9768743db66bfacbc199ea188c92e
  • TLSH
    T179E02D740E879AE08C4B8F372740B0411CC00C2E0C1303217E56E04122BC0D09F0BA34
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10
  behavioral3behavioral4
• • Target
    data/cache/bytecode-39.rpyb
  • Size 366KB
  • SHA256 e032a47ea0f9ac09ad11a38d90a891ab4920e1891d0be533fa15039590902fb6
  • MD5 d941efe023606740f61670e8ab96f8b1
  • SHA1 7ca1eff375ef2404dfb5a4366f3f0c3f6102bc94
  • SHA512 ec2741628b433b4d727989b47307441bd930ff299a8d0e480c8ff54585644338af53fc14ae1cd1f87af6a12e447ebcd5f2c6de3cdbfcb5b1bf43106fe749aa0d
  • SSDEEP 6144:iad71GRb0EejU3yfiFE2DzbuJ014QsEel0Oyl0JewbTAboC/7esQvlpYseioW/Fj:ia4peoAyJzbuJ/RE+yUewQboCVQvlpYe
  • TLSH
    T12E84230988C710040EBC87A97105FA7CF16C6629A3EA637959E7C6F5FD1EC662D62C0F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6
• • Target
    data/cache/py3analysis.rpyb
  • Size 69KB
  • SHA256 70716b7c625f95c6dc94c6db766eccb4f9bb46d89108fb50a62ba68cb511a835
  • MD5 444c6d02b7b55150e317c5ad24955bd0
  • SHA1 3e4e465c9de3d1ebeb589ebdf1efa8c73f492d58
  • SHA512 baa5746878e733689b19335bff924b9049efc940dc2e8a7fae1c6ede0b764debc7bebab3fab83dd8b79df58364f49d108a85bc6be0bb7f163613bc35e0fbe2f7
  • SSDEEP 1536:Y6KDNSwqoiXumM8GEszg1CR24NjF7Z/hIkFMR22AsMNRSi6xEY3NRCT:fK4FJumM68gsjFliwugQikL3NRCT
  • TLSH
    T1EB6302168249773FB414EEBDBAD6DC44C524F7C03ECA03A39F59B98852D4DA03656BE0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10
  behavioral7behavioral8
• • Target
    lib/python3.9/ordlookup/__init__.pyc
  • Size 1KB
  • SHA256 623b4681156300784621048d49779ef9136dd3a16970c9a55a0e537e38a487f4
  • MD5 612cbcc2da0644edd722692ab0121c3b
  • SHA1 83bcdadc218cfe383cd419efdb2418a180f1ec56
  • SHA512 2027b5b2e683591f48c5efb2e60ab03186da09f3a28e8b085b2ade53edc444edb1a572172b9b0fffabca7632cf6a927e8e8fe30322e66d9431178d99d343971b
  • TLSH
    T13E1110D086445B6BFD79F0BD9896022493E9926A339E25037E6E62BF3E476408C22C4D
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10
  behavioral10behavioral9
• • Target
    lib/python3.9/ordlookup/oleaut32.pyc
  • Size 11KB
  • SHA256 0be8e15e9ca86bde024ddbaee631c4b90b98a212bd67ef1bbc17b62b4d779a52
  • MD5 b3834746bd1b6475aa19598c7a3329fa
  • SHA1 d8c242c66a3706263b4f2890e28f037922624824
  • SHA512 fc5513d28b9f47329e09b0181cb93a1682e23d8e48f5b2282bb9bd74ecacdd3e85b27d47ddcb931998fcb0cff354d724682ec13142f7b272d07d55133f0a2cc6
  • SSDEEP 192:LzPfpR/vfv/vfv/vfv/57TohDTrRAu8w/UbhH3OZcMnha0VmNFByqRYauT+F7t2K:LzXX3X3X3XRowuy70VutelJUmM
  • TLSH
    T19132CCD292B134DB777919A538E393095E00E7A8CFC8F2445490DBA5A94D7382F3C2DE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral11behavioral12
• • Target
    lib/python3.9/ordlookup/ws2_32.pyc
  • Size 3KB
  • SHA256 8e3c2dd5de8fe5c10243b7d390be442f69ee5300326ae6dab05993f351df9ed6
  • MD5 361c9c4d180933d815825c5ce21ab168
  • SHA1 22c667f1646d06167c6a0dad549412208c115025
  • SHA512 b761ebc5b142ca3ce125cefdc9eb6ccd79078721a882f3462b651ea4c91699f7a342a2ca147b68c274464a6d931749d16c4158afc7fe1f41daa5b2e5951bcea0
  • TLSH
    T12271C8D05E6104BBB2A7331C2C6F83005A4035A9FF27F5B39FB97AA348D3F194819646
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10
  behavioral13behavioral14
• • Target
    setup.py
  • Size 8KB
  • SHA256 5a2d8e648e3f4cbdcd32cbd2bb0ba48d10de32fe14042e201a8bb7088cefad79
  • MD5 f82bfb01fa17b87134b14fc21ddacb74
  • SHA1 7b2c9342a390253dd012d278a2b9ea83e1759827
  • SHA512 ff3d5de26bf951e00cac2c8bc13fb015235de569c6edf95e8b2800ab3a4126c974d817dfbf475b4a9b57ff0b0306deb0e389411f43162fc7aeb8e970b50d8aa0
  • SSDEEP 192:7X1dwQHjiJqdt2RqEq1ShhKBqMJx45KB/H/osX3qzbFsqLdx+aHv8UTri:7wKiwdtzvMhhVMJ2KNf9XatLn+A0H
  • TLSH
    T10E029696B5D536918313AB58D8D6A0C82217E9E73EEF11783ADC33647F6091043F36AE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral15behavioral16behavioral17behavioral18