Extracted

• • Target
    6bdcd7a0d5c1bb109552844edebdf4b4.exe
  • Size 13.6MB
  • SHA256 574cebd5ea2acb459274679dc5411d805e1a20c4c79c111450befd038819c4c7
  • MD5 6bdcd7a0d5c1bb109552844edebdf4b4
  • SHA1 56040d65720a2eee67b0cff3160e3504d113ec65
  • SHA512 c6797b620f888c48182ee0cdee23778640630e264c93b7efa153e242dba7c83521b3c9ac33aaba927ea6b5e5dcb171b83235f8cc6ac0c78918f01aa377fddbda
  • SSDEEP 393216:+pyylzKO4ouPZZ03V7f3jBFPVXD6KWW8n5RqEdZ:eylO4ouPn0hfXEHWGRv
  • TLSH
    T18CE633413B9405B6DBC1C0368FAACF2D3477EA65A3044BA347D52D82DF921B87A1B8DD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryhijackloaderloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2