Extracted

• • Target
    https://cdn.discordapp.com/attachments/1440315843928920216/1520806140483473631/phase2-get-nextstage-20260628-235955.unsafe?ex=6a428897&is=6a413717&hm=ac54c72c5e278228893d7055c13c637dcc2871f7e2f1045be3562cb426a38091&

  Score

  10^/10

  discoveryexecutionhijackloaderloader

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1