Extracted

• • Target
    𝗦𝗘𝗧𝗨𝗣.exe
  • Size 97KB
  • SHA256 33705f092b0dfb7f8a01892bfe687d972f4d2b09090ff5e332a8fbf6082a56f3
  • MD5 8c29f8199264aa005c4dfbf51889c2d0
  • SHA1 2c0ddee4504e0779b8c979fe527c53386d570471
  • SHA512 28131b7aa26695e55867203614df1fbfcd46ba1706f8d60a7323bad8f8e029b51cbfe0d628a5206e16876421d33d23516cfc56ca5bdce1b4d7b554f61958f493
  • SSDEEP 1536:6wqHuhIxHHWMpdPa5wiE21M8kJIGFvb1Cwr/8+st7Sy4w6K:6wqOSwMpdCq/IM8uIGfx/8+stuw6K
  • TLSH
    T172A3F551E66DBCDDE41CC0314975E4F25E24EC317680A25EB3F6BF0629712A3F90A93A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryhijackloaderloaderspywarestealeradwarepersistenceransomware

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4