Extracted

• • Target
    c875012919be75070006b3967b7cedf2c5e4f1803d610dcd34ec7cd05aced4bc
  • Size 8.9MB
  • SHA256 c875012919be75070006b3967b7cedf2c5e4f1803d610dcd34ec7cd05aced4bc
  • MD5 dbd46d6a4a15faed18b20be54bf49b40
  • SHA1 1d0c6f84cd93ab412d1f6889f2210b6d0302ed6e
  • SHA512 bf2534b4eb3831b463558936855349f9e6d22e0ea8b2f262ea33027f4f390b142faa1d7ce323be2362f1398ece2ab368904110b0499b87a800cd337150427672
  • SSDEEP 98304:K60IGHpK9SFNGfW1iYleD0HgwGSMh9TlUwEVlGGvdTXmrpjFCE9EbLJs5MM5ZSCw:50HcSnGfklezjzm/DVWdgPZo/54
  • TLSH
    T13F96337EE142B8D7C4819B76357CF720EFC5FE83E4B1A1CA558543A142DBB2DB0626A0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiondeerstealerhijackloaderloaderpersistencestealerupxadwarespyware

  • Detects DeerStealer

    stealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: DeerStealer

    DeerStealer is a sophisticated information stealer written in C++.

    stealerdeerstealer

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2