Extracted

Extracted

• • Target
    452a98403a11d4f0be84588e4ee59fecc594c297110c21215b8b31d398703f59.exe
  • Size 13.6MB
  • SHA256 452a98403a11d4f0be84588e4ee59fecc594c297110c21215b8b31d398703f59
  • MD5 c9f32ae870e1326c3a02502f8af0e77a
  • SHA1 a35c706146b1b1ccc9ed0f5c6c8fb51e0f944eff
  • SHA512 d029556aba9a72f3a14e14b33bfa50025696e996ebef1341cd0d115f0773d4e9f17f44d8193d160e9bca2b44f8c241f212be5cf9d5c0304cdbc319ca8364074c
  • SSDEEP 393216:+pHeNCchKL35M454TYs7q80D+sba4qkiAKGbddoA:eAC9pVMYq/0KsbaPHGRdoA
  • TLSH
    T107E633163B81B8F9C5BA8538CECCE34812B7E76552A39ECA68C51F161F471F7094B4E8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  6b14f00e19290ca45facc408a2d566e1credential_accessdiscoveryhijackloadervidarloaderspywarestealeradwarepersistence

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2