hijackloader | 4c0943303b7f41661e0a2b965678e391896b828669b28c36ec44bb14b3ee780e

Sharing

Copy URL Twitter E-mail

General

Target
Archive_win_203285.zip
Size 817.8MB
Sample260718-xp7knadx3w
SHA256 4c0943303b7f41661e0a2b965678e391896b828669b28c36ec44bb14b3ee780e
MD5 ccb64f3df3e130abd2147137bdccaf42
SHA1 941916157191fa7125c458d669d353144d1ed52d
SHA512 3b738cfa59c64654b430e92e42d264215158940d443f231f499560b4c24942260e495b5b2a5b09d0bf2f413772c88314875b0721fc4ddc9fb18319c8ab021828
SSDEEP 786432:Y8PWo/PYz5SQH0TZVih5X0vHGd1v2zJ8d:Y85gND0TriPked4zg
TLSH
T1E1993305CE2CA7D7FB9776B8B8B09157A93F91B136CDA265349831F49D4AF002F2890D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\UTWV_net35
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Targets

- Target
  Archive_win_203285.zip
- Size 817.8MB
- SHA256 4c0943303b7f41661e0a2b965678e391896b828669b28c36ec44bb14b3ee780e
- MD5 ccb64f3df3e130abd2147137bdccaf42
- SHA1 941916157191fa7125c458d669d353144d1ed52d
- SHA512 3b738cfa59c64654b430e92e42d264215158940d443f231f499560b4c24942260e495b5b2a5b09d0bf2f413772c88314875b0721fc4ddc9fb18319c8ab021828
- SSDEEP 786432:Y8PWo/PYz5SQH0TZVih5X0vHGd1v2zJ8d:Y85gND0TriPked4zg
- TLSH
  T1E1993305CE2CA7D7FB9776B8B8B09157A93F91B136CDA265349831F49D4AF002F2890D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution hijackloader loader persistence spyware stealer sectoprat rat trojan
- Detects HijackLoader (aka IDAT Loader)
- Family: HijackLoader, IDAT loader, Ghostulse,
  HijackLoader is a multi-stage loader, first seen in 2023.
  loader hijackloader
- Family: SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  data/.6PB
- Size 328B
- SHA256 aa298dff33e9dc119cce1fe3232b5c5ea994cd07ba50524e8adb67780df68d69
- MD5 371b79a12ad20e239faa1c95836b3316
- SHA1 b079cfb62c26f33db5a7873e134dc7f45a2ac910
- SHA512 16e3f7aae11f339d6d8c4a3b26516193447a8890b616a07bb1d945ab1f990bde2a56f8e70b2c634d84ede2d9fdadc299b21ed003bf804a7cc9d3172a583eab22
- TLSH
  T1C1E026840B27AFEF4A180055A456356A45C43AA8B3B5E9411C26944B12D1A1AA73A0E1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  data/cache/bytecode-39.rpyb
- Size 366KB
- SHA256 d74c58faf938196d73e01b465b32f9055940626064779456afae856b1f1870fa
- MD5 70972a8308280f9e45596aa97b0df8b5
- SHA1 026c833e13ac58788a94be409006860a2bb1dcf8
- SHA512 5b14028ee4084d3d07eb9ff57d104d4a91612a3a8d3660c735f6459951d0bc41e47999e29874b7e42062cd2dab1bfd17c1b552c596c6742686260c0c5f6b3398
- SSDEEP 6144:iad71GRb0EejU3yfiFE2DzbuJ014QsEel0Oyl0JewbTAboC/7esQvlpYseioW/Fc:ia4peoAyJzbuJ/RE+yUewQboCVQvlpYP
- TLSH
  T12B84230988C710040DBC87A97105FA7CF16C6629A3EB637969E7C6F5FD1E8662D62C0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  data/cache/py3analysis.rpyb
- Size 70KB
- SHA256 2bd784047a637b8de9f4edd9d87d4f7346a3d189a7c88aa592ce248cdf584fd5
- MD5 89d38577258a7df5e6a9b506abc77bff
- SHA1 1b70ed807635fadfecdaeddcad9d2c9550d792cb
- SHA512 565a6baa32ca9cec992567e252029b31975834579d4cb4a67dcf103f6988b7405c806b44b3b8cce066796bfcf8dbf63f023147409ce7d9b2d062961713dc036e
- SSDEEP 1536:Y6KDNSwqoiXumM8GEszg1CR24NjF7Z/hIkFMR22AsMNRSi6xEY3NRG:fK4FJumM68gsjFliwugQikL3NRG
- TLSH
  T191630116815DBB3BB414EEBD7AD6DC44C534F6C03EC603A39F58798852E5D603652BE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  data/cache/screens.rpyb
- Size 125KB
- SHA256 681000f467b010ef05f762b512164566018d01903bd7282cb8b3c0caae4b67bb
- MD5 d9b366fce3a9bc4ed92219d79ad65df9
- SHA1 56cd9c1e1873c2179182d04ef7ce0f557758afab
- SHA512 1ec6cd89acfd0b739a6e02005080af30cfd37351b90ebef3d33271edbb0746d4274bb5f840a2ab984d32931c00fbaa47c0ff9bb3f0bfdbadfbaa2dd29a5a928c
- SSDEEP 3072:Z2epl/0KH70Jp0soBzVtiE58qmgbIclyRldkm2wZ6EL/bb/qHaK1O:Z77jHIL0vBzbiE54gbyDdkqL///qHaMO
- TLSH
  T145C31327BA3D584858A47C16DE81AFAB06E04C0ED68FBB4B42827C9C9C1F142FF50DD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  data/cache/shaders.txt
- Size 861B
- SHA256 f814981af1ca4a1da94c43f43a3d67e4a9e54338dad2956b0d8c55d0eca810e9
- MD5 7f7665676911240d04896500aed1f247
- SHA1 fa1761970fda24c47f2b211f756493d144c879dd
- SHA512 477295c0201a21fe6db87ab97e08d85545431d787fbdd88024e57024505c472d49ff2bdd57b942627b83e05e75bd3e58ebde81342610f28898c7920caf2a725a
- TLSH
  T19311960E33D9C751A5A9AD9E0EB0CD0C7953BD4139CFC9FCE5254D258BD3B025169C92
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral13 behavioral14
- Target
  data/gui/bar/bottom.png
- Size 968B
- SHA256 23d6f947ad5ef7027f7268e3217411c6e24bf86ee2d43a5690ac21fa636e513f
- MD5 c37ebfd1518e16ddd32ff391714991cb
- SHA1 ffd9f232e4bad3e95ee0d3860d701f5f2ba4a693
- SHA512 3e309004973c1460c614f0df5a1377ad930c88d56686f5862a2dc49c1a53465b7aa75ce8c23991e819b65d148a53788d00d53ad523a530704c2a84054d93e67a
- TLSH
  T16D113ADE933E1FA49341ECAA913569F3CF0A1310FAFC746C54479BB109479239085770
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  data/gui/bar/left.png
- Size 751B
- SHA256 2a4c8011e8a39c65f7a9c01a138f373cf57158b2c4e94bb4183acf6434054607
- MD5 b3459ff62df7d2229f49fccbe7a625d7
- SHA1 fa2297c243ad36cc792e1f59db5a087c31a76116
- SHA512 e9e960d029f6fc07891a04508b0797f103ff5b94a9bf74857872dc92cf651aa41af3f70fe9b947ec977d909ae5a9cfb3f2dbf5a8296470ecd337a40a43961864
- TLSH
  T1D9019C84C6559533B2590151E0820A724A216D3E3830DC5C55C73A1F0687F7A2C79C92
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  data/gui/bar/right.png
- Size 1KB
- SHA256 bc80725157a111c45913197e8569530da84c13a4dc4d8ebf954777ce7aadd029
- MD5 f5ec46ff6075ffd3ec56f538e475ca44
- SHA1 6232d9cb51bfbf56867843ef077a8b329269214a
- SHA512 b37ec13106a8ec19778449e11f20bf89312e9bcfda58624ebc003580f69c22bc7d41ac14d749dfff7015af09eae5a17bb9c884bc25ddac1efbf5c2975352259a
- TLSH
  T18D2183C0E645E53F75640262A64762F3CC28A977BC30D71C43C2396B099BFB61E36E66
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  data/gui/bar/top.png
- Size 1KB
- SHA256 4a2d56daee1338243d54ed63e1cec7e73179fcaa5dba3bb3050bc44eec04b667
- MD5 8c6019dcd8cf56db439a08b5a760e874
- SHA1 7f76cfbd88c617e83ff3106e469ec584d01ef995
- SHA512 d5590cec4a054e1e4893e62d6488037d77d554377c28e13a159ab14d01e567260dd3ee6fc95a210a53ed67a7eef76f8b326a69e85323d66f863ca8ea054b970c
- TLSH
  T1C52186EED73E1B505350DCA6603165F3DF1E2300B6FCA86C645BA7740A87A339189B70
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  data/gui/bubble.png
- Size 7KB
- SHA256 f4eaf88b777b3256c5336f6a2e09a8505f98554ec5a12faf1679a3973a8a9463
- MD5 a717b887bf23a0fe650d95a57a18010c
- SHA1 3057c4c354909a446f4d70d547e3899441783fdb
- SHA512 dea2b9340b21614794a65700f077b579d146a692d6820bacf866b80fe673d1d9534dc7d55734de4bcb4410b8561fce4f39f1f623e6e94c1e352cec9c5760aaec
- SSDEEP 192:vzR3KblGhHiG+WsElhnJ3mD3SNnt5u/7DpYx:7R68hCedDtOSJu/BYx
- TLSH
  T1EFE19D42C9AC8266E7F550E18C846B57EE610B3C16BE8FE19C8C0D83CAB4D475B598E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  data/gui/button/check_foreground.png
- Size 446B
- SHA256 81129e5e87b75aeea08c1f5f46926d5aa35c7dfe606d0b1c0ca53e0f48941ead
- MD5 9e822a65265b2176fdbc53192339f5c6
- SHA1 8eb4e5f5a954694259598b0b8c57ebc3cead5341
- SHA512 6d7496e2136d3173f89cfe5c87297118fcb2a4db20e9537cb3c08ecbfb4e4dd3bfeff3843cf12acaf8f3daf216c49504a1fb729b8a4b7d2e76f27e9b120e5ed9
- TLSH
  T1D4F0DCC48E0A0629B0CB157392BFF840D230E29553C6559CA409F83ED205616A40D16B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  data/gui/button/check_selected_foreground.png
- Size 985B
- SHA256 13fc44cd672965ecda2cfaa31dd8e842c138c17d0c2e7bc1095e3dafed272766
- MD5 848642ec2d19ac2f7cdb31381bb9e1c6
- SHA1 2d8c100ef964ac3bd3c112ed6cc00381e7d4cb1c
- SHA512 7728960377c2a4563b670c9e200c0f02e2b1c12d46088b4196288bb02373c03fd17bdb7ff01741423de5ec1aa769761a7e7b25a00fe87b4c8e685162fbb471ab
- TLSH
  T12C1198A75A352C046201A7D6A67AEDA8576593889258F4CE1C39210FFB4C28E539234B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  data/gui/button/choice_hover_background.png
- Size 2KB
- SHA256 1924357871b7cbc654a7384b81550c6b8fe986e82f5ee8dc0fc047733abbead4
- MD5 64ebeaf22b6e45ac0a54f076907dcbda
- SHA1 10fb3e1ffa0d97eab237d88c15cd82be4d2ff1a3
- SHA512 e58f7d730cb91525bc1c7f8d9208d03b45a3749325d17655e8d103d0563d69ccd7dffa46554dc4be284dbb0abad629624273202d9d9759943c836904b36ec913
- TLSH
  T129514081E328003372950154B16A495741880CBB7E68EC6899CB793F477FF3AADB0E83
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  data/gui/button/choice_idle_background.png
- Size 2KB
- SHA256 fb2a27725e428229f0109fb455eb1e330a378dc716202e6ec259f1fd96054f8a
- MD5 36ed531f92541fafba5ab2490dffb8f8
- SHA1 91ac1d15381d4cba17ec0193b2859e62d6a90737
- SHA512 0dd6c9dc1dd0090ddf7496c0b35c0f16b681bfd19d020aa507283b10018b1d4b352636f5ed836b097dc86a4d096825d6ef5124eb94fb8ec1619152cec71953e3
- TLSH
  T19A515F01D35912337A161A68F5FA1087AD468C37B805DC128ECB7A9F1397FB96CB2C64
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32