Extracted

• • Target
    772b547b8e01d86b2d4a32e308a42388f298ca4faedb0d6a3b78fb0d4dce8826
  • Size 8.7MB
  • SHA256 772b547b8e01d86b2d4a32e308a42388f298ca4faedb0d6a3b78fb0d4dce8826
  • MD5 6c769798db4163b768fb72c76c7de62e
  • SHA1 81acd63ace51ee93a780de764e355f588a401ad1
  • SHA512 7d12a9a0804c38fb451121225d5b14a238cc702bf8953a775cf2fecdadfba8fadbc31f8696ee45b1201d769d760867af8494fcb027d7d41c1464672ef9a8859d
  • SSDEEP 196608:+pB2LmlxRbw4vVkIKikMNCi5DdWzBv44usq2XSPUcy7hr:+pzPKzMkcM44uS3r
  • TLSH
    T17D9633423BA1E0F6C228C6B59F02C7E252FCD65F1B819E6BD6543D12EEA34B422171D7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydeerstealerhijackloaderloaderstealer

  • Detects DeerStealer

    stealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: DeerStealer

    DeerStealer is a sophisticated information stealer written in C++.

    stealerdeerstealer

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2