deerstealer | 7f99bcecc41ac0eb9c6d765aa88ec35a164d80451be4c1cffc9771c92ab6a733

General

Target
7f99bcecc41ac0eb9c6d765aa88ec35a164d80451be4c1cffc9771c92ab6a733
Size 6.4MB
Sample260719-3mfxtagt6n
SHA256 7f99bcecc41ac0eb9c6d765aa88ec35a164d80451be4c1cffc9771c92ab6a733
MD5 5be444b3b278046ea16b5b4c430c37a3
SHA1 1b38bc38085131d4b2fba0f1a013cc11c348dca7
SHA512 32d5599e032ffaed68c406c66a5715ba62d48afe9da991a442c6064fc646e52be214373731957bdf334e73dda036a6d7c2be40a470802657477adb31d78bea9e
SSDEEP 196608:rDbqonGaJHG5XE9+O8n3jxJs3xcJWr3GpKScav:rDbGKGJQ8TYip9v
TLSH
T1B0661213F18E773EE469553A55769910943FAA20A41E8CB396EC3D4CCF2A0602E7FE47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\demohost_std
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Targets

- Target
  7f99bcecc41ac0eb9c6d765aa88ec35a164d80451be4c1cffc9771c92ab6a733
- Size 6.4MB
- SHA256 7f99bcecc41ac0eb9c6d765aa88ec35a164d80451be4c1cffc9771c92ab6a733
- MD5 5be444b3b278046ea16b5b4c430c37a3
- SHA1 1b38bc38085131d4b2fba0f1a013cc11c348dca7
- SHA512 32d5599e032ffaed68c406c66a5715ba62d48afe9da991a442c6064fc646e52be214373731957bdf334e73dda036a6d7c2be40a470802657477adb31d78bea9e
- SSDEEP 196608:rDbqonGaJHG5XE9+O8n3jxJs3xcJWr3GpKScav:rDbGKGJQ8TYip9v
- TLSH
  T1B0661213F18E773EE469553A55769910943FAA20A41E8CB396EC3D4CCF2A0602E7FE47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery deerstealer hijackloader installer loader stealer
- Detects DeerStealer
  stealer
- Detects HijackLoader (aka IDAT Loader)
- Family: DeerStealer
  DeerStealer is a sophisticated information stealer written in C++.
  stealer deerstealer
- Family: HijackLoader, IDAT loader, Ghostulse,
  HijackLoader is a multi-stage loader, first seen in 2023.
  loader hijackloader
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects DeerStealer

Detects HijackLoader (aka IDAT Loader)

Family: DeerStealer

Family: HijackLoader, IDAT loader, Ghostulse,

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2