Extracted

• • Target
    aee7978dc8889e53d9cbd36ff78c5c26d92e52365591accc0a7ba2afbcc40dbf
  • Size 4.7MB
  • SHA256 aee7978dc8889e53d9cbd36ff78c5c26d92e52365591accc0a7ba2afbcc40dbf
  • MD5 a01f2e58d64fb224b448a19100828d53
  • SHA1 19340c80e820a5a40f1dd04d489d846a33702c27
  • SHA512 3865dbaec311344f509ef74839e622af4ccefa3784ede3c1e50c8b6cca9dc73613b0f7cdc46681ecb54ca16e7ab6540e937b7f9ac0d3ecbf588dac496c7e8885
  • SSDEEP 98304:+pJHoLSblSMpjVj7WdUVBYBva+zDRf9DRl6R3dNx+fSOkDnlLN:+pJHBbNZB5BYBy+fRVD76R3Z+frG5
  • TLSH
    T1ED363351B752F4F7DA364236CF0AEF629176E7B3B2406F8B52A14E053C97351A20B4CA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydeerstealerhijackloaderloaderstealer

  • Detects DeerStealer

    stealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: DeerStealer

    DeerStealer is a sophisticated information stealer written in C++.

    stealerdeerstealer

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2