Extracted

• • Target
    fd81468eeb74e091f0b328344cb992093a92d10c18dfe9ba45ebbd88a4673d4b
  • Size 3.8MB
  • SHA256 fd81468eeb74e091f0b328344cb992093a92d10c18dfe9ba45ebbd88a4673d4b
  • MD5 7961bfb8d78690f646a2ae6073720cae
  • SHA1 353a00cb5ee48bc2b033e2ed488b1dd9ff031f6f
  • SHA512 17a28a1cb15084c236158c44455855a0e3e49b1bfc87536f81d817e1df5b910045bda3f451335b2b60c9d3baefe58b0b131bdce88641deda65fe5151df10dc52
  • SSDEEP 98304:+peXXR4eP1kfbWVfJkxAPQuyR1CunJM4rukPK4ew+JC:+pG4C1lVfJkCPgP64rmC+g
  • TLSH
    T166063352B79154F8DCBEC332EF0ECBA10A77D732A2045E4791AD2E062DE71E552071EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydeerstealerhijackloaderloaderstealer

  • Detects DeerStealer

    stealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: DeerStealer

    DeerStealer is a sophisticated information stealer written in C++.

    stealerdeerstealer

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2