hijackloader | ab50ea5db097ad33424b53438685d07ffcbeb4bf7db3f3fb3edfb055c3c777f2

Resubmissions

20/07/2026, 21:02

260720-zvsd2aey2j5

20/07/2026, 20:54

260720-zpyc4aex2l3

20/07/2026, 20:47

260720-zk72qsgt6s

20/07/2026, 20:23

260720-y6c8tad14m10

Sharing

Copy URL Twitter E-mail

General

Target
Archive_x64_4745.zip
Size 798.0MB
Sample260720-y6c8tad14m
SHA256 ab50ea5db097ad33424b53438685d07ffcbeb4bf7db3f3fb3edfb055c3c777f2
MD5 cc1bd295508b513e4af3de47e555a6e1
SHA1 a874c0b628a09065cce50f0fb90fe8353cbbfc5c
SHA512 64ee7733472558d70d0c3cdb540f7e6df83c54bb50480d4a1fb5851b60bb9d16df3774d229bfdf5038fb80888a1ab1ab2e4a909ab4175411634de94c29a496ea
SSDEEP 786432:3XYGkZkwR1XLOs+X0vXihnPYz5SQH0TZZoe:3XYK6OBkviVgND0TD
TLSH
T1EE99330ACA39E4D7FE9736B8B4B0C157D52E60B632CF9298F99531F49E8AC045F1C909
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\com_srv_utility_debug
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Targets

- Target
  Setup.exe
- Size 102KB
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution hijackloader sectoprat loader persistence rat spyware stealer trojan
- Detects HijackLoader (aka IDAT Loader)
- Family: HijackLoader, IDAT loader, Ghostulse,
  HijackLoader is a multi-stage loader, first seen in 2023.
  loader hijackloader
- Family: SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Indirect Command Execution
  Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
  defense_evasion
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  data/python-packages/sys_config/__init__.py
- Size 1KB
- SHA256 e296ad5da58e4745782990bcecc8fe8961a8943c05a7b6ebabc014abdc8e319e
- MD5 5331866e85bcc1aac40bb35bd57abb6d
- SHA1 605cabe056cf0c0c4390b271e3ee1ad6bbc9733a
- SHA512 3460a053219e414a7256a3c1580a923025de78004618e1fa4d571438bddeeabe0106902b0855467003284dc8d3bf912e922a003283673f9d95f3b06a066c5285
- TLSH
  T1B0119ED7834D0998F38E4A07059B3B6EC1553C6B55ADCE8839FDD2885350673E083430
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  data/python-packages/sys_config/access_internet.py
- Size 1KB
- SHA256 c42f5f1545809a993fda539b42fe91ec0f582bf673a8b61efab1d66961a6b1a9
- MD5 444492fdc0ba2d91fa0278c0cffc4a95
- SHA1 92abe7a820267e98cec4b1e1d24ce9cc4bcca320
- SHA512 265dea21b427ab7046f1550ab1c5b8b2d0dc1512c8197feb3fd5335f1789fed775867ba3974d6d1f36e01fdbdbf366fe902342d55f46944f3dc3cac5f689e17e
- TLSH
  T13A2108D7874AA819F366835B088FB746D0892CD2166CD96C76FDC80C1781EB746C74B0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  data/python-packages/sys_config/sys_check.py
- Size 6KB
- SHA256 a5e89f958fc8d19a23d745e5533ad96e16763d98583e5ec5cefc4845d1ee3cc1
- MD5 f8168e1e6bbefa5e32691b37b30efec7
- SHA1 ff515cbbb6b1816e55cea3d279c29dcc47ed7c43
- SHA512 73e2b128d7848fab53433147eb0e6a29d430c28d24a0f90862ecdbadc69128e52c956535014dc2b8db26b75863728910ae9c169415d83d576a30e1c007bf9835
- SSDEEP 192:ixccNX+1xxu82kPtytseas7R2iKLJsJp44XN:i/X+o8BO//z
- TLSH
  T1C6D112D68B0B7814F38B86198C83A656A3392E83074C95547DFCD45C2F50AB39AE38B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  data/python-packages/sys_config/sys_file.py
- Size 17KB
- SHA256 ead44bdcdc8934a3454e6d7817bbaeb074b2ffe195cb2268b8adef25cf80c324
- MD5 0b3eadf8a1ebb758b815edf4a14bc8fb
- SHA1 045ac302c58f1e6afb7c8cbcace7d98402ee0f8d
- SHA512 9bf58aa8fd5fae364c99b758775536e05991a82ecad8a93bd986892e0087fbf0756f4c486122566f4c5d829a893edf5b081b5c97ca86f136628ea18452349b46
- SSDEEP 192:AX5EBBE1xnCHrsuWM9IORHCitjhSe7RJU8rzuHurSYKFZs+Ze:ASRJlr2xYKFT0
- TLSH
  T112829AC3874C99A5F322830B188BB78150953C971A6CC96CBAFCC94E9B41DFB52E74B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  data/python-packages/sys_config/sys_spec.py
- Size 22KB
- SHA256 5caa623a26c3eca76facb94b1b71e1a342d5f27b18d12b2d2bf0be2bdda57c4d
- MD5 e79ffc91b5be8e8150b073ce6c33c40e
- SHA1 84b3edb34f99a4887dc35df5970c423f77118276
- SHA512 05fc5c0124338ed1bf9d7e7b03d6107fb3e0b39a181234f8ad8be01668772e366d556c972c176ab8318ac9c1af0bdd9c67159908dbc05cbfa8825a6dd8973584
- SSDEEP 192:+ZXojPQWah40JwmWN9Yx7s8r+fIUnUS41TQN0/nWBM+d2zguHZY:uGUWZTPo+fIUnUU0K52za
- TLSH
  T13BA2ABC7D38C9A94F316432B189FB34A80856CDB125CD49CB9FDC90E2B81EB765E60B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  lib/py3-windows-x86_64/d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- MD5 7641e39b7da4077084d2afe7c31032e0
- SHA1 2256644f69435ff2fee76deb04d918083960d1eb
- SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
- TLSH
  T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  lib/py3-windows-x86_64/libEGL.dll
- Size 436KB
- SHA256 b20c1e14e42da55c13dad3c23a5060ca086eaf5b18b12ef5c60cd7e80276a9f2
- MD5 1090bf4c5495697a1416cd77481cf7d0
- SHA1 94452eed4fa88dcb0a5b3c503a12f3a3b5f23ee8
- SHA512 d205dd98260d033300afe3f2a1c0c06f3bfbf158067fc3290e10ddf6f51eb80b57af56fb0e75a56b82dc3ec49190c5d2c296aa548b64e39b4b004f60a7da89a6
- SSDEEP 6144:CrHQz/GL44uCWgSqTpyGRxyB5EdpmMB6cm+p4HRw0FlA1Qu4P:uudhGDyB5Xa4HRw0FlCQ
- TLSH
  T182947C29B2A448A9D036C038CA174A72DB31B89A0F75F7DF12E5D2692F773D45B39720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  lib/py3-windows-x86_64/libGLESv2.dll
- Size 6.3MB
- SHA256 2d171e91e1fe7205b76dd69ba9f7ddce7910283a5a5111c09c84f5db8c795a74
- MD5 7dde909bd5c7538ac46064741a8da6c0
- SHA1 46b50003be83eab7e0c48ebbd9260b5b021e70eb
- SHA512 a057586a0b566c5470a6508e27764f9662ceaf3b08244c3db3d1e07789e87a30a43f1daad0274a4e3d00b641d3f9f90e9c073a5f7db3fa6d1de7f45c33adc092
- SSDEEP 98304:1DACC5v8sHfvlfkvghk3xlkihzsfFUQOJt6c:CvxkvgfyoiQOR
- TLSH
  T1BD665917F2A281E9C009C135574B9632EB31BC851734BADF2294F6692FB27E06B3E715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  lib/py3-windows-x86_64/libpython3.9.dll
- Size 8.3MB
- SHA256 ff051213109bca8ae55d458c3eb8c9c0aae12a765ecbb45e6b4b20d4b97b8da7
- MD5 32d079f77a2383e262b4a512931fb120
- SHA1 19902535da3cb79c093f59fd597444a96f143761
- SHA512 b1bca949aa2f7b735a9e8e5d4fed3e698f3ce77edb804ec56d0f66d3faffb9d1f82a55bfdfa5393ea5d64cd8379ce9a59a298fa486d21e4ea5f29340d4cde65b
- SSDEEP 98304:Dt85Qi40yDueXVj4ka+Pjd2wSY6XO7dPlMBLa2THxM/UZpMBAOd3+opm9g0vHF6:B8r4pr4OjZR/XBA63+opm9g0vHF
- TLSH
  T160967C23B19150EDD93AC13192975233BBB5BC501B21BBDB2154B7702F72B911FAEB28
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  lib/py3-windows-x86_64/librenpython.dll
- Size 18.2MB
- SHA256 29d7304930809804502f331e47d06b72f07b3a1569eb29e0a12dbc71932915d6
- MD5 773d30682db91d99eed3b6f6a3591fe6
- SHA1 1be09711350cc40dc258d893ca3c0500c71f92cf
- SHA512 b0893ee4d82b5efe59d8a8ff9690579b106da608d04d161093ce4757e0eea62b5e16d84bbf3a422012801cec3c45a570907bab6d33ae5516facb9e57e3940322
- SSDEEP 196608:Vg6lprLkZark54oIFe/IFtRRcYoB/xEOAoP3i:W6lprLkZarkCoaeQzcYoBxEki
- TLSH
  T146176C4BF05268A8C586D174CE2BEB22BB65784C457279DF329457B03F71BC0AB29F48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  lib/py3-windows-x86_64/libwinpthread-1.dll
- Size 344KB
- SHA256 00d784e7e002c1b01f3146c87f30030f169843988f87c9631cb2df211979286b
- MD5 da67da022bbc1bb9409e3328c1cb64e1
- SHA1 e1fd29f4256d7066f05d113cb8e96e1aebaa38e7
- SHA512 24ba4936ff149f0875b3e4c7e36e80f941130faccd4d6296d68c8af8b0e647c37d0822d477218ab0b3d4b51f24cd1dfa1ace54adfbd175d122036c3a7e787ebf
- SSDEEP 6144:Wo14rtZLc1fPm3YjZxgMOKSjkPDNjYBlplydMofn6cHqq85l:Wo14r/cBPm3Yg8SjoYvplydMofRHqq85
- TLSH
  T1E4744B8BE754DA7ACA1146318CBB0B097337D04067979F5BAB2CD2783D8BBC4DD99608
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  lib/py3-windows-x86_64/nvdrs.dll
- Size 14KB
- SHA256 068b0c02c881a5d8587a24929e30d8c596305543ae6da5f264f8230a2e45d300
- MD5 c48d5218e5f97b2064c4002d4b30c435
- SHA1 4ac56e31bfb9c5036d60afd6de46a3f1e41f2ec8
- SHA512 3e54fe5174f121528d175ac691c5d36cee63031823c9e09d603d8955312046f57f452e33ffa4863698597849102f52711c3d8738933c07cba12d1f49e611c44c
- SSDEEP 192:rKFj3Az2SjQ0bnUdPIPKPpCxeELcNiTw/dUfYa2GzEfw9vmQ:rKejQ07KPUKueELcNiM/dyDzCw9vF
- TLSH
  T1D762E7069B5524BEDE4AC17FC2771762FAA0B960076219C70371F2650E71FD42B3D8AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  lib/py3-windows-x86_64/python.exe
- Size 101KB
- SHA256 652f72976536214578a6ef848d7359495e02db58846d15ea3a85e90ef1040dc9
- MD5 d11142598cad7ca67caf7606470bbd00
- SHA1 f6d35808803e2c7eaaa85d2f1f756b06495771aa
- SHA512 87b8533b53f87bd8ce0133cd949b0b5393dc3ce02235b374f73be41cea0fa0697da15bee65ec9cf0b8109b549b85659cee38ffb39df763898f584671ff9e2e1a
- SSDEEP 3072:jOC3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:qcQ+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T115A3F10AAF5616BED921403FEAA70562D7B0FB6223911CC71211A3311FB7BC1AD3747A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  lib/py3-windows-x86_64/pythonw.exe
- Size 101KB
- SHA256 092c282f21cdedf3d533dfbc3c77401856de863833904fc09a1d3668e8d50181
- MD5 8cd16e17df02782c111ef7475bece461
- SHA1 e368b52a96d656c6635df6717bdfad13572ee746
- SHA512 8029576e56a28b9f1975cb28b093c4896bdeee8b7ffe4596bdd9fa4ab7bc277906c7dd6aa7c33375a1fbbc5182ef009e70d7feee1689d4c7ed6510254cbda4f0
- SSDEEP 3072:yOc3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:TqQ+IFCumUGekHRvEuO3go9kfnQ
- TLSH
  T149A3F10AAF5615BED921403FEAA71562D7B0FB6223911CC71211A3311FB7BC1AD3747A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  lib/python3.9/__future__.pyc
- Size 4KB
- SHA256 791de268946ce6bca07aea7fb44c9ad0172b374bea4b290c38fa6e9c1efd5e44
- MD5 2d68b1f1a4da598a147bc9e375534570
- SHA1 fbf957813a63fd6d7bcc347eb5d4f221ae1e3d62
- SHA512 1c841e412d336bbb1d11d1ce903f1d076af1f9375e74733106ab69e081534948fd1d5ce30949ef139b5e95369fec6badfbfb9f8ca8ba3ef9b54f9a8a3b683709
- SSDEEP 96:Gg1NzUuGd+P2sKNwWwD2j82xnCg8Q/Ks/qN+Bj0ui:L4BRdwD1YCM/KsSN+Bj0ui
- TLSH
  T1BA81860A694549AFFE47F2F2A2C911C14F59C2BD2F94603A365C52443BC3892937B88B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  lib/python3.9/_bootlocale.pyc
- Size 1KB
- SHA256 9858005ffc5e24dbd8c8324aa7a1c677da5f4d256da7970053cf8320ddd295b9
- MD5 b310c1aa498564e607b7323a4c1e5675
- SHA1 9d52941323913140830ccdfdffbcf6916b18d193
- SHA512 1b75a52813a372e7d5fce372b9319c3c8e832754bd18ad6003a8a0f1f106668f01f69c82abd9c0f282439342d406e8a269793ee4139408c5cc9fede8b2486d50
- TLSH
  T12A21024A0B015E4BFD21FBF476C5822446B985790E1FB9591715C27A3D0E25C6E514CF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral32