hijackloader | cb8053c819c587f3e81b0201d27d686ccdd3ca042cb4c2ed50b84e7f2ee2232f

General

Target
2026-07-22_24254fea4804740c56a045ab3dafd12a_icedid_mespinoza_njrat_ryuk
Size 6.3MB
Sample260723-ak3dtabl8w
SHA256 cb8053c819c587f3e81b0201d27d686ccdd3ca042cb4c2ed50b84e7f2ee2232f
MD5 24254fea4804740c56a045ab3dafd12a
SHA1 2bac12ddc98123efd2f2f8381e50e3a2f848c96f
SHA512 e781b3234ee43f19bfb9300639703115ece1c3c10b3514cc600dffefb24e60257c40666aa59d03e41477051a52602ea1f0f55907266366146400e0d29831c29b
SSDEEP 98304:BYWU/qWCGU3pnQsW1Vh5UoQ2v041LPIRrTOE6JeNhAzgsoe9R7pCwoscWYqXjAnp:BhWCHZjW1jpQJ5K8NKgsoSCwJYqXsp
TLSH
T1EF6602852A9881E4C0B6CA78C5F54167F2773C40AFBAEFEF19596A1E2D376D04D38321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%LOCALAPPDATA%\ProcessSystem
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Targets

- Target
  2026-07-22_24254fea4804740c56a045ab3dafd12a_icedid_mespinoza_njrat_ryuk
- Size 6.3MB
- SHA256 cb8053c819c587f3e81b0201d27d686ccdd3ca042cb4c2ed50b84e7f2ee2232f
- MD5 24254fea4804740c56a045ab3dafd12a
- SHA1 2bac12ddc98123efd2f2f8381e50e3a2f848c96f
- SHA512 e781b3234ee43f19bfb9300639703115ece1c3c10b3514cc600dffefb24e60257c40666aa59d03e41477051a52602ea1f0f55907266366146400e0d29831c29b
- SSDEEP 98304:BYWU/qWCGU3pnQsW1Vh5UoQ2v041LPIRrTOE6JeNhAzgsoe9R7pCwoscWYqXjAnp:BhWCHZjW1jpQJ5K8NKgsoSCwJYqXsp
- TLSH
  T1EF6602852A9881E4C0B6CA78C5F54167F2773C40AFBAEFEF19596A1E2D376D04D38321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery hijackloader loader
- Detects HijackLoader (aka IDAT Loader)
- Family: HijackLoader, IDAT loader, Ghostulse,
  HijackLoader is a multi-stage loader, first seen in 2023.
  loader hijackloader
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects HijackLoader (aka IDAT Loader)

Family: HijackLoader, IDAT loader, Ghostulse,

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2