hijackloader | 400aa45042634a36ee677e904e4b5c4e6c2a139c2bbe9b585b60ac4da02623a2

Sharing

Copy URL Twitter E-mail

General

Target
400aa45042634a36ee677e904e4b5c4e6c2a139c2bbe9b585b60ac4da02623a2
Size 10.3MB
Sample260730-erba5ayhld
SHA256 400aa45042634a36ee677e904e4b5c4e6c2a139c2bbe9b585b60ac4da02623a2
MD5 9267c3d87303ef74dd4c7ccfb626fe6b
SHA1 ebe0697965d16dbfd4464e628a80d6811cbcf1fc
SHA512 d55fb6c5ef6fa1f3df242038111e1e268a6aee19d1dc106297cfc1e2aa8cf77fea6447b82d9bbed710d220a6087845971f9b2bfd81c8e4905137c410a74674cf
SSDEEP 196608:CNx+s+iSUBejlRZtLpEPoM1oWLplf4zJSwT3+RdDH128osLp3xwSvsQBYAY2BSe6:CP+s+EBe/T3M1oW7fmSwT3+7V28obSvU
TLSH
T100B63368CF7C10AD685793B8FED6C182BFF2AB6580D1D953D4BD04A8A5DB063C279C60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\com_dev_queue_v6_debug
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Targets

- Target
  BCGCBPRO1100u100.dll
- Size 4.7MB
- SHA256 e650ae0d297b0de8b7a708003dc07e5a5ed7542b39e0519dcc11be582986117e
- MD5 b560e9da72827308c322f8c18c76617f
- SHA1 100e0c71d2890bc5ce600768e31c6c6b13f5695d
- SHA512 dccc1ad8ec97f559ef09f3bb245daa82defe558ec561c24512c08b0043851271cc54d09dc46216385f09afadfa287d86ff65061aa8ff0da0ef11adaca80e31fd
- SSDEEP 49152:inJn0WQqXU2JY33XK2dMYD3rzMwbzUVujdhHVUkdpRlHtgvDDyQkmMbJxY9XZ+x:inl0WOlK2Gw3fMwboVuH6kXRR
- TLSH
  T1C1367C30BE7C027AC5DE95B59E3E366F4D5EBD50472842C75168385AB870AC23633E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  CreateMiniDump.dll
- Size 26KB
- SHA256 f6ddce7554a0d1b9786ee1822cc026fe97be5b4778ecaf349843fe79769907f6
- MD5 49405ba66b7a666c379a0e92812d05f5
- SHA1 7017394286c11c4cdab34ea3cf96fc7d79599149
- SHA512 bd3533d53ce77fb9219854992d1eb505859253726bdfbde8704272f4047022c5aa1ac1f6ffb439fdceb291f435a39936365f3c1085e451254b91f150f4d5f72e
- SSDEEP 384:P8IvV5BgO/P3f/VinPVPL08AIYikHKKKUe8JN77hh1ZyHIYikHK1e8JN77hhEX:P8A5BgEvYndQiYibUZ3h/ZyoYib3h6X
- TLSH
  T106C26CA60A5A4422EF9B4EF071E0E3761D7876D677D090EB6258C1560FC47822B683BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  FeatureSwitch.dll
- Size 62KB
- SHA256 9023552a39117772e5d44c52deef13b1066825f49b538c3849f6c7192091b711
- MD5 5ca0ba3dbf6e8adeb99f1ed97cc3123f
- SHA1 5af6a411b275c26365b7bc11f6922e5364aa8a28
- SHA512 5a64def2f357038a03cdfc8913dbaa06da9a2d947f18733df9dc6cd454b70f5eb1cabd4d6b342ae7bde2f00fddc9293135a48a99b913d18f271a9010b67d2d22
- SSDEEP 768:1yyiUPdWUUUWhvPNgpf4YYA/Q1K6h053antEDpm42jFy5vynA+QFAChYiAHfY3h/:0wvBuA/9mEk7ZtnA7ph7j3hCH7c3htz
- TLSH
  T113537D0565958033F3E35E382AF4E2B94D7F79422BF1508F2B6905B94FA17C19A3837A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  PPUtilLib.dll
- Size 300KB
- SHA256 178e832158c7fb2fffbeebb26b2a0ce35b710731b7cad51a600cfb7fe03a4fd6
- MD5 ccb172f4b6dac0374e203b9e90342e29
- SHA1 04473b0dcbe13bea53cbc90961fab9b206441f5f
- SHA512 dabe7b182ef06fc2d61886b568336fb03cce69431c045fc9f0ce0219d4967369d651f15e3c3c966fc538d89eba814d087eb817e5d95bbab44673cb3204586748
- SSDEEP 6144:wKg3kdXZ9g1Vg+kIWxpZ11OZhsl+KFJqzD:Ok/96kzpjFl+MK
- TLSH
  T15E647D207A568E37FAFA02349EBF661655ACB9100774C2C7E34C9E8EE8315C3993574B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Stati-Sync.exe
- Size 108KB
- SHA256 5d501d3c51576a402a301470f7bf919b87e0f8a0ed40172dde3d7c1c622ccdc3
- MD5 a3d2a2cdfe0f51e0194de4e66f5a4e59
- SHA1 9e74abf1cb6ce8d4d8fd1a564fac9dfa3df806bc
- SHA512 5cdb2276cc69fff03ae7ee7566f46e3fc0603d0f7e0337f39f089ebdfa4563cfa6cdb8c83c3839c5767212578cc195f87d19a903ed50e26c7ca6643db5489005
- SSDEEP 1536:5x38QUYa1eDrFhKweJ13+V7XIw9mBiL5axtuA4Bd6JVoJGLn05UuiFCMR10NTkGr:PDijCUfjyMr17C0IEnOnDLCg/taX21
- TLSH
  T1DDB33A21B7449827E972D1776AF8FF294A2CE0B0479110DF72682DCDA9709D31D3A1EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer hijackloader loader
- Detects HijackLoader (aka IDAT Loader)
- Family: HijackLoader, IDAT loader, Ghostulse,
  HijackLoader is a multi-stage loader, first seen in 2023.
  loader hijackloader
- Drops file in Drivers directory
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral10 behavioral9
- Target
  XMaxUtil.dll
- Size 79KB
- SHA256 5665023d6154010e09c38da961fee756abc5d0673dd62f9b9baa0fa70697f4bf
- MD5 0ec5fd79b9693951a807b6685c85ba01
- SHA1 48b843d2ab1fa7e7518ba4a402972539796dcec8
- SHA512 81d89b788de920da59a054e8440dedb2665356be46f6f3fe0dcaa4db98960870a8a47492c48ac40dfe14783bddeb8e08ebd2e179ba0c554ef41dd408add69a99
- SSDEEP 1536:KC7rwJtwGQj8CIw5Up5wo6nJp2Zh89MhCbV5OGpwwJfmMMwoT733hNr7M3h6A:KCJ4f6nD2ZaMIbV5OGpwwJfpSXrR
- TLSH
  T1A6835C527E198422E6F6057079BC6B6E383DB2622BE500CB53171A4D0DB0BD3BF78756
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  maxcodec.dll
- Size 110KB
- SHA256 895b1c78f7dc2402a4214c4150b027da78cb5df5468dc9127f4b8362fbce0f76
- MD5 59ddc1ee0aec813f455c5efe2e57ecce
- SHA1 e6d28991fa3ea3934af753a7332ebe75c79f010a
- SHA512 a19c43ca3d3719e44883374f4b00bfc8403622650bd956afa29b65c7df26e8020750e8c68e4666ac01bd54d466fa41bc6f6248004f2ae36a941c1b1e1d02f8ea
- SSDEEP 1536:pI1xxpkfYLtPZdjKL/VUPB3I8FPcoyIO8PjG35Olh9y8eg7l3hZY7qL3hl:pIhp+YLtaLN4B3ioQ8Py35OlhxlxYE
- TLSH
  T19CB38D12F6818033E5F70679A8FE8B7D0A3E71648F9610DB7B8467995D206D32B352CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  maxkernl.dll
- Size 185KB
- SHA256 de80ee1540042b5c6a72fc29bf122aed388f443ea2d55213791f01f174d5c59f
- MD5 1acd68411179a9cabf34adb9b76e9895
- SHA1 b2c4bdcc3c9fd279d2cb77dff1e56d72ada5cbfc
- SHA512 7dc7cd7a966c7d621ef52f0d7f7b5113c4e5320350ad93db9a62e92968b0ae3b890e4f0e12db5a3c42c58b326e8b9492e91d1c33c67cf99b5effc809754ab37c
- SSDEEP 3072:mIpzfcRp2PaPNDbRfOs7EaWTIEkrUiZLxGy24Qw8sjOJN5OtTSk5XXqea:XzURp2PaPNp97ErUEkrTZLxinN5OlH5Y
- TLSH
  T1D6047D21FA41C13AE9F70171E7FF6A9E283D9566033444C723E81CAA5D606D37B3929B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  maxrast.dll
- Size 157KB
- SHA256 f39c0e4a85171484bade6171f4be8b2951e5de7c39f041160b9da2a44f4220c1
- MD5 056d60dbbe43ddcf7729937319b75578
- SHA1 643695ad727732d592af8dc4b9ddc10db18667f5
- SHA512 d2823f0c228c14444c27f2c3264b5fc80f0651d5cb5594e974be4942ec5665aafbad7f1bcf92359565a54e92638582c5b646c6477621b8637273a766bfa5f0ff
- SSDEEP 3072:0FJ2JIbY8XzQA4oASEl6N2Ld8Rj+N8IUpgtH55WEXmK+6jTdyAi8LuL:0FJ2JIbNzKff6UJudJsHn/2K+aTHuL
- TLSH
  T1F8F38DC2F9529E7ADADB087ED6AAAD3414EE0313077701E73665C941EB407C32DB528B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  mfc100enu.dll
- Size 54KB
- SHA256 ee7d56095c1ccaa93fb2e86ae9381f77cc60cb332dbdcca49da63896349f98b8
- MD5 3cf266ca615e03dc6c2afac0443d606b
- SHA1 92aed0a7811c9ed1eb1a5b87b296253b010ec962
- SHA512 838ef68081b91ca0c3dcc9e095fd472681c4bd23304b8b90a8d7858c06d848ffd8f41ddeab32e504741a8ebebdc1515d47eef5b31179fd95be3b5c69a60881c2
- SSDEEP 768:HgIdijcuEhCgy4Y6B1CLPLNq5f/nWHBNheOU2fd5c1viY+w:AI0ify4Y6B8PLNYf/nWHNTd61vj+w
- TLSH
  T1D143736263F98605F5F77F752EB546605E3ABCA2ED38CA0E1640614E0972F50DEA0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  mfc100u.dll
- Size 4.2MB
- SHA256 515f8c3683c36ffaf64d01693bb83eeb1f0dbfddecf95ec4d7c3f08e7f00c0dc
- MD5 6358cc2a77f3c12c5b9b16190d5477f7
- SHA1 47ee1895c6e11248fa6cd2a594f6395335453d35
- SHA512 8eced5237cbd287b8a66044580b60fedf2a324ba377b2ac1e332f5bcd7aac6b212e9c4da1cd5f3b1aeafcc313da80040e634e05fccea60f803aaad19a18e6e7d
- SSDEEP 98304:ZhRRni1aewd5ZnDRB+5sCpffcU1jQV7jztl8bo1pKkXwLNVk7hERtCDJFLOAkGkh:Zhi1/2JIg9JFLOyomFHKnPAK
- TLSH
  T14D268D227ED990B4CDD321B0469E7679A26EECD4273406C351943BFBE9743C16E3898B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  msvcp100.dll
- Size 412KB
- SHA256 cd28daeda3c8731030e2077e6eccbb609e2098919b05ff310bef8dce1dce2d8d
- MD5 ed40615aa67499e2d2da8389ba9b331a
- SHA1 09780d2c9d75878f7a9bb94599f3dc9386cf3789
- SHA512 47d94c5f4829a0f901b57084c22b24adefb4aec2f7b8df9ea838e485dbc607aa837ed6d3c7186159499c44a3ff488fb04f770c624649a406854d82cd3baf72ee
- SSDEEP 12288:AOb8zxr1aWPaHX7dGP5HrhUgiW6QR7t5qv3Ooc8UHkC2ebe:AOb8Fpa6aHX7dGP5Ov3Ooc8UHkC2ei
- TLSH
  T11D9428237A4649F5E1D223F46289932143F9FCA40721B3C3E2EFE1A99F583D56A33951
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  msvcp_win.dll
- Size 480KB
- SHA256 4b218a354d58368cbbd884b58e6539ce38e54247eb6e0b5c67f202e9cec067a5
- MD5 66e604c9e8bb7fe0d02902c3c041e461
- SHA1 9dcb34d86fd45e75e34667183b0790676dce99be
- SHA512 c3027fd1b09c041b22750d302bc9f67cf88f82a082c3af792276ad34806b6b822286b9bebc51928a837cdeba3d00c06acd6cc3085c3c9cbd67a172df05bda923
- SSDEEP 12288:VDprVN3S7dLYu8AB5A5Pb4lGqLHK1BvSVJashUgiW6QR7t5s03Ooc8dHkC2esSaa:xpu7dLpA5j4nHKnKU03Ooc8dHkC2eraa
- TLSH
  T1C0A43C337A460AB1E48923B4328D536283F9EC654761A3C357DFF6A9BF152C06A336C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25
- Target
  msvcr100.dll
- Size 756KB
- SHA256 25d1cc5be93c7a0b58855ad1f4c9df3cfb9ec87e5dc13db85b147b1951ac6fa8
- MD5 ef3e115c225588a680acf365158b2f4a
- SHA1 ecda6d3b4642d2451817833b39248778e9c2cbb0
- SHA512 d51f51336b7a34eb6c8f429597c3d685eb53853ee5e9d4857c40fc7be6956f1b8363d8d34bebad15ccceae45a6eb69f105f2df6a672f15fb0e6f8d0bb1afb91a
- SSDEEP 12288:amCy3y9cSWI5vMBEWL3XU8+n6ODOlMFgvXmteA5RLTDz7sHA9p++/pj:amCy3acqvM6WL3XU8+n6ODxgf4eUH7Tt
- TLSH
  T1D8F49E11B692C073C17221300629D7B25D7BB9711034A46BBBD99F3E1FB47C1EA277AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  ucrtbase.dll
- Size 1.1MB
- SHA256 e0bb6f1a8606fd8988f93255a5c69e89970da6a30ff60be22d3f90ac5d20e56b
- MD5 359a14ce507a0d0ada72127ae5e7d439
- SHA1 951b1fbc667ffed0b9961bc14a5e7c37bae52afc
- SHA512 d6151dc504aa469a275e2ffc25a014995c72dbcf6509e33a679202a5c3f0f4e8f7fe283ca46120cfe53f13cf0b2548e040ac1840fdb615986a9ca7497f7edec0
- SSDEEP 24576:th84y2E/fKgq25i20+cQAKEtP1zEaoBX8mcvIZPoy4EM2jk9i:P84vmZNAKEtP1wlbMjc
- TLSH
  T18F358C10BB88C0B7DCA971BD079DF67E09AD72900B28A8C37BF44BEED42C1C1A576559
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects HijackLoader (aka IDAT Loader)

Family: HijackLoader, IDAT loader, Ghostulse,

Drops file in Drivers directory

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28