Resubmissions

08/08/2026, 02:26

260808-cxc1ssgj2v10

08/08/2026, 01:14

260808-bl4tpszwbv10

08/08/2026, 00:56

260808-bal5hsztfv10

22/03/2025, 04:08

250322-ep7ljsxxay10

Analysis

  • custom tags

    dead drop resolver

General

  • Target
    db06fc0b3a8bef0fdc708948d3110b64eb7e4c9cf51ea0296b13e9f03287e327.zip
  • Size 46.8MB
  • Sample260808-cxc1ssgj2v
  • SHA256 db06fc0b3a8bef0fdc708948d3110b64eb7e4c9cf51ea0296b13e9f03287e327
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • hijackloader

Attributes
  • directory

    %APPDATA%\systemtask_vsv2

  • inject_dll

    %windir%\SysWOW64\pla.dll

xor.hex

Signatures

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • Detects references to legitimate web services potentially used as dead drop resolvers 1 IoCs

    Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.

  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

  • Insecure Codesign Algorithm 4 IoCs

    File was codesigned using an insecure algorithm.

  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • db06fc0b3a8bef0fdc708948d3110b64eb7e4c9cf51ea0296b13e9f03287e327.zip
    .zip 46.8MB
  • Install_58.97.4263.21.03/#Instruction.txt
    79B
  • Install_58.97.4263.21.03/DuiLib.dll
    .dll 519KB
  • Install_58.97.4263.21.03/Setup.exe
    .exe 1.2MB
  • Install_58.97.4263.21.03/WinSparkle.dll
    .dll 1.3MB
  • Install_58.97.4263.21.03/bin/CSERHelper.dll
    .dll 121KB
  • Install_58.97.4263.21.03/bin/GameOverlayRenderer.dll
    .dll 1.2MB
  • Install_58.97.4263.21.03/bin/GameOverlayRenderer64.dll
    .dll 1.4MB
  • Install_58.97.4263.21.03/bin/SDL3.dll
    .dll 2.0MB
  • Install_58.97.4263.21.03/bin/SDL3_image.dll
    .dll 665KB
  • Install_58.97.4263.21.03/bin/SDL3_ttf.dll
    .dll 2.2MB
  • Install_58.97.4263.21.03/bin/Uninstall.exe
    .exe 387KB
  • Install_58.97.4263.21.03/bin/aom.dll
    .dll 7.1MB
  • Install_58.97.4263.21.03/bin/crashhandler.dll
    .dll 362KB
  • Install_58.97.4263.21.03/bin/crashhandler64.dll
    .dll 464KB
  • Install_58.97.4263.21.03/bin/d3dcompiler_46.dll
    .dll 3.1MB
  • Install_58.97.4263.21.03/bin/d3dcompiler_46_64.dll
    .dll 3.7MB
  • Install_58.97.4263.21.03/bin/dav1d.dll
    .dll 1.0MB
  • Install_58.97.4263.21.03/bin/fossilize_engine_filters.json
    816B
  • Install_58.97.4263.21.03/bin/libavif-16.dll
    .dll 685KB
  • Install_58.97.4263.21.03/bin/libavutil-59.dll
    .dll 1.6MB
  • Install_58.97.4263.21.03/bin/libswresample-5.dll
    .dll 615KB
  • Install_58.97.4263.21.03/bin/libswscale-8.dll
    .dll 1.0MB
  • Install_58.97.4263.21.03/bin/libx264-142.dll.crypt
    855KB
  • Install_58.97.4263.21.03/bin/libx264-142.dll.md5
    32B
  • Install_58.97.4263.21.03/bin/openvr_api.dll
    .dll 612KB
  • Install_58.97.4263.21.03/surveyorship.ogg
    34KB
  • Install_58.97.4263.21.03/tantalum.vcf
    2.7MB
  • Install_58.97.4263.21.03/x64/WriteMiniDump.exe
    .exe 277KB
  • Install_58.97.4263.21.03/x64/chrome_wer.dll
    .dll 125KB
  • Install_58.97.4263.21.03/x64/d3dcompiler_47.dll
    .dll 4.7MB
  • Install_58.97.4263.21.03/x64/dxil.dll
    .dll 1.4MB
  • Install_58.97.4263.21.03/x64/icudtl.dat
    10.0MB
  • Install_58.97.4263.21.03/x64/libEGL.dll
    .dll 493KB
  • Install_58.97.4263.21.03/x64/optimization_guide_internal.dll
    .dll 10.9MB
  • Install_58.97.4263.21.03/x64/resources.pak
    9.1MB
  • Install_58.97.4263.21.03/x86/SDL3.dll
    .dll 2.0MB
  • Install_58.97.4263.21.03/x86/SDL3_image.dll
    .dll 665KB
  • Install_58.97.4263.21.03/x86/SDL3_ttf.dll
    .dll 2.2MB
  • Install_58.97.4263.21.03/x86/Steam.dll
    .dll 506KB
  • Install_58.97.4263.21.03/x86/steamclient.dll
    .dll 19.0MB

db06fc0b3a8bef0fdc708948d3110b64eb7e4c9cf51ea0296b13e9f03287e327.zip

  • SHA256 db06fc0b3a8bef0fdc708948d3110b64eb7e4c9cf51ea0296b13e9f03287e327
  • MD5 SHA1 SHA512 SSDEEP TLSH