Extracted

• • Target
    Setup.exe
  • Size 7.6MB
  • SHA256 9f4e92d43db6f77fc3b5e7a764afb703ed327e595ff693bde6e03d7eb0e1cf19
  • MD5 677d3e43a0ee2b00841b8e6eacb4f2b3
  • SHA1 14881a228c7220a44369127c85f64071627b5f22
  • SHA512 100000ae2ad1275ddd1bd107992a6b4469add5da49f89dffe456f5aecc46edf8c863069488cfc48621fe5d734213cc3f0aae586f44cef87f8fafe4c2e13475ab
  • SSDEEP 196608:+pxrLLQ8TE+rOVhRj15/GgLkJSnm8UAdmap3x8wrdBUx:+pxM8DOHRjPGg/UAdRZx8wrdOx
  • TLSH
    T1B0863341738862FFC1B1EC329F06EB825176D7EA1120AF474A992D181ED33BA77435DA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryhijackloaderloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4