Extracted

• • Target
    Setup.exe
  • Size 17.2MB
  • SHA256 506461eb9cdf0a488c4955188e47b317481932c7427c2994f83192b5f0c0bfd8
  • MD5 c7014aa28e0aceb8c34e6d1e3c6ef986
  • SHA1 f3b9ed878d15af93f42e801aa1533a8fa8f1a79b
  • SHA512 7d6b4ce2972da3bb4e83c27cc2fcd7cc192bc51ac4fa32f16e8a1a4ddbd3f4db86f1c61f4cb51d366862f7869616b27aec5ba33962afb1c7af1177b006a0351c
  • SSDEEP 393216:+pbs7d4HdaCn7xbKN+6LYMG2nJ+11iFuXE7wAbOphzUvoQ/enDWX2:e84HdB74N+6LYlPiwAwAiLU7GCm
  • TLSH
    T11B073381F7E9F4E1E2A1D073590ECB2549B6F36CA3824F5A19A9BF050F528D1DE830D9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryhijackloaderloaderspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4