hijackloader | 6e4069b7c8adebb1785b19c9a50a2aaa7f5a56df5cfde1e6d9e4b7969cf2eda4

General

Target
2026-08-23_ea29f7dbe96f2097315f627b8e15d834_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
Size 41.7MB
Sample260823-vb3nfatsc1
SHA256 6e4069b7c8adebb1785b19c9a50a2aaa7f5a56df5cfde1e6d9e4b7969cf2eda4
MD5 ea29f7dbe96f2097315f627b8e15d834
SHA1 bd0edc8ecf0888d30b5a11402d81bc4c8eee77a2
SHA512 51355ad7c1908488a3d360c9e8ba0d9cf2b8c8b77e1347dfa7987c6481d15e5fa746ca0f27b4e40f7849ef19b5aea2edb1dfff98c3c9ecdc8684e7b96e77d91e
SSDEEP 786432:uZXVTYoHTit5iuPNgbfRs457899vUEgT1uTGHjSYXGWQNOWTvnVc0hHQ:uJVTdHTitlFg1rAUEgTw6HGkxWTvQ
TLSH
T162A73311B3D429E9E0F58D354B57E820EF33BC0252B18AAA2B94572F1FF7691C93A345
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\fastream3
inject_dll
%windir%\SysWOW64\pla.dll

xor.hex

Targets

- Target
  2026-08-23_ea29f7dbe96f2097315f627b8e15d834_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
- Size 41.7MB
- SHA256 6e4069b7c8adebb1785b19c9a50a2aaa7f5a56df5cfde1e6d9e4b7969cf2eda4
- MD5 ea29f7dbe96f2097315f627b8e15d834
- SHA1 bd0edc8ecf0888d30b5a11402d81bc4c8eee77a2
- SHA512 51355ad7c1908488a3d360c9e8ba0d9cf2b8c8b77e1347dfa7987c6481d15e5fa746ca0f27b4e40f7849ef19b5aea2edb1dfff98c3c9ecdc8684e7b96e77d91e
- SSDEEP 786432:uZXVTYoHTit5iuPNgbfRs457899vUEgT1uTGHjSYXGWQNOWTvnVc0hHQ:uJVTdHTitlFg1rAUEgTw6HGkxWTvQ
- TLSH
  T162A73311B3D429E9E0F58D354B57E820EF33BC0252B18AAA2B94572F1FF7691C93A345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery hijackloader installer loader
- Detects HijackLoader (aka IDAT Loader)
- Family: HijackLoader, IDAT loader, Ghostulse,
  HijackLoader is a multi-stage loader, first seen in 2023.
  loader hijackloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects HijackLoader (aka IDAT Loader)

Family: HijackLoader, IDAT loader, Ghostulse,

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2