Extracted

• • Target
    http://gbcu.org.il

  Score

  10^/10

  discoveryhijackloaderloader

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • .NET loader stage by imphash + section/import shape

  • CLR-hosted .NET infostealer assembly: GDI screen capture + AES CryptoStream + raw TcpClient exfil +

  • CLR-hosted .NET infostealer: reflective assembly + browser cred theft + AES socket exfil

  • ClickFix v8 — Suspicious named pipes: CPFATP_ (CLR profiler abuse) / Sessions

  • Durable RSA-1024 CAPI C2 handshake public key (modulus). Cross-wave anchor.

  • Embedded CAPI PUBLICKEYBLOB carrying the DURABLE RSA-1024 C2 handshake key (e=65537). Client RSA-wra

  • Embedded RSA-1024 C2 handshake public key (CAPI RSA1 blob, e=65537). Client RSA-wraps the AES sessio

  • Fires on any WP-002 chain component

  • Fires on any WP-002 chain component (prologue OR durable imphash OR embedded C2 key).

  • Injected CLR-hosted .NET infostealer (memory scan): AES-over-raw-TCP + screen capture + WMI recon

  • Network IOCs for the WP-002 stage host and C2 gate

  • Executes dropped EXE

  • Loads dropped DLL

  • Use of msiexec (install) with remote resource

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2