hijackloader | 394b415859c18c3aab01d28745744544307ced89fc8176df2046b090414aa06d

Sharing

Copy URL Twitter E-mail

General

Target
#Pa$$w0rD__2024--0peɴ_Set-Up!.zip
Size 62.2MB
Sample260903-qvadsahn9t
SHA256 394b415859c18c3aab01d28745744544307ced89fc8176df2046b090414aa06d
MD5 d5619cec2ad152dd6096fa690b5d7918
SHA1 2cce404e02f1f56cf82ac55b24267a055a57ae47
SHA512 71568a7e3c2d867ab2cb0a597a4721bf07c12705f7b4eb319b9fe02adfa7b6c6f306f40b2ffe66c57303f6e69f85b3e615f09f2686340db815a701e37daf5904
SSDEEP 1572864:rPtKZbfHg4FjFDjr0jb0U/5qZRWfC3VsfGQTDZN4sM3wXUTF:rPmbfAiFDjUp/5OOowr4salF
TLSH
T1AFE73358FF8D421AD78AAF779957536EA2F286124F94F93F5A5118002C762F10F0EB0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\component_util_v3_0
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Targets

- Target
  Qt5Core.dll
- Size 6.0MB
- SHA256 94c3a0a28b10c54661d13a1ae3bc6e55676cbaf20dd143d21e77ad7693b0afd0
- MD5 36907b3150ee3b6eb67bfeffd4773c30
- SHA1 362c198620f7b98f6eba4a00a01046ca29034de5
- SHA512 7eeb19c8d71addc68ccd8b028e521d389fc6bedc594b33398eec3f97a4ea505116a115aa15a20ff66645b6a2c67c8e5df8ad65463f11f7bc1c11a6787d63ebd7
- SSDEEP 98304:QnssWapSAQBqYJsv6tWKFdu9CfkCDQxqf5bgw:Qns1ap0B9Jsv6tWKFdu9Cc0Qxqf5bF
- TLSH
  T12F567B57BBA64154D0B7C23CC9D78216F6B2B8118B228ADF4259A30E1F377E1693F712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Qt5Network.dll
- Size 1.3MB
- SHA256 f1f60c10f1822155f6f8688c29682edec3bda63f5919d6d4df567a1cb5523150
- MD5 464a3904cfcff47d480b04e891b3bf25
- SHA1 0fc403ef469f34cece3bd26af008d632beffc70b
- SHA512 5b6856d775906cd398b7685a40f0f8f49130b4bf3e3ea29dd2f77a7def324ab688450c551bf7e9462b40bb42b6a4281a7b74f8d585b1ee5d751b93273df95009
- SSDEEP 24576:4O51NG2bq1mhQpCR4SSUVxiKZLha+s23pUlSuMEFR+PoTbbwU:m4hQoRpSUVYKZ9vs23pUlNMEePoTbE
- TLSH
  T13E555B53B39542A5D13AD239CA4B8903F672700193A69BEF5669CF582F33BE2673D340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  bin/003-get-errors.phpt
- Size 2KB
- SHA256 da47b7e56e2bd1893d7f7dbb21d136a56ad8b3abaef3b44edebae82b97790bec
- MD5 e5b1e0f51bec4dae88a8c4c75a783562
- SHA1 6ca1d51f54b646eefc412e1677dcfa4f2eed2e44
- SHA512 cc1066e9f8eaee967e45643e35b07a5bc672da6bc50a010a080dd8fd0bb5ab877b3c0444ebd30619c4a4e0b4a9f5ff67e8e384d86a32acaa84f08ec672634458
- TLSH
  T13A410018A44E67A30E9360A0C7907C49B4E6C67F92125924BF4ED26F6FCC462C5F91DF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  bin/007.html
- Size 15B
- SHA256 7d9b4b03fb98730b578bed02451442068b1c6ad7cc22cc8a32a9dfd3abe39f72
- MD5 c68e6ee89aee068bc3f4eef32a9e0c8b
- SHA1 fbb869b65d85790e5f433baa2a267c335b64f060
- SHA512 8902c57020ccd00dfe46ac629e3a4bb70b5592b742c20a706e3c0564e8c71ef6c3baca3eca131dcac274cc1d30c25b1d9fe49a633559f6e2a547420e699b7b9b
- MD5 SHA1 SHA512
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  bin/Microsoft.AspNetCore.Mvc.Abstractions.dll
- Size 262KB
- SHA256 9bb1201305a99fc6be9a2d90daed5b8b9e8db9c54a183eae9bccac14227a3ca1
- MD5 7bc25b7b712fd3cccf6b2e9c696e3797
- SHA1 80ce57df5f10c0f63eddc387cad9cae4e6992a05
- SHA512 daa142c823d23029005a05d60e4876545458c2790bd86286026a0f474077ea0c7d86fe2924601467788c174aceb7f3652be4646983ba6841c8a07bcb605dad77
- SSDEEP 3072:eVwCAhQ13ysRD+ZZPiJ91OWZfOJ+NaRg4IpXuWlkP7wowQFcjCQrwtzbmDoBn+Co:NFs1I0bZGUNaGGxwowGyy39o
- TLSH
  T19A446C3A7B688F16F67F563CE1DBD512E6B4B1832364C6C70B64D9981E43BC89E30192
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  bin/Microsoft.Build.CPPTasks.Common.dll
- Size 519KB
- SHA256 d61ba94de1bb41c3361b21917d316364bbf53e756453378bb2a3eb1a57819985
- MD5 d062aecb41d6f67f9ff00d2dba3a324f
- SHA1 d8925b28df4d60429642de6e59e1e56b6bb02e2f
- SHA512 689c7111605ca29ed975a3b03b20545cf73ebe47bd78c2c8254ce04f2c6ec9c31f290f4da5f03c5e6a35ef178a688474ef354e329d41b5f2bb00dcdba98934d5
- SSDEEP 6144:rUnh7dQWDum1vARNM8KmcbpODut6KwdpgVHuspzH2gQ+Lb:ahJQWDvvWOT7bkcpLHZb
- TLSH
  T124B4B3112BF8A62AF5FF7B3564B8A11085F9BE96BD76D26D0D101C9D0A72B40CD21B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  bin/SplDoublyLinkedList_add_null_offset.phpt
- Size 367B
- SHA256 0755036e4ee28369117459aaeb618a157cc7c1a496b725070ab3a08abe4a7b0e
- MD5 9011e28d9c37708a052079d04e48c8cd
- SHA1 f1d423a83fd9ba809a7075eea8f2a41d51a52832
- SHA512 81fd90bdbde339fd553dab6aa1c7b1f32e55cf6a27e6c315a61b1975572a2e235708abc6dfb239fae0c2246ff122b3a6ad01649a5d448d42bfe994505b8fd839
- TLSH
  T154E061D1908E056A85F300C8315D2A4775B282A9F11D8930C8174175B9F04D3CDCE0C5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  bin/action.yml
- Size 1KB
- SHA256 b8a79405221d4713536137cd68d6696826237cf21bad2f1c5e4cc31c21c027c6
- MD5 c585e4c192b65b319a30d35f6bc5e963
- SHA1 23e5919c87cedb8899683f6bbf66d2d43037725b
- SHA512 b9137d4497791ba57ade44ec47be10a0fc38b2c4a61a7e620411b8a6366789c7b026ea85a49b61434ca00c925753c454213b5b5a0f90985bbe4bc0a6786f36bb
- TLSH
  T1A2217B615CC219CAA1405D4E5DA1085B526F820384121CD47FCDD3A97F074DCF2F03E4
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral15 behavioral16
- Target
  bin/autoload_016.phpt
- Size 384B
- SHA256 20c8c3866389d138898b0872595490f8f46e4b2a9a035a616134cad63af08008
- MD5 299346d5da6ac4e16b3522629d608d92
- SHA1 1862b4d54d65674ac98debb75fede952261af72e
- SHA512 c87e66050294a1977c8932c327b36092c548a7434e4acf339da8094d80be61cb7db86f89a4e46aae8afd8e1d0d3df2875a74221e1c45de028cf2edbba2920d4e
- TLSH
  T151E0AB4D502A9084E1F300EC58063128142D214BDB681270C37A036298F80C04D2B50F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  bin/basic_connection.phpt
- Size 2KB
- SHA256 d1647eb75d793f7680297886bcb0c710ff6deb832cb696450d6714d4261c7995
- MD5 3fba183f74020611ba5a8fa5325541ba
- SHA1 c430c20c0a6660e7e75d9c2c54a5921b0df73e36
- SHA512 ff2155115f0512e2d1d80807ec88a40c8be53981e26b9a6fa68e6e21c35311ff3d678b4299d6215bb1fb12fb03be3271fdf903c10085f6b64fa1ccb661a0aaee
- TLSH
  T16541B00333DA0C5861C688D06C15D950F03BE80B5F8A5AD5236AB2CBED78DF1DAB56CB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  bin/bug73957.phpt
- Size 452B
- SHA256 de861b5479838f217262a861ec685dfeffd5304a87f40d28d9a21b0d6c64d194
- MD5 0f70d53de74835189d4d2de881ce0633
- SHA1 68118b7f8fd5bb4456079ae497895863ac318930
- SHA512 83501356215b819825bf93c6f9dcd1a49976d66934655038237e2b59e65e948c4ad20661ec745dc698a12560c537b5f65eae71156b0228ead9f3b18566b495ae
- TLSH
  T1AFF05CE621922893C071040B384AF8A5A3CEB6E843C6DB0B010C00AD8AE20A082F9A0E
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  bin/file_get_contents_variation8-win32.phpt
- Size 1KB
- SHA256 a13cba05a74443c41acaf69a1377acdb32b4c3089a0e8c4849466fa0df3d301a
- MD5 d2fa5e9d0628cdea318f7dd7125ac7f9
- SHA1 eafe3d03123d8d974fedb401e5231185b46e1b55
- SHA512 e7af484f54355586597b345914bd7781fecaed4f114dcd9fca136dfef353443f71975b27cf6cfe448ef851e41f8c19b6623a8dbb402061d7641fd27fdef3dcf4
- TLSH
  T15A41F128A48C3062E3F15C4637ABAA9F6191C18F930C5E3467DE855839EC97C13F52DD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  bin/get_properties.phpt
- Size 406B
- SHA256 c530a3e7b282ad23673dda121987a01820674f3eb20a8cf0aa315372e2a49740
- MD5 41a1f0fb66f56659927d417745153014
- SHA1 18c79c017438dbfad207c7d83b291f27dcc864c0
- SHA512 dd3131e6ed8ee262089648cd207f401c45b0c49ae021dc1a1c598004f6ff115523fdce360a8c38fac0d964e1867e9366fe7103ac564b6b532b9551cc23465262
- TLSH
  T1A3E0AB49C8F40AF260F318C058399783A4B6268ABAED2920D4BC0215AF98094CA03C1F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  bin/gh9032.phpt
- Size 593B
- SHA256 8ad3453687cdf738d6673edee08a7ba07d5f1eac159f87492f20cbdec900141f
- MD5 74a90a314baf1980728f11b0f16b883f
- SHA1 7a2c19542869f640a723612827f04400de5bf66f
- SHA512 0ff84a029ac607ca3c419ed8f7b901863b031bea7034f31a008944cd8911bae8d77877161ce370ae97e4ef909d7d1a5d7a87dafcd7b4800041435230f87916cd
- TLSH
  T1E3F0A21670592A70A1F740D35C247061EC8BD5DEA15C0EF9EC09829CC94805C775F336
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  bin/hxds.dll
- Size 1.2MB
- SHA256 6aabb0c5b7b5b04e6dfef398cef35af3d9e18a6ab302794fa9f113f91380e3d7
- MD5 0a459886e1584024676898d073808059
- SHA1 efed176bc2275191e7513f6a232950930fbf9e3f
- SHA512 7c2e99b768832d4e9fb5610441190606f6a41a0fd17ff85d77873fca06ab85d8007187eb46dd2bf6304cb135fcaf46e05465145c77105d87838222788648f824
- SSDEEP 24576:+jlP9VBNtxQrzfFJrj5s5wcof9fZky20yrJMzLm:+RFA5OSj20yrJM
- TLSH
  T153456B17F2648391D066E139895BCB9AE3727CC61F2007C72668BB2E7F736E15A39311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral29 behavioral30
- Target
  bin/lab/Bass.Net.dll
- Size 676KB
- SHA256 5edc14702b84ebed5653a6cbf64b3a06ffe4e500be10d449a0c68e5a2040f9ef
- MD5 e0f9ca774f0e3b40d42de2793f46245a
- SHA1 9c2e4403e0b5123196b0118fc6678d305a246efd
- SHA512 896e83ac8fe989369bc8f433242e5d0cc03611a24c3376d7f5662b1a0d252979f2a4329b9287f72d5903a82880facea393720fe105aeeb2138ec3315dd4ceb37
- SSDEEP 12288:YhAilLJOTeBtAnoxmbkq+ll9iBzrBFmVTmrBVv9lRVsg:WAilLJ3AoxdizFmVKrBVv9lRn
- TLSH
  T163E46B057BE8BA07D77E1374A0B24A1657B0E046276AFFCB4E9484AA9DE37C18D413D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Visual Basic

T1059.005

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Executes a VBScript file via the Windows Script Host.

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32