hijackloader | 69b4237948ac88c62cbf829cb93024675a1619a23f3604f7ef76bbba2c98375e

Sharing

Copy URL Twitter E-mail

General

Target
PLS2.zip
Size 6.2MB
Sample260905-nqr2xstdjb
SHA256 69b4237948ac88c62cbf829cb93024675a1619a23f3604f7ef76bbba2c98375e
MD5 cc4980bf427692cc9faf62362a064ccc
SHA1 9ec4abc9c3a097ec255138d07dd4fe538ec61103
SHA512 f9f09adddff8a0053af6ebd0fdb996d25c133d982d08a2b3c3a9114caf6256df9e9e3b04a678c45dc11377da46f3872479e7c66ddb6d7e92f984432ebebc1233
SSDEEP 98304:efL9Ngy6gG68Gg6g+SxfkzMiunEAbAmn6tT0Cpt6ARPBqg+1GEXR4w6WHqJ:eDIyA6Hz2fQMiunE8ln6tj6A1bEXRNO
TLSH
T1C9563345DCD672BFD874FA39B828025635364985406273DDC2388C5C5E09EF2ABBF9A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\DidixResearch
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Targets

- Target
  ToolkitCo.exe
- Size 2.3MB
- SHA256 b5f52026101317daec58961904d81ee1ebda06f1313ba2900787c00b2c04bd5f
- MD5 59f965fb0991545e5dd96a037a92cb8d
- SHA1 e3e3c1b0df9557fbbbdd783037ff8fcae5759ca2
- SHA512 6e184509f38f77d9e35c8218a5b8c738654c372d6129816aa9861e9b5e7d959c169783d4d5b12b332facf5ed02fdcd604f0ade3c80ab7f41b423bb5f5ed90eab
- SSDEEP 49152:Lto/cIESFOWTESrM9cXUL8lSHMFFo4rB46x98bOwx:Lto/cBSyFL88Z
- TLSH
  T118B57D1362844036D07B0A3B4C7FD78C693BBE20AE969D272FA45ECD4E376816C39657
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery hijackloader loader
- Detects HijackLoader (aka IDAT Loader)
- Family: HijackLoader, IDAT loader, Ghostulse,
  HijackLoader is a multi-stage loader, first seen in 2023.
  loader hijackloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  mssp7en.dll
- Size 525KB
- SHA256 1a279027ff5df2f3f768b3654a36379a89e44502a1767b1015edade36f0cbfa1
- MD5 f91b613690bf25347cfccee6d0f01bd1
- SHA1 e3b145859e68cdcb01001bdbfb777d3a732b38c8
- SHA512 cf9466fcc186bafa01f382dec887275c736917f5a765d3fa0fc2907b82d76257ef68ae4840a94083e16f6d35fced15e833429374257fe8c81cb05da8c41b0fc9
- SSDEEP 6144:ezWzO86Rxpfx4x+y1XxqkEo2z20hqGjZFClx2MOnU1IOW8jPaTw5:ezQtWzKQy1XxqkEfjvO32bOW7T6
- TLSH
  T11BB49E333081C07AD23E23719D59F27817F9B96299B1A20B7FD8973D2FB15D06626392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  msvcp_win.dll
- Size 480KB
- SHA256 4b218a354d58368cbbd884b58e6539ce38e54247eb6e0b5c67f202e9cec067a5
- MD5 66e604c9e8bb7fe0d02902c3c041e461
- SHA1 9dcb34d86fd45e75e34667183b0790676dce99be
- SHA512 c3027fd1b09c041b22750d302bc9f67cf88f82a082c3af792276ad34806b6b822286b9bebc51928a837cdeba3d00c06acd6cc3085c3c9cbd67a172df05bda923
- SSDEEP 12288:VDprVN3S7dLYu8AB5A5Pb4lGqLHK1BvSVJashUgiW6QR7t5s03Ooc8dHkC2esSaa:xpu7dLpA5j4nHKnKU03Ooc8dHkC2eraa
- TLSH
  T1C0A43C337A460AB1E48923B4328D536283F9EC654761A3C357DFF6A9BF152C06A336C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  starburn.dll
- Size 444KB
- SHA256 8218bda3803fecc05418de4ad951a35673f4a3b51d0ac3584f5a3e4599c6e343
- MD5 b171593a23147872cdd2d4250637550e
- SHA1 d0c7669ae9b64b247f97c099e41e15626302a8dd
- SHA512 2370853e73f427cccbe35b102e1151eb7b31397fd22b92f5e3b9eaee07db4158c3a574674616cea11e38c24d7f3642b54eaa0e08b05b647ce640a6a69e9857a5
- SSDEEP 12288:j/gzbnBCGqx8Vw5wTVZs9d2RXkGHwL9sBA+V/2B:7UCGqxeyoXsbo+sBAq+B
- TLSH
  T1E5A49E22B9A0E873C98209B4464CB735BEBAF470172A81D7774853DEE8293D3AD34757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6 behavioral7
- Target
  ucrtbase.dll
- Size 1.1MB
- SHA256 e0bb6f1a8606fd8988f93255a5c69e89970da6a30ff60be22d3f90ac5d20e56b
- MD5 359a14ce507a0d0ada72127ae5e7d439
- SHA1 951b1fbc667ffed0b9961bc14a5e7c37bae52afc
- SHA512 d6151dc504aa469a275e2ffc25a014995c72dbcf6509e33a679202a5c3f0f4e8f7fe283ca46120cfe53f13cf0b2548e040ac1840fdb615986a9ca7497f7edec0
- SSDEEP 24576:th84y2E/fKgq25i20+cQAKEtP1zEaoBX8mcvIZPoy4EM2jk9i:P84vmZNAKEtP1wlbMjc
- TLSH
  T18F358C10BB88C0B7DCA971BD079DF67E09AD72900B28A8C37BF44BEED42C1C1A576559
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects HijackLoader (aka IDAT Loader)

Family: HijackLoader, IDAT loader, Ghostulse,

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8