General

  • Target
    PLS2.zip
  • Size 6.2MB
  • Sample260905-nqr2xstdjb
  • SHA256 69b4237948ac88c62cbf829cb93024675a1619a23f3604f7ef76bbba2c98375e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Family
  • hijackloader

Attributes
  • directory

    %APPDATA%\DidixResearch

  • inject_dll

    %windir%\SysWOW64\rasapi32.dll

xor.hex

Signatures

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

  • DLL Hijacking vulnerability 1 IoCs

    Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • PLS2.zip
    .zip 6.2MB
  • ToolkitCo.exe
    .exe 2.3MB
  • __MACOSX/._ToolkitCo.exe
    178B
  • __MACOSX/._bindinginfo08.cfg
    178B
  • __MACOSX/._guardinit.json
    178B
  • __MACOSX/._mssp7en.dll
    178B
  • __MACOSX/._msvcp_win.dll
    178B
  • __MACOSX/._starburn.dll
    178B
  • __MACOSX/._ucrtbase.dll
    178B
  • bindinginfo08.cfg
    4.3MB
  • guardinit.json
    21KB
  • mssp7en.dll
    .dll .ps1 525KB
  • msvcp_win.dll
    .dll 480KB
  • starburn.dll
    .dll 444KB
  • ucrtbase.dll
    .dll 1.1MB

PLS2.zip

  • SHA256 69b4237948ac88c62cbf829cb93024675a1619a23f3604f7ef76bbba2c98375e
  • MD5 SHA1 SHA512 SSDEEP TLSH