Extracted

• • Target
    OPFZCRNP.msi
  • Size 5.0MB
  • SHA256 c819eaf9fd91ed4bb72e62085344d402e7317eb6ded9e6a71663c85a242d7757
  • MD5 debf45863852b6daaa9f51389a2932b7
  • SHA1 4f4f22158fb10c2c7daa0babe2417a08f4a9aee0
  • SHA512 8e0319367c3c1aec74a15adb8a4061478b9f6a0d85136af303cd2858391bed48c5b45743a18b65e83c815a98e694e3faf92cc3afe8b8e70ab00b15595818f9da
  • SSDEEP 98304:ULHHlEF/+mxA3lZ5dFvI9jfqTNUROsONQscG1gg/s78HVMa:iitlAnFsquTONEGOO
  • TLSH
    T1C9363328E8C81313CFC66BB242054D876927FE8173270416B93B3AADADF177746947B6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryhijackloaderloaderpersistenceprivilege_escalationransomwarespywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2