m7f3s7CfkPLmRZfy.zip
- SHA256 4aca31a1b1aad01dd065330ffb82b43f1e33c951d280849d4ca136a6b4c14169
Behavioral task
behavioral1
Sample
CelSu16.exe
Resource
win11-20260911-en
Behavioral task
behavioral2
Sample
TenioDL_core.dll
Resource
win11-20260911-en
Behavioral task
behavioral3
Sample
msvcp_win.dll
Resource
win11-20260911-en
Behavioral task
behavioral4
Sample
ucrtbase.dll
Resource
win11-20260911-en
hijackloader
%APPDATA%\int_oracle_terminal
%windir%\SysWOW64\input.dll
HijackLoader is a multi-stage loader, first seen in 2023.
| resource | yara_rule |
|---|---|
| static1/unpack001/dispatchreg.bin | family_hijackloader |
One or more certificates in the signing chain have been revoked, indicating potential compromise.
| resource |
|---|
| unpack001/CelSu16.exe |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/TenioDL_core.dll |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/CelSu16.exe |
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Mar 21, 2018
CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Mar 21, 2018
CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN
count=18, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=108, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=48, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=100, id=1, productName=Unmarked objects,
count=3, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
count=5, id=150, version=20413,
count=31, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=109, productName=VS2005 build 50727, version=50727,
count=196, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=67, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=25, id=123, productName=VS2005 build 50727, version=50727,
count=231, id=1, productName=Unmarked objects,
count=37, id=138, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Detects HijackLoader (aka IDAT Loader)
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=59, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1204, id=1, productName=Unmarked objects,
count=8, id=259, version=27412,
count=11, id=260, version=27412,
count=1, id=256, version=27412,
count=127, id=269, version=27412,
count=24, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
Oct 20, 2023
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=131, id=1, productName=Unmarked objects,
count=1, id=253, version=27412,
count=1, id=256, version=27412,
count=110, id=259, version=27412,
count=93, id=261, version=27412,
count=619, id=270, version=27412,
count=21, id=260, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,