General

  • Target
    m7f3s7CfkPLmRZfy.zip
  • Size 2.4MB
  • Sample260919-tk599adn2w
  • SHA256 4aca31a1b1aad01dd065330ffb82b43f1e33c951d280849d4ca136a6b4c14169
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • hijackloader

Attributes
  • directory

    %APPDATA%\int_oracle_terminal

  • inject_dll

    %windir%\SysWOW64\input.dll

xor.hex

Signatures

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • Revoked Certificate in Chain 1 IoCs

    One or more certificates in the signing chain have been revoked, indicating potential compromise.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • m7f3s7CfkPLmRZfy.zip
    .zip 2.4MB
  • CelSu16.exe
    .exe 188KB
  • TenioDL_core.dll
    .dll 544KB
  • dispatchreg.bin
    1.4MB
  • monitor16.xml
    33KB
  • msvcp_win.dll
    .dll 485KB
  • ucrtbase.dll
    .dll 1.1MB

m7f3s7CfkPLmRZfy.zip

  • SHA256 4aca31a1b1aad01dd065330ffb82b43f1e33c951d280849d4ca136a6b4c14169
  • MD5 SHA1 SHA512 SSDEEP TLSH