hijackloader | f663aaab15536ac4bf5b2f7547470c256faf171149d3ede5dd0199e762bf2792

General

Target
f663aaab15536ac4bf5b2f7547470c256faf171149d3ede5dd0199e762bf2792.unknown
Size 10.3MB
Sample261003-b31tdaaf53
SHA256 f663aaab15536ac4bf5b2f7547470c256faf171149d3ede5dd0199e762bf2792
MD5 d81498ffdbcc8d72fab7cd46f9352918
SHA1 3c38c19e42ce4093efc9d6752da20912ac2ce7f8
SHA512 bc3b26dbb39a7c2e5df48932b4fa9e3fc31950865fad5487dc8fcfbcf98a60a7f222d404dd473df7286a1a4ed02f9e5bacbd40248a04e6375f39a6a7ac0c6a19
SSDEEP 196608:uXx1YFJXnVEVZ7Y2RZ0KzHeZq+w4SDUjE2gWbYDWt3/zdMu4g1StFWsyd:MoJXnqZ7Y2RZ3z45SDUjE2nbRBzJ7c7g
TLSH
T1E4B6331333E38872D1E22636857A28E59DDDBD3820E6E41E3C74CE5DA1BD9D2887F542
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\adv_tracer_profiler_dev
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Targets

- Target
  f663aaab15536ac4bf5b2f7547470c256faf171149d3ede5dd0199e762bf2792.unknown
- Size 10.3MB
- SHA256 f663aaab15536ac4bf5b2f7547470c256faf171149d3ede5dd0199e762bf2792
- MD5 d81498ffdbcc8d72fab7cd46f9352918
- SHA1 3c38c19e42ce4093efc9d6752da20912ac2ce7f8
- SHA512 bc3b26dbb39a7c2e5df48932b4fa9e3fc31950865fad5487dc8fcfbcf98a60a7f222d404dd473df7286a1a4ed02f9e5bacbd40248a04e6375f39a6a7ac0c6a19
- SSDEEP 196608:uXx1YFJXnVEVZ7Y2RZ0KzHeZq+w4SDUjE2gWbYDWt3/zdMu4g1StFWsyd:MoJXnqZ7Y2RZ3z45SDUjE2nbRBzJ7c7g
- TLSH
  T1E4B6331333E38872D1E22636857A28E59DDDBD3820E6E41E3C74CE5DA1BD9D2887F542
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery hijackloader installer loader privilege_escalation
- Detects HijackLoader (aka IDAT Loader)
- Family: HijackLoader, IDAT loader, Ghostulse,
  HijackLoader is a multi-stage loader, first seen in 2023.
  loader hijackloader
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

1

T1055

Defense Evasion

Process Injection

1

T1055

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects HijackLoader (aka IDAT Loader)

Family: HijackLoader, IDAT loader, Ghostulse,

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2