hijackloader | e46594ff5a752f6271b9e19ec981c90cfc38a6a5b97b46dc07f147231c912eac

Sharing

Copy URL Twitter E-mail

General

Target
hashmanager.zip
Size 3.7MB
Sample261007-tm77mabt91
SHA256 e46594ff5a752f6271b9e19ec981c90cfc38a6a5b97b46dc07f147231c912eac
MD5 efe4e6da63debe93dabb9dd53d348ed1
SHA1 c783b1ca20338dc8f2bdeb9f5203aaf175f3e458
SHA512 3e03432eaef9c62e555566ad5fde8352d4009730378f5da1e17f66fea80de3703537e6a0215e5f4fb5092dca21907ca2c891c68c3472edbb785ce8f1e5f93c25
SSDEEP 98304:dxbIYcWVNBFyeaWL4JwFGXzSFHzHtWwKAhX9T:8U3Tb4JwFGjEHQAZV
TLSH
T1910633E2A1515408841DB9FE2EB36CCCDDE885E0C308B4F8995715E7F7D8E46872B2B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\RivexAccelerator
inject_dll
%windir%\SysWOW64\pla.dll

xor.hex

Targets

- Target
  HashManager64.exe
- Size 3.6MB
- SHA256 ac7bfdcccd7ac9216aa95626f52e01dfe7ea9881577de3733f3661ae0c683e20
- MD5 627a003577e467fc40ad0ce7182f8af2
- SHA1 8b16a9f195ee44927fcf36e0fa9e462ae02d53a0
- SHA512 4e6305eddb435091ee1edff888e84dd962850a57524bee9aec782d908b7b9911ce7321fcef893deeddabb74e0a4008900fd4b2447f3d3dfec4832df3b1d5fd65
- SSDEEP 49152:P5L+mmS+7LuPv4ECGOf2kq+AOYIgaWr6UryUFFjwvpC+KIVVSDi489cuAnT8hrqa:P5JmS+HuS/fK3bL8jClS
- TLSH
  T106065C62A385B53ED09B1A3B583BE714993E7F7139168C4B5BF4188C8F355813A3A34B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery hijackloader loader privilege_escalation
- Detects HijackLoader (aka IDAT Loader)
- Family: HijackLoader, IDAT loader, Ghostulse,
  HijackLoader is a multi-stage loader, first seen in 2023.
  loader hijackloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  Microsoft.VisualStudio.QualityTools.VideoRecorderEngine.dll
- Size 184KB
- SHA256 ad7ae1df63dc9f6ee4eabbeb4e9c0f98b2a1b1d69ad8bde9b564e998678310c4
- MD5 01dc40c8eed7ca14008da6adfb4eb476
- SHA1 6db3344864e00e7cbd27fa212a89b7db0e23d0f2
- SHA512 6b79efd89b22b3468a17cfd086c0a301980c72de9af8e7dcc2f23659cf84288f65bccee0ae1e4169a1b746f2e49f5d220bb16351066e22ab2c53e248e5d63449
- SSDEEP 3072:I3L+vYKVnpM9aBy37ItsUn0h05ilgCQzeioerIAy57dvCNVL1eCnQAM:npMMaMtF05pgvr87piek6
- TLSH
  T14704491076E48931E6FB1A36B876992A497F79220FE4E2DF1750166E1E316C0CE34B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  bResourceStrings.bpl
- Size 544KB
- SHA256 13608aa205e934e3e0b3ac504e1589a41285f9197f6f53be01c2bc59f46b6837
- MD5 e954c33a4f1d57ecf977f3409d3fe0ac
- SHA1 205691dda52b9becb59afbedf0e1739c0025f423
- SHA512 6e5ee88ae179adfe45e2e6d76c48a4c136630f5dd10f535a387ade271c8b91d2699efff6f4d49c12f02111feeea26a787e87486d876575d317356fae0fbf6d65
- SSDEEP 12288:7+oJnQ+k8oYgrhiE2sZmNePPip0fzSvsKpRjga+4:7+oJQ+k8oYg1iEBmNePip0fWvsKpRjVp
- TLSH
  T1AEC45F1163FE86A4F6F73F38ADF459104E7A7C67A934C19DC192084E8971E809AF0B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  msvcp_win.dll
- Size 480KB
- SHA256 4b218a354d58368cbbd884b58e6539ce38e54247eb6e0b5c67f202e9cec067a5
- MD5 66e604c9e8bb7fe0d02902c3c041e461
- SHA1 9dcb34d86fd45e75e34667183b0790676dce99be
- SHA512 c3027fd1b09c041b22750d302bc9f67cf88f82a082c3af792276ad34806b6b822286b9bebc51928a837cdeba3d00c06acd6cc3085c3c9cbd67a172df05bda923
- SSDEEP 12288:VDprVN3S7dLYu8AB5A5Pb4lGqLHK1BvSVJashUgiW6QR7t5s03Ooc8dHkC2esSaa:xpu7dLpA5j4nHKnKU03Ooc8dHkC2eraa
- TLSH
  T1C0A43C337A460AB1E48923B4328D536283F9EC654761A3C357DFF6A9BF152C06A336C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  ucrtbase.dll
- Size 1.1MB
- SHA256 e0bb6f1a8606fd8988f93255a5c69e89970da6a30ff60be22d3f90ac5d20e56b
- MD5 359a14ce507a0d0ada72127ae5e7d439
- SHA1 951b1fbc667ffed0b9961bc14a5e7c37bae52afc
- SHA512 d6151dc504aa469a275e2ffc25a014995c72dbcf6509e33a679202a5c3f0f4e8f7fe283ca46120cfe53f13cf0b2548e040ac1840fdb615986a9ca7497f7edec0
- SSDEEP 24576:th84y2E/fKgq25i20+cQAKEtP1zEaoBX8mcvIZPoy4EM2jk9i:P84vmZNAKEtP1wlbMjc
- TLSH
  T18F358C10BB88C0B7DCA971BD079DF67E09AD72900B28A8C37BF44BEED42C1C1A576559
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Process Injection

T1055

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects HijackLoader (aka IDAT Loader)

Family: HijackLoader, IDAT loader, Ghostulse,

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8