General

  • Target
    hashmanager.zip
  • Size 3.7MB
  • Sample261007-tm77mabt91
  • SHA256 e46594ff5a752f6271b9e19ec981c90cfc38a6a5b97b46dc07f147231c912eac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Family
  • hijackloader

Attributes
  • directory

    %APPDATA%\RivexAccelerator

  • inject_dll

    %windir%\SysWOW64\pla.dll

xor.hex

Signatures

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • hashmanager.zip
    .zip 3.7MB
  • HashManager64.exe
    .exe 3.6MB
  • Microsoft.VisualStudio.QualityTools.VideoRecorderEngine.dll
    .dll 184KB
  • bResourceStrings.bpl
    .dll 544KB
  • layout_link.pdb
    27KB
  • msvcp_win.dll
    .dll 480KB
  • queue-prof.lock
    1.4MB
  • ucrtbase.dll
    .dll 1.1MB

hashmanager.zip

  • SHA256 e46594ff5a752f6271b9e19ec981c90cfc38a6a5b97b46dc07f147231c912eac
  • MD5 SHA1 SHA512 SSDEEP TLSH