Overview

overview

10

Static

static

1

LICENSES.c...m.html

windows10-2004-x64

3

LICENSES.c...m.html

windows11-ltsc_2024-x64

3

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

flomo.exe

windows10-2004-x64

10

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/app.js

windows10-2004-x64

3

resources/app.js

windows11-ltsc_2024-x64

3

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    flomokdh.zip
  • Size 138.9MB
  • Sample261008-tx48qaa16z
  • SHA256 7a6b3c9b79d6a05b05e2990a4ada3ec3351ab3292e56c008da8d73fd721ff624
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
hijackloadercredential_accessdefense_evasiondiscoveryexecutionloaderpersistenceprivilege_escalationspywarestealer

Malware Config

Extracted

Family

  • hijackloader

Attributes
  • directory

    %APPDATA%\LZW

  • inject_dll

    %windir%\SysWOW64\input.dll

xor.hex

Targets

    • Target
      LICENSES.chromium.html
    • Size 14.5MB
    • SHA256 c54df6af4da6dbe8199869b48d1a7c8c457bd96441d944377b83e173af2bb2f7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral1behavioral2
    • Target
      d3dcompiler_47.dll
    • Size 4.7MB
    • SHA256 2e79c59f71594b59d63755e0a86aa1f13272846faa54519a1b4700fc9aa3b57c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3
    • Target
      ffmpeg.dll
    • Size 2.9MB
    • SHA256 7c4f47f7d8281ba1e5538814ff28e4820be30b97f0b349bd78adabf32d78711c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral4
    • Target
      flomo.exe
    • Size 193.6MB
    • SHA256 e32ad3654b38a13decd093db82b75e44e4bcd4b836c816d27488eb1828c33ae5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdefense_evasiondiscoveryexecutionhijackloaderloaderpersistenceprivilege_escalationspywarestealer

    • Detects HijackLoader (aka IDAT Loader)

    • Family: HijackLoader, IDAT loader, Ghostulse,

      HijackLoader is a multi-stage loader, first seen in 2023.

      loaderhijackloader

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral5
    • Target
      libEGL.dll
    • Size 492KB
    • SHA256 0b739a65ca84923639657f9d8bb646d00e07bcc732a9eaa22ed809f740185485
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral6
    • Target
      libGLESv2.dll
    • Size 7.6MB
    • SHA256 1331f4c6909dbf154e54510dd368fb01011e88086aed310cf3ed172ec91595c2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7
    • Target
      resources/app.asar
    • Size 40.4MB
    • SHA256 7a534b6f952b592b65863cc37d134090dcd5dc77e778521494794ab280325469
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral8behavioral9
    • Target
      vk_swiftshader.dll
    • Size 5.3MB
    • SHA256 fa5aedd749117ec4c68727c83ff138aa51c8ad984092c7b1f3b06c88f0fe6114
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10
    • Target
      vulkan-1.dll
    • Size 897KB
    • SHA256 e85e73e823fafee6998106da4d4e1504cd9f2eb8d1cc8bf4d8b69d5b1e6da35a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

JavaScript

1
T1059.007

Windows Command Shell

1
T1059.003

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Process Injection

1
T1055

Defense Evasion

Modify Registry

1
T1112

Process Injection

1
T1055

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Tasks