hijackloader | bfddf99bc783d732aeb8df6d9daa359a536fa4829f355f30c2f194916eb470df

Sharing

Copy URL Twitter E-mail

General

Target
HashManager64.zip
Size 3.6MB
Sample261012-ppjvlacf69
SHA256 bfddf99bc783d732aeb8df6d9daa359a536fa4829f355f30c2f194916eb470df
MD5 0b961c4f73484a1c3bac5085cfa115d8
SHA1 116cdde5ca745979219cc903749651be1a263e1c
SHA512 1eccebac25e8467e3aa62064ef5bc5e8ea1bc78380c9828ae86474838f874678cfb18ee3300b998b6b683a598f1cf39b5a8453ff3223c874e81361ee972253b8
SSDEEP 98304:FxLIYcWVNBFyeaOz4J9G5+AnXE57mMGBTAhX9A:EU3Tb4Jg5pVjAZW
TLSH
T1D3063398E5A4C907600F76FA1BB7B8E8E7D168E1E240B3E5481316C6FBC5143573B2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\TemporalSearch
inject_dll
%windir%\SysWOW64\pla.dll

xor.hex

Targets

- Target
  HashManager64.exe
- Size 3.6MB
- SHA256 ac7bfdcccd7ac9216aa95626f52e01dfe7ea9881577de3733f3661ae0c683e20
- MD5 627a003577e467fc40ad0ce7182f8af2
- SHA1 8b16a9f195ee44927fcf36e0fa9e462ae02d53a0
- SHA512 4e6305eddb435091ee1edff888e84dd962850a57524bee9aec782d908b7b9911ce7321fcef893deeddabb74e0a4008900fd4b2447f3d3dfec4832df3b1d5fd65
- SSDEEP 49152:P5L+mmS+7LuPv4ECGOf2kq+AOYIgaWr6UryUFFjwvpC+KIVVSDi489cuAnT8hrqa:P5JmS+HuS/fK3bL8jClS
- TLSH
  T106065C62A385B53ED09B1A3B583BE714993E7F7139168C4B5BF4188C8F355813A3A34B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery hijackloader loader privilege_escalation
- Detects HijackLoader (aka IDAT Loader)
- Family: HijackLoader, IDAT loader, Ghostulse,
  HijackLoader is a multi-stage loader, first seen in 2023.
  loader hijackloader
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  Microsoft.VisualStudio.QualityTools.VideoRecorderEngine.dll
- Size 184KB
- SHA256 ad7ae1df63dc9f6ee4eabbeb4e9c0f98b2a1b1d69ad8bde9b564e998678310c4
- MD5 01dc40c8eed7ca14008da6adfb4eb476
- SHA1 6db3344864e00e7cbd27fa212a89b7db0e23d0f2
- SHA512 6b79efd89b22b3468a17cfd086c0a301980c72de9af8e7dcc2f23659cf84288f65bccee0ae1e4169a1b746f2e49f5d220bb16351066e22ab2c53e248e5d63449
- SSDEEP 3072:I3L+vYKVnpM9aBy37ItsUn0h05ilgCQzeioerIAy57dvCNVL1eCnQAM:npMMaMtF05pgvr87piek6
- TLSH
  T14704491076E48931E6FB1A36B876992A497F79220FE4E2DF1750166E1E316C0CE34B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  bResourceStrings.bpl
- Size 544KB
- SHA256 13608aa205e934e3e0b3ac504e1589a41285f9197f6f53be01c2bc59f46b6837
- MD5 e954c33a4f1d57ecf977f3409d3fe0ac
- SHA1 205691dda52b9becb59afbedf0e1739c0025f423
- SHA512 6e5ee88ae179adfe45e2e6d76c48a4c136630f5dd10f535a387ade271c8b91d2699efff6f4d49c12f02111feeea26a787e87486d876575d317356fae0fbf6d65
- SSDEEP 12288:7+oJnQ+k8oYgrhiE2sZmNePPip0fzSvsKpRjga+4:7+oJQ+k8oYg1iEBmNePip0fWvsKpRjVp
- TLSH
  T1AEC45F1163FE86A4F6F73F38ADF459104E7A7C67A934C19DC192084E8971E809AF0B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  msvcp_win.dll
- Size 480KB
- SHA256 4b218a354d58368cbbd884b58e6539ce38e54247eb6e0b5c67f202e9cec067a5
- MD5 66e604c9e8bb7fe0d02902c3c041e461
- SHA1 9dcb34d86fd45e75e34667183b0790676dce99be
- SHA512 c3027fd1b09c041b22750d302bc9f67cf88f82a082c3af792276ad34806b6b822286b9bebc51928a837cdeba3d00c06acd6cc3085c3c9cbd67a172df05bda923
- SSDEEP 12288:VDprVN3S7dLYu8AB5A5Pb4lGqLHK1BvSVJashUgiW6QR7t5s03Ooc8dHkC2esSaa:xpu7dLpA5j4nHKnKU03Ooc8dHkC2eraa
- TLSH
  T1C0A43C337A460AB1E48923B4328D536283F9EC654761A3C357DFF6A9BF152C06A336C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  ucrtbase.dll
- Size 1.1MB
- SHA256 e0bb6f1a8606fd8988f93255a5c69e89970da6a30ff60be22d3f90ac5d20e56b
- MD5 359a14ce507a0d0ada72127ae5e7d439
- SHA1 951b1fbc667ffed0b9961bc14a5e7c37bae52afc
- SHA512 d6151dc504aa469a275e2ffc25a014995c72dbcf6509e33a679202a5c3f0f4e8f7fe283ca46120cfe53f13cf0b2548e040ac1840fdb615986a9ca7497f7edec0
- SSDEEP 24576:th84y2E/fKgq25i20+cQAKEtP1zEaoBX8mcvIZPoy4EM2jk9i:P84vmZNAKEtP1wlbMjc
- TLSH
  T18F358C10BB88C0B7DCA971BD079DF67E09AD72900B28A8C37BF44BEED42C1C1A576559
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Process Injection

T1055

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects HijackLoader (aka IDAT Loader)

Family: HijackLoader, IDAT loader, Ghostulse,

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8