Extracted

Extracted

• • Target
    run.ps1
  • Size 774B
  • SHA256 188bf96438941262015afebdd25f93eacf7d107cbd2cea5e5ca3d9d646f16f5c
  • MD5 d0d97e787ca377bf8d7cb9b9f2cb3fed
  • SHA1 7401563d1eeed2b87d5adb5ae4a2ff1e37561c52
  • SHA512 89e3501aed38aedfbcc4c6f9debd1387bb47e44f41b6221f736ff7aa891e8de85aa12d6ab6ae7d3ad6f1bb907e138cb7cf859b84050290fede60b044c4e4cf3c
  • TLSH
    T10E01100EBD322A2882914706CF6393AEAD4B50FC055B020432FEC3159E2C81B4FEC334
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionhijackloaderloaderpersistenceprivilege_escalationspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1