hijackloader | b01e31a7cb69f463d00c6ce59a2028948f8f9cb42df597d239adc4c560f7d208

Sharing

Copy URL Twitter E-mail

General

Target
new.zip
Size 31.7MB
Sample261101-vm2waaby9y
SHA256 b01e31a7cb69f463d00c6ce59a2028948f8f9cb42df597d239adc4c560f7d208
MD5 c0bb5687d8b580154ef01e9fab3d651a
SHA1 565682ad5f1b26542851e3346d4696c172e5a6b9
SHA512 31083099f7e40af76434c7d53cd5e5cbde7479c303a8f970cfb95dbda520369b70f64abf1b32eb3e83c8b2d62e064169ac9d3c1548cb49fe6ff2ea3611171771
SSDEEP 393216:gvhpefBCGHSQX93Jsv6tWKFdu9CCP/qfBrCPz+qT+k7Zg0NW2YomEGBtCktKHhFj:PD6+pk73yrtS
TLSH
T183777C4672950291C47BE13CCA8B8517E2B37C414B228BCF3A9DBA591F337E51A7FA05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\ScannerScheduler_v4_arm
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Targets

- Target
  Compiler_Digita.exe
- Size 6.0MB
- SHA256 bdb31ebe39c1a5217b2afd89c8a49ee92fd08534536e3390c3ddd319ea441e0f
- MD5 2178cb45c813eb64c8466ad6a4551d84
- SHA1 5dcc78087b26df7882fa682c99033ce2833474e4
- SHA512 81633c6afd2f3a688e4cc38708f4c68ebf02fe99179e1c257e8f82f515c10a577edf729e976cecea638f106c25b234e8ec0c7d49dd978d02a72f2ae52a803b70
- SSDEEP 49152:decyqNWp47s8jji2ZALFnxoCvajnkYR3WaYooJHfFgdcpEaq+VyGmAtcnDHYzV6l:jjiVaYJ92cmaqsyY2rYVjM
- TLSH
  T15956494AA9949794D48AF134E4DEE403C6B33D804D21552F7E8DFCF90F329994EE298B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery hijackloader sectoprat loader privilege_escalation rat trojan
- Detects HijackLoader (aka IDAT Loader)
- Detects SectopRAT aka Arechclient2
- Family: HijackLoader, IDAT loader, Ghostulse,
  HijackLoader is a multi-stage loader, first seen in 2023.
  loader hijackloader
- Family: SectopRAT
  SectopRAT also known as Arechclient2 is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  MSVCP140.dll
- Size 576KB
- SHA256 2cc02c5e6654aa9175d5963f811cac222f4a2604dc28553139c675b1a78995a7
- MD5 a11a1d761d757d367146f0f772632d8c
- SHA1 9fd3eee4c4111dc386510a930192d56a2e938dfe
- SHA512 6fbbb77766ee9846d6d3bde2ced5eeaafe721de5524a410a4821dfa6c08edbd00905bec2b9237b8f7986d6d06dbe444c5845130193da537cadaf29ea784c48e1
- SSDEEP 12288:fFrCZUcfGI/O+bE9krdFFM5lle0dkM4X2n08ukSIAg6wQEKZm+jWodEEVrR+:9rCZUNYX2nSkGg6wQEKZm+jWodEE9R+
- TLSH
  T1C1C4F823675901A0E1A5E3B861C38306D7F17C4A8312A3C792FBD6AD2F5B7D5A73B250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Qt5Core.dll
- Size 5.6MB
- SHA256 2925e5e2b386e6697cd42eda0afc6d3246f8b1d5005b5876670b36c3cd474ebf
- MD5 607a99dcc9e21d2300fda4455c0d8a81
- SHA1 b26427451ce3fb20c414c01e5576ff79d4a81e81
- SHA512 9d4412715fc368502acf97215d0aada6e2080806757b891c9a257c0e33405f9b187bd2124d7bb65127ea7523b3890209c383e1445b14a8afd0d23b0180e64361
- SSDEEP 98304:vy+r4abJ7g+QjT2Qt1zJsv6tWKFdu9CCJiDRnZy3/qf:K+r4abJ73QjT93Jsv6tWKFdu9CCJau/q
- TLSH
  T1F0568C47B6A70150D0B6C23CCAE7811BE6B2781187228ACF129DA74A5F777F1293F716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Qt5Gui.dll
- Size 6.3MB
- SHA256 afd95670974815e61d941ffa4bf69bc20d2dc60d6800e4d9d5058eebde062be9
- MD5 d6e43cb6441e91b181c0ae7b1f759a06
- SHA1 82a20b0e9b53b59c5dc90d1481f15172f4f8d936
- SHA512 7d5f4f7fb3d85fca70811fa9100ac75e416ce1248579396a25363d00f1db72f3b548193a5d4b72b145c0619bda8463117519842ba8044e7513203a8110daa9cf
- SSDEEP 49152:zrCUSiqD38zpqbmU0lRuwczVv85pjI672TS9U+mRYdJNa07YHOH28D2fXw0KGThW:zrCgpQwcTp5kqTdQfcfN7Zg0
- TLSH
  T10166288672596252C977E27E8B4F052EE1F3B85283428BC748559B480F737EA1B7FE01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Qt5Network.dll
- Size 1.2MB
- SHA256 be4dafdf0903d7844e667bdc682e2f46287717d831e7bcc04b4da60041cdbaa8
- MD5 fa35e8732eb2ab09c9a970f4001c207e
- SHA1 7da45263debfa03df8582b05113cf876937b39c9
- SHA512 e8b6f9614aa3e6c5bd45a818a74395cd7c7d557672c2b94dbdb50663ea9477169b9ad1987e5e372c2725ecb173f9327cd651c6feaeba8efa12185e44714ed2b4
- SSDEEP 24576:w3hEi0HyyIabm2mTl4bgDMY7PlHu9hmkaS9xzYK:H2aS2mTTD1emk7
- TLSH
  T163456B57B36142A5D0AAC139CB8BCA06E672700087669BDF6279CF592F737E2173E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Qt5Widgets.dll
- Size 5.2MB
- SHA256 5a89434353cded683c750124b25fce258550c091c051b33a1e73f42b81b25cef
- MD5 ca738e77373a5d21715bac3c3e63c786
- SHA1 98dc208af21dc1df800e85097b85d046250c327f
- SHA512 90afb6a2b9615d469456263a50f246fc6cc01256f2dabaa363d42305847d4b5cadf18f2309b2854f9ebf7a3ea88283b55f8e58525b7b5c08900d3f487dc0e74d
- SSDEEP 49152:6n/oO+x1vPV18zU522R9ATJDwDipYDRvS4dX1042CbiIZBwaNGOTtCktKHhFmTXs:IfqFNBtCktKHhFmbVY0C
- TLSH
  T1FC466A47B7A50184C56BD23CCA8BC617D6B2B0144B228BCF256A8F592F737E12E7E705
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  VCRUNTIME140.dll
- Size 83KB
- SHA256 2b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c
- MD5 1453290db80241683288f33e6dd5e80e
- SHA1 29fb9af50458df43ef40bfc8f0f516d0c0a106fd
- SHA512 4ea48a11e29ea7ac3957dcab1a7912f83fd1c922c43d7b7d78523178fe236b4418729455b78ac672bb5632ecd5400746179802c6a9690adb025270b0ade84e91
- SSDEEP 1536:U3qPWvVCMgfw2eeWqjOebgk0jIpePxd76LGYU8j6ecbolG8EB4h88ii0:U66dsFeeBGPj1L6LGY+ecboC/8ip
- TLSH
  T169837D4577E402BAE06BD074C0A29E47FB72B585873047DF036996AE0F53BE24E39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  libeay32.dll
- Size 2.0MB
- SHA256 afe52d1e3d599e8c5db06f9d60c94a7c4e7b411473faeec072d26e436f2eb209
- MD5 e2ea72ec7da1f8ab37ccce9d8520865d
- SHA1 983ab6c47f39fa6da110c144f822b3b99f279357
- SHA512 8a14a965047e5c8ae05dfdd594a8bdc5a998ac0247d671a4e576ee65ca787eee38e4fe09594d89be6e9a70e2698c91527c84076398c9afd1f1c64ad75734687d
- SSDEEP 49152:jGtlq9zVwASOORKBbY7tzMrbb8rNlxQspeTB3GIU6ikiDqtgsP:mRxDWspeTr+vqtg
- TLSH
  T16DA58D16AB5810E1D6BBC17C98778637A3F1B45603B0ABEB4B6886B80F53FC5537A740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  msvcp_win.dll
- Size 626KB
- SHA256 777d112d7e01a6b7d65f01e74bbd76dd4042614b2ba65a03ba12a661fe753481
- MD5 182d64877ec6ac8f0dcca0554f782e08
- SHA1 4c7002a605fcfb6dfe18ffd81a9958daac33c0bf
- SHA512 73e1bb8d43b6dc30846ebaf045abdcdbbf818bc098fd6dc80886c1f69bfbbee121c327ab1063704e7a69f2c543ae0afe09c4ad7179611825619d8adc29c3cd8b
- SSDEEP 12288:w+TTIwt0B5483RXXoTk3iUKQEKZm+jWodEEVUsS80v:58wdKnIk2QEKZm+jWodEEmsSN
- TLSH
  T1CFD41827BB5906A1D16693BCA5C74306E3F1BC054721A3C742EBE26D2F2B7C8673B650
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  msvcr120.dll
- Size 940KB
- SHA256 ad32240bb1de55c3f5fcac8789f583a17057f9d14914c538c2a7a5ad346b341c
- MD5 9c861c079dd81762b6c54e37597b7712
- SHA1 62cb65a1d79e2c5ada0c7bfc04c18693567c90d0
- SHA512 3aa770d6fba8590fdcf5d263cb2b3d2fae859e29d31ad482fbfbd700bcd602a013ac2568475999ef9fb06ae666d203d97f42181ec7344cba023a8534fb13acb7
- SSDEEP 24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
- TLSH
  T10525BE4676A106FAD463D2B4C9A79607E2B2B85B1530D7AF02E0866D3F23B30975F317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  ssleay32.dll
- Size 344KB
- SHA256 bdc9170cea7c45861391bae3cd57767c090ecf8b52b6b9af3cd6ed2305abef9d
- MD5 3ee69e78eec1906ee5b896e54b94291f
- SHA1 1c979d26b5983d149c96741a9105a972258fdbd3
- SHA512 549ee77f8bc100eaf3c136bf3c8af750ff0ae10f383e2c3b9325bbd49d32143e42b59ea5d056c27e3e17752b6f0fb6de70d154da6458f2a1a345e978effed5c6
- SSDEEP 6144:sHhGGNDfsOambwCr5DoxYOpmAzOgdUHKCz2A++ghmnlpnC+atKEIMaigjq+e3pWr:sHhGGNDfjDbwCrBoxYOpmAzOgdUHKCzI
- TLSH
  T14574395266704C85CCD3C278C2734AE3FB74BC2113799BC71B2A856E0F63BC56679269
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  ucrtbase.dll
- Size 1.3MB
- SHA256 491a68206038a66c97e5e98094923cc0e7529504e506c13d6996c2b57cae3d3b
- MD5 4be2b1c8948f2d8e479b859ea027fd86
- SHA1 710b2438fd71e50569e12af4a0bba3e2d38b8dad
- SHA512 d778c2c9826698fa8e7484010b26ef4dd77f1bc20f0599fb95f703fe3f3696135548d924694b0f703b424973f10520ec69673cb7e25fda843067e227ad635fab
- SSDEEP 24576:QM6VUOfZDUVOb+uifkfEee3siuEWBlwmN1v2PI/BoEzJszW75mxvSZX0ypOpTq1:QM622DUVOb+uiMfE+nzTv2ApvzHWpI
- TLSH
  T1AA55AE6576AD01E9C1BFD139C64B4A06E5B27C1503708ACB03E94E792E3BBE9177B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  vcruntime140_1.dll
- Size 43KB
- SHA256 da5d3440dd53261bffec0f9163a46eb12e46b2a4e1bd72dd1b62c6bca9cca280
- MD5 6fe223ce568d919f80bea233738d0628
- SHA1 d7bf5acfb4bed8b0790dfc617a9b6f899b484d4a
- SHA512 420bde4da4f2e9cb0b4a26c11a4cdb405656eaec6b9e8ebcfe8c6b71682dd02cea0a26ed01eea2295bf1b574ea7ec33e15b5b1cf742694ee8aeed07feb1e6543
- SSDEEP 768:RPWiU0RnpFSvzRz3wdAevN3lEWSPm1zw4:RPk7Z3wlplzD1zw4
- TLSH
  T168136C4597B84447E4A785B0C1E2DE57FE38FA926660828F0B64D16D2F53BC0EB3D31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  worker32.dll
- Size 23KB
- SHA256 eddefa41587574794940656e8c5140540b7eb42ab27a05fa8214159967c21b76
- MD5 13c5715b0a92d5f501babc6a89d069b8
- SHA1 c51ff769b284c577c0bc5412aab7ef307ccd4d67
- SHA512 3de44a4a7dc29a1b89108c6757e9e78ac7da0e85a2849354019c5e9c52529517b29119359587e58e02ad32dcf2ceceeeaca328e33b1ec5eb81f99700f01d65dc
- SSDEEP 384:lPrF3ugVvM4ye0lYFOT816W8Sdwe27fB0hqXWoAngRcbg2LJInci7:lP5mJ4OMT4ByhqXWnna17V7
- TLSH
  T15BB27DA37A283ECEEC142C7B4424D4D1466CB261FE1B41ABF1C91D0B742A5979E7DE83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Process Injection

T1055

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects HijackLoader (aka IDAT Loader)

Detects SectopRAT aka Arechclient2

Family: HijackLoader, IDAT loader, Ghostulse,

Family: SectopRAT

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26