Overview

overview

10

Static

static

10

DotNetHost...er.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    silver_only.zip
  • Size 11.0MB
  • Sample261104-hpkzbscg32
  • SHA256 ec0af26e7da82f39a13b8d39dea35688e70e8e1126d9d2c50c08fd49de79bc2c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
hijackloadernetsupportdefense_evasiondiscoveryloaderprivilege_escalationratrevoked_codesign

Malware Config

Extracted

Family

  • hijackloader

Attributes
  • directory

    %APPDATA%\libiot

  • inject_dll

    %windir%\SysWOW64\input.dll

xor.hex

Targets

    • Target
      DotNetHost660/Analyzer-Silver.exe
    • Size 2.5MB
    • SHA256 3456a4234d3d844ecb921c0fe21a06b052a67936264fc5ec7fa7470abbfee84f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryhijackloadernetsupportloaderprivilege_escalationrat

    • Detects HijackLoader (aka IDAT Loader)

    • Family: HijackLoader, IDAT loader, Ghostulse,

      HijackLoader is a multi-stage loader, first seen in 2023.

      loaderhijackloader

    • Family: NetSupport

      NetSupport is a remote access tool sold as a legitimate system administration software.

      ratnetsupport

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks