Extracted

• • Target
    helm3301.msi
  • Size 10KB
  • SHA256 90bba4c2d5e07c42ebd2df49c2387a2a73bac01c970ddc9b7a98030c825b04a7
  • MD5 4784578eec43ea3911308721936f9a2d
  • SHA1 3aab5072884d01ccd25d8768a45cc6213093c882
  • SHA512 75c844de2ff0b2a8effe85cf78dbd38efec3e9a2ec7b3abea48da73c3195148ae35fea23221bbf2d1370333a13593c7e5457e467526594091ae5be7d8505a127
  • SSDEEP 96:5yWVNmdQhGAL/FCwQlM5Wu+8zL5EzP1zhrsqz5Uf2IpVreWHvbKSd95ApC9o10Uc:xSAz4wvTzL5KdrueI/OSNW0E8SA
  • TLSH
    T1A622D74979028A33C1015F318AA7074A47752C40DF8B260B3BFD735C6FBA5E475AA3E5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionhijackloadernetsupportinstallerloaderpersistenceprivilege_escalationransomwareratspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Family: NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2