hijackloader | a931342039167fb36f39e0e656edb218ebb72e2e67dad681d864c035b11ee7a3

General

Target
Etapa2_xHrlPhNmb_pass-infected.zip
Size 23.6MB
Sample261107-t9fe5aet5r
SHA256 a931342039167fb36f39e0e656edb218ebb72e2e67dad681d864c035b11ee7a3
MD5 ce77fc4a4c389e1d2d85f5c0e6271062
SHA1 e5f716b8258c3f683be87002234105ec524da617
SHA512 abc946515f068c2993716549c36e6a4dbc8a424358d1244b71500fb5cd9e57de155a610d19458fc872074caebb152b4bfead6b508401eb86b6163e051392f3ef
SSDEEP 393216:+yo5FAfpLGus9PoXPNHgrUs9n9fVw3LTrLVb94NLZvgZtkrdWw3wbq0UrY01nvmu:9+FOR5iPofNHEnB+XrJbuZvotWZwbq06
TLSH
T14A47334469478D210B9A1CB3EBF38540DE3FA6CF7A79EEDB35228D50920A2FC59E7510
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\LaisarisExperiences
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Targets

- Target
  session.yaml
- Size 13KB
- SHA256 86d4119b4763aba3c257d198ba0b945fc6795ac275d8b512b46c07ac9848b535
- MD5 a4585a434988951ecac7f6703d5ec5fd
- SHA1 a73ba906fae5d13807ce385afa3bb4e04c52c8a5
- SHA512 c090ea09c01e3d516438fbfbb45439cf0f35e23eda9a78e7ebfef732c55573e9fab06ebf1ceb3806f586baf429f73a920474ebf9645c2eead45b40fb6f0f7cd6
- SSDEEP 192:qYsn+bUeUZ02fK3+jaYUDUPzCh5SHMGUUOV3rEGRGTicKpCszD7/k30qFl:9+Z0Z3YFrC+HMHV7fGTicolZk
- TLSH
  T13B523B9507A0F612870C74795C24889DBBE3E6FDAF6290619A97FF5E3405BF98134C22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1
- Target
  stencil-setup.map
- Size 2.5MB
- SHA256 05cac5f8eb194527a7e635849314748407187bb99d973f2f8787de748614e111
- MD5 c4087458c0d7d487a5b36271cd2f02d4
- SHA1 6f4d1135957dfb12b0620432a82f51856f875377
- SHA512 a08462c3cdd35ca30c7014c41943e720201ba60671701484afe23781658d4513e59b02cc66f5e1479a399df71b89bb70042e738b4cb7fbe8b8b3628c02d0ebe8
- SSDEEP 49152:uy2aELJwluD4w7rBKrXcNTEohX7UJZSGYoZWBgDkmFoUuF2AbrY:NkJZDF7rwWwJZJQBggmkj3Y
- TLSH
  T178C523CDE88EFAF2D4AF11B322B080E687C5172C56EBB260D76DD946B89CB455430B4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  xHrlPhNmb.exe
- Size 4.1MB
- SHA256 7a51e99e405d712d1182389bd84220d65536a3b96fde1d20bd1d5592fc303f3f
- MD5 90768e2e28c82aa74fa934ea8c3e8e07
- SHA1 045aed0433762dbd8621eb53c8d368cc46436571
- SHA512 8fcde39f3bd9134e1aa33fe515d8bcf1a6f18d2528bd08bea26d05fd769b3a9e9c49d885a05108b5c0d232cee0866c36f81cddeddeba46c938d22475b0104c65
- SSDEEP 98304:vp+XtuTRvA/+yoanGI3llIYKkCUoe6955Bl:hEtCI/+yoanGI3lyR759Xb
- TLSH
  T12616390666980CF8F4669139C9064D26E6B37FD5236197DB3160BF673EE3AD41E3BA00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3