General

  • Target
    oct2.zip
  • Size 14.8MB
  • Sample261109-h24bfaay2y
  • SHA256 54297a9b17e5e21d4e8140a19bb61868e1911cf16553b61788a9b46ac324e1d1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Family
  • hijackloader

Attributes
  • directory

    %APPDATA%\WordpadDownload_v3

  • inject_dll

    %windir%\SysWOW64\input.dll

xor.hex

Signatures

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

  • Detects HijackLoader (aka IDAT Loader) 2 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • oct2.zip
    .zip 14.8MB
  • SmartLab.exe
    .exe 5.4MB
  • WebView2Loader.dll
    .dll 145KB
  • graphlog15.bak
    1.6MB
  • mfc140u.dll
    .dll 5.4MB
  • msvcp140.dll
    .dll 544KB
  • msvcp_win.dll
    .dll 624KB
  • particle_policy.dat
    17KB
  • ucrtbase.dll
    .dll 1000KB
  • vcruntime140.dll
    .dll 121KB
  • vcruntime140_1.dll
    .dll 48KB

oct2.zip

  • SHA256 54297a9b17e5e21d4e8140a19bb61868e1911cf16553b61788a9b46ac324e1d1
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Detects HijackLoader (aka IDAT Loader)