General
- Target https://primedrivingschoolllc.com/
- Sample261112-2ql3kaxt7k
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://primedrivingschoolllc.com/
Resource
win10v2004-20260911-en
23 signatures
150 seconds
Malware Config
Extracted
Family
-
hijackloader
Attributes
-
directory
%APPDATA%\ZirixCore
-
inject_dll
%windir%\SysWOW64\mstscax.dll
xor.hex
Targets
-
- Target https://primedrivingschoolllc.com/
Detects HijackLoader (aka IDAT Loader)
Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Executes dropped EXE
Loads dropped DLL
Suspicious use of SetThreadContext