Extracted

• • Target
    run.bat
  • Size 167B
  • SHA256 8ab002184fe90f4a4bfdd62de0984dddc98e9be59380899c7d8ce30c7f916f8a
  • MD5 fa6ce032c96f0a928b989ab1df105b8c
  • SHA1 06337ca207c3e81e4630ac5372936ddf77dabc5a
  • SHA512 0d9ad0c210dac95e53e123d1105336e40033dc72a5ccc824d4c8552c45b7557bdaea650bbe0f1ef7c6859994930e5cd04bb7ffeb1a6cb824a009eca23144fe9b
  • TLSH
    T1FDC080F3DC545D91074FD4E555437D59111511015F6942E9FFF304977C10524CC94596
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionhijackloaderloaderpersistenceprivilege_escalationspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1