Extracted

• • Target
    d421ea33f2b56e665424dcb501dd4925fdf81307c94dc183a120886f6a978112.exe
  • Size 5.7MB
  • SHA256 d421ea33f2b56e665424dcb501dd4925fdf81307c94dc183a120886f6a978112
  • MD5 62352f4abbf89126b776e982e6abb2de
  • SHA1 145cec38750ce7052583e3f9b7018349828ea62a
  • SHA512 dd11eadcc74671c8336674beb5831b17866e1dfa6b94b907ac297a11040866daa3dbd3504d3d0bd4a23a3f5f2cc48d6bc7c081d67141c8b88d9dec4707ca36b6
  • SSDEEP 98304:+phBbxffWv0ZE2F0HMtJ6IKmfzWGeNgZNf6hqPD20FCTdH15YnxnE8O3xeu:+phB1ffG2gMtJ6Ijb5NShuDAsnmheu
  • TLSH
    T1AC56338177D4B8F2C166DE32DF8ED3114272D79980D20E8F2A6AAF052DC71F626075E9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryhijackloaderloaderprivilege_escalationspywarestealer

  • Detects HijackLoader (aka IDAT Loader)

  • Family: HijackLoader, IDAT loader, Ghostulse,

    HijackLoader is a multi-stage loader, first seen in 2023.

    loaderhijackloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2