MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18a21ca3dd5a492f47ba194d8f238ee94d67bf6bceee6d5992b3174feabcef1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HijackLoader


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18a21ca3dd5a492f47ba194d8f238ee94d67bf6bceee6d5992b3174feabcef1f
SHA3-384 hash: 7c721fbaf87d24e0b87e13cf641bf9c9cbfe6b2651ff7517371f7a1366bc11bdf904a8adf5343eef5c90c46a81cb3025
SHA1 hash: bb69bd993349f8db1b55cedb38ec87bd609b693e
MD5 hash: 0a839b1215f4e37eefecaf8edfd9025c
humanhash: two-illinois-vegan-three
File name:file
Download: download sample
Signature HijackLoader
Create hunting rule
File size:6'526'748 bytes
First seen:2026-07-17 08:10:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 20dd26497880c05caed9305b3c8b9109 (31 x Adware.Auslogics, 28 x HijackLoader, 5 x Adware.IObit)
ssdeep 98304:jJoRb3aK2ayBzvcDSbgp1+8WES51qPzXQi3kjA8oyIG4hcDzGTkvIs04Lx+4d:jEadBzuSbgK8WtG3kjpxSSzGT+9Vd
TLSH T19A66330777D220B6FC32563724058020AE3E786C5FF5952A1EF5C2AD9F39684CFB2696
TrID 72.8% (.EXE) Inno Setup installer (107240/4/30)
9.6% (.EXE) Win32 Executable Delphi generic (14182/79/4)
4.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win64 Executable (generic) (6522/11/2)
3.0% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon b298acbab2ca7a72 (2'335 x GCleaner, 1'824 x Socks5Systemz, 67 x RedLineStealer)
Reporter Bitsight
Tags:dropped-by-gcleaner exe f HIjackLoader MIX9.file


Avatar
Bitsight
url: http://158.94.209.95/service

Intelligence

File Origin
# of uploads :
1
# of downloads :
151
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/dc543bc5-aaf2-48ac-960d-070b18a90125/
Detection:
HijackLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/74969/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a59e40b56bd89099b557d83
Tags:
dropper ramnit crypt smtp
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm base64 crypto embarcadero_delphi evasive expired-cert expired-cert explorer fingerprint inno installer installer installer-heuristic lolbin obfuscated packed reconnaissance
Link:
https://www.filescan.io/uploads/6a59e38c478f88daa9fbbba7/reports/ac8d27cb-954c-4801-a27e-6d46f1049e8b/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/18a21ca3dd5a492f47ba194d8f238ee94d67bf6bceee6d5992b3174feabcef1f
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-17T06:04:00Z UTC
Last seen:
2026-07-19T02:35:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/18a21ca3dd5a492f47ba194d8f238ee94d67bf6bceee6d5992b3174feabcef1f/results?tab=lookup
Malware family:
IDAT Loader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/42178ce6-45bc-48a4-8924-caaf719240a4
Score:
20%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/18a21ca3dd5a492f47ba194d8f238ee94d67bf6bceee6d5992b3174feabcef1f
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/0a839b1215f4e37eefecaf8edfd9025c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/18a21ca3dd5a492f47ba194d8f238ee94d67bf6bceee6d5992b3174feabcef1f/
Threat name:
Win32.Trojan.Kepavll
Create hunting rule
Status:
Malicious
First seen:
2026-07-17 08:10:59 UTC
File Type:
PE (Exe)
Extracted files:
21
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dcrbzi65ljes6r52dfgy6i4o5fgwpp3lz3xg2wmswmlu72v454pq._file
Verdict:
malicious
Label(s):
TinyUtility
Create hunting rule
Link:
https://reports.threatray.com/2aebdd17-23c0-4e80-9eb2-c10f2b4a3fde
Similar samples:
18a21ca3dd5a492f47ba194d8f238ee94d67bf6bceee6d5992b3174feabcef1f
HijackLoader
34877cb949d9465df94c8a7efd8e045ce25c835d65cc7c92ebf7cc241abf5065
HijackLoader
fbf7be017043471582fbe888052ad018d759c3d5ff25c27db07e4fce65a3d120
HijackLoader
Result
Malware family:
hijackloader
Create hunting rule
Score:
  10/10
Tags:
family:hijackloader credential_access discovery installer loader spyware stealer
Link:
https://tria.ge/reports/260717-j27jjafs3q/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
Browser Information Discovery
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Detects HijackLoader (aka IDAT Loader)
Family: HijackLoader, IDAT loader, Ghostulse,
Unpacked files
SH256 hash:
18a21ca3dd5a492f47ba194d8f238ee94d67bf6bceee6d5992b3174feabcef1f
MD5 hash:
0a839b1215f4e37eefecaf8edfd9025c
SHA1 hash:
bb69bd993349f8db1b55cedb38ec87bd609b693e
Link:
https://www.unpac.me/results/d3314955-b2e5-46a6-bb53-e8bc33ab19e0/
SH256 hash:
c7925da8f1bf342ff6d2a6ce3633e9cc8eba9f2a1983b63600880b25dc26048d
MD5 hash:
2f565df034af46a2b9fbc5364d627a51
SHA1 hash:
03ae68c3b15fb754b0fd6b555a6b17610abf50c7
Link:
https://www.unpac.me/results/d3314955-b2e5-46a6-bb53-e8bc33ab19e0/
SH256 hash:
c232f007222dc0cd8aa8156c06d75aae2e43544312ebf53d8da2a6582e7810bb
MD5 hash:
1246f9997e77a9ad4eb73efe8c1f79fe
SHA1 hash:
4bcbfc369f4874c57791e7aaf652eabad021f032
Link:
https://www.unpac.me/results/d3314955-b2e5-46a6-bb53-e8bc33ab19e0/
SH256 hash:
20e80893bfc0d7327a6788b89bc97d2844d6958f4566fbfe66d13dc456ca8849
MD5 hash:
b004a408401da9093691771b1d88541a
SHA1 hash:
d0566079e8253cc74efc6f63039434d4304daa28
Link:
https://www.unpac.me/results/d3314955-b2e5-46a6-bb53-e8bc33ab19e0/
SH256 hash:
3a07d29b99ab535d1f1ede7b5181d6e02a0dff739be5e3828d308940d0193c99
MD5 hash:
d16a388d7a4c702a406fd5a3f4cd3433
SHA1 hash:
ebdac8b777c1160992a4d869c579c0c608753aa7
Link:
https://www.unpac.me/results/d3314955-b2e5-46a6-bb53-e8bc33ab19e0/
SH256 hash:
1e8213c36ab1b5720f0e95f9c8d0309d0aceb201f5f8ac96a6e90c73e86eddf3
MD5 hash:
2f98870b68b2a42e89013f7c37027732
SHA1 hash:
f8edd14b2e9fa1c6b784822d1bf0432f5756cca8
Link:
https://www.unpac.me/results/d3314955-b2e5-46a6-bb53-e8bc33ab19e0/
SH256 hash:
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
MD5 hash:
e4211d6d009757c078a9fac7ff4f03d4
SHA1 hash:
019cd56ba687d39d12d4b13991c9a42ea6ba03da
Link:
https://www.unpac.me/results/d3314955-b2e5-46a6-bb53-e8bc33ab19e0/
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
Link:
https://www.unpac.me/results/d3314955-b2e5-46a6-bb53-e8bc33ab19e0/
SH256 hash:
8f0beb5863d190b7b2cfe7f506f3b721ab6b9e892337a133364f2ba710931b25
MD5 hash:
be3cc5717f5951662adb399d613f20cc
SHA1 hash:
f776bc4344ad59fbd6950d24d3aa6dddb3df215a
Link:
https://www.unpac.me/results/d3314955-b2e5-46a6-bb53-e8bc33ab19e0/
SH256 hash:
72cd446251fcb480db1ee748d160830e9760654bb51d0e1924dac6811b8bb28c
MD5 hash:
10fd6f0cc57d6127b1e86907f97a25ca
SHA1 hash:
0f58251807136044c4857668c62eccb73cfa5c58
Detections:
win_samsam_auto
Create hunting rule
Link:
https://www.unpac.me/results/d3314955-b2e5-46a6-bb53-e8bc33ab19e0/
Parent samples :
a8ca24a38e697ee4c2864e3c9c129101ba0c3394b5f173c23d1a599bb91d19e1
34877cb949d9465df94c8a7efd8e045ce25c835d65cc7c92ebf7cc241abf5065
18a21ca3dd5a492f47ba194d8f238ee94d67bf6bceee6d5992b3174feabcef1f
SH256 hash:
08a93ad91061aeda02121ae6a4fc9ec024f612e39626c615fd5f3765957608a4
MD5 hash:
2e259afb699d02eecfa0817e791e3324
SHA1 hash:
3873b36b6b1257dfa6543124383e932d553126a4
Link:
https://www.unpac.me/results/d3314955-b2e5-46a6-bb53-e8bc33ab19e0/
SH256 hash:
a6edb3fb6d21dd461da3767a7995034e208f7d6b08997f6cf7ee7b0ea833a8f0
MD5 hash:
cabb58bb5694f8b8269a73172c85b717
SHA1 hash:
9ed583c56385fed8e5e0757ddb2fdf025f96c807
Link:
https://www.unpac.me/results/d3314955-b2e5-46a6-bb53-e8bc33ab19e0/
SH256 hash:
68bee500e0080f21c003126e73b6d07804d23ac98b2376a8b76c26297d467abe
MD5 hash:
d4dae7149d6e4dab65ac554e55868e3b
SHA1 hash:
b3bea0a0a1f0a6f251bcf6a730a97acc933f269a
Link:
https://www.unpac.me/results/d3314955-b2e5-46a6-bb53-e8bc33ab19e0/
Malware family:
SHADOWLADDER
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/18a21ca3dd5a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/18a21ca3dd5a492f47ba194d8f238ee94d67bf6bceee6d5992b3174feabcef1f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

HijackLoader

Executable exe 18a21ca3dd5a492f47ba194d8f238ee94d67bf6bceee6d5992b3174feabcef1f

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/74969/

Comments